✅ Three Months to Compliance: Industry Scrambles
The EU AI Act's high-risk system obligations take effect August 2, 2026, and a European Commission survey released May 15 reveals that only 34% of in-scope organizations have completed mandatory conformity assessments. The regulation classifies AI systems used in critical infrastructure, education, employment, essential services, law enforcement, migration, and democratic processes as high-risk, requiring documentation of training data provenance, bias testing, human oversight mechanisms, and robustness guarantees before deployment.
Penalties for non-compliance reach the greater of €35 million or 7% of global annual turnover, the steepest regulatory financial penalty in any AI regime globally. "This is GDPR-level severity but with GDPR-level preparation timelines, and history suggests that will be a problem," said Anu Bradford, Columbia Law professor and author of The Brussels Effect, in testimony to the European Parliament's AI Committee.
⚠️ The Standards Problem
A critical bottleneck is the absence of finalized harmonized standards. CEN-CENELEC JTC 21, the European standards body responsible for AI, is expected to deliver the first tranche of harmonized standards to the European Commission by late June 2026, giving companies roughly five weeks to align their systems. The standards cover risk management (based on ISO/IEC 23894), data quality (ISO/IEC 5259 series), and transparency documentation (ISO/IEC 12792).
Industry coalitions including the Information Technology Industry Council have requested a six-month enforcement grace period, arguing that retroactive compliance for systems already in production is impractical. EU Commissioner Henna Virkkunen has resisted blanket extensions but signaled openness to prioritized enforcement focusing on the highest-risk categories like biometric categorization and emotion recognition in workplaces.
🔓 Open-Source and SME Provisions
An ongoing debate concerns the scope of the open-source exception. The Act exempts free and open-source AI systems from certain obligations unless they are monetized or classified as high-risk, but the threshold for "systemic risk" GPAI models remains contested. Models trained with more than 10^25 FLOPs of compute are presumed to carry systemic risk, a threshold that Meta's Llama 4 and DeepSeek V4 Pro both exceed.
The AI Office has indicated it may issue guidance distinguishing between open-weight release and genuine open-source development processes when assessing obligations. French President Macron and German Economy Minister Habeck have both publicly urged the Commission to preserve Europe's competitiveness, particularly for startups like Mistral AI that depend on open-source distribution strategies.