On 2 August 2026, the EU AI Act stops being a law with no bite. The Commission and the AI Office gain their supervision and enforcement powers, and for the first time the regulation can be acted on — with real fines behind it.
Here is the part almost nobody is saying out loud: most of the countries meant to enforce it have not finished setting up the machinery to do so.
The readiness gap, in plain numbers
The AI Act did not leave enforcement to Brussels alone. Under Article 70, every member state had to designate its own national competent authorities — the market surveillance body that actually investigates, orders fixes, and issues penalties — by 2 August 2025.
Most did not make it. By that deadline only around 8 of 27 member states had formally designated their authorities and single point of contact. Many months later, reporting still put a large share of member states in a grey zone: some with only partial designations, and several with no operational authority named at all. In other words, the referee for a huge part of the single market has still not walked onto the pitch.
Why the referee matters
It is tempting to shrug at this as Brussels bureaucracy. It is not. The national competent authority is the body that, in your country, receives complaints, requests your documentation, runs investigations, and imposes fines. If it does not exist yet, day-to-day enforcement in that country is patchy at best.
So the picture on 2 August is genuinely strange: a fully enforceable law, uneven ground to enforce it on. Some countries will be ready to act. Others will not be able to for months.
The trap for a small business
If you run a small company, the reasonable-sounding conclusion is “great, nobody’s watching, I can wait.” That is the trap.
Three reasons it is a mistake:
- Your obligations do not depend on your regulator being ready. Article 4 and Article 50 apply to you on their dates regardless of whether your national authority has been set up. The duty exists; only the speed of enforcement varies.
- The gap closes, and it closes backwards. Authorities are being stood up steadily. When yours is operational, it can look at conduct that was already non-compliant. “Nobody was enforcing it yet” is not the defence people think it is.
- Enforcement is not the only risk. Increasingly, the first person to ask “show me your AI compliance” is not a regulator at all — it is an enterprise customer running due diligence before signing with you. They do not wait for a national authority.
What it means, stripped down
The chaos is real, but it changes the timing of enforcement, not whether the rules apply. The businesses that read the headlines about unready member states and decide to do nothing are making a bet that the gap stays open forever. It will not.
- Article 4 (AI literacy) — in force since 2 February 2025. A one-page policy and a dated training record.
- Article 50 (transparency) — applies from 2 August 2026. Label your chatbots; mark your AI-generated content.
Neither of those waits for your country to appoint an authority.
What I would do this week
Do the quiet, boring thing while everyone else argues about who is in charge: assemble the record. Write the literacy policy. Date the training. Decide your disclosures for anything you ship. If a regulator — or a customer — asks tomorrow, you answer in minutes instead of panicking for weeks.
Not sure what applies to you? Start with the free 2-minute self-check → it tells you exactly which obligations are yours, then points you to the plain-language Handbook (€35) if you want the full walkthrough. Link: linktr.ee/frelih
This article was written by me and edited with AI — the kind of disclosure Article 50 is about. It is general information on the EU AI Act, not legal advice.
Ales Frelih 
Leave a comment