歐盟《人工智能法案》透明度規則生效，通用人工智能模型執法程序明確

The EU AI Act Just Started Biting: Transparency Rules Are Live and GPAI Penalty Procedures Are Locked In

As of 2 August 2026 the EU AI Act's Article 50 transparency obligations are in force and a new implementing regulation sets out exactly how Brussels can assess and fine general-purpose AI model providers — raising the compliance stakes for every company that builds with or deploys frontier models, whether they are in Europe or not.

What Is Now In Force
The obligations that switched on this autumn are the transparency rules, and they are deceptively simple to state and annoying to implement. Article 50 requires that when a person interacts with an AI system, they must be told they are talking to a machine. Synthetic content — text, image, audio, or video generated or manipulated by AI — must be marked in a machine-readable way so downstream systems and users can detect it. Deepfakes, emotion-recognition systems, biometric categorisation, and AI-generated texts on matters of public interest all carry specific information duties. For the millions of chatbots, image generators, and recommendation engines already live, this means watermarking pipelines, disclosure banners, and metadata standards that most teams bolted on as an afterthought now have the force of law.

The New Penalty Machinery
What makes this round genuinely new is the procedural backbone. Commission Implementing Regulation (EU) 2026/1755, published in the Official Journal on 21 July 2026, lays down the detailed rules for two procedures the Commission can now run against providers of general-purpose AI models: formal assessments of those models, and enforcement actions against their providers. Under the assessment route, Brussels can demand access to the model via an API, to the source code, to the weights, or to the hosting infrastructure, and can appoint independent experts subject to strict independence and confidentiality rules. Under the enforcement route, it governs how fines are initiated and concluded, when urgent interim measures can be ordered, and how a provider's right to be heard and to access its file is protected. In short, the EU now has a legally defined wrench it can turn on the biggest AI labs in the world.

Why This Is Depressing
For the industry, the mood is closer to dread than delight. The penalty ceilings are severe: prohibited practices can draw fines of up to 35 million euros or 7 percent of global turnover; most high-risk and core obligations up to 15 million euros or 3 percent; and incorrect or misleading information up to 7.5 million euros or 1 percent. Crucially, liability flows to deployers, not just providers — a law firm, bank, or insurer that calls an OpenAI or Anthropic model through an API is itself a regulated "deployer" with its own duties under Article 26, including, in credit, insurance, and public-sector contexts, a possible fundamental-rights impact assessment. Then there is the AI literacy obligation in Article 4, which requires organizations to train their staff, and the shifting patchwork of national competent authorities and notified bodies that vary in capacity across member states. Compliance is no longer a checkbox; it is a recurring operating cost with existential downside if botched.

Why It Is Also Quietly Exciting
Regulation is not only a tax; it is also clarity. After two years of ambiguous "soon" deadlines, companies finally know the shape of the wire they must not touch. The Commission's 20 July 2026 guidelines on Article 50 transparency give providers and deployers a concrete map of what to disclose and how. Regulatory sandboxes, mandated in every member state by 2 August 2027, offer start-ups and small firms fee-free space to test before market. And the EU Kids Act proposal, adopted on 17 September 2026, shows Brussels is extending the same "security by design" logic to minors interacting with social media, video platforms, and AI chatbots, with a feedback period open until 26 November 2026. For compliant players, a predictable rulebook is a competitive moat against less disciplined rivals.

What Companies Must Do Now
The practical sequence is unglamorous but urgent. Inventory every AI system in use, classify each by risk tier, draft or update an AI usage policy, and train staff on literacy obligations. For anything touching high-risk Annex III uses — recruitment, credit scoring, certain judicial applications — the deferred deadline of 2 December 2027 is the one to watch, but the scaffolding must be built now. Deployers leaning on third-party vendor models should demand declarations of conformity and training-data summaries in their contracts, because under the Act those obligations flow straight through the supply chain. The era of "move fast and ask forgiveness from no one" is, at least in Europe, over.