EU AI ACT

OLYMPUS opened an institutional file on a statute. A law has no Big Five and no Dark Triad, and the unit does not invent them; what a law has is a text, an enforcement arm, and a drafting-room ledger. The AI Act is catalogued here as the blueprint — the world’s first comprehensive horizontal AI law, the statute every other jurisdiction now drafts against. The finding is the shape of the machinery, not the intent of its drafters: a risk pyramid whose banned tier arrives with its own exceptions pre-authorized, whose frontier tier draws the moat at a compute number, and whose fines were fully legislated before a single one had been issued. The numbers in the front matter are reach, entrenchment, and durability — a regulation outlives every parliament that votes on it.

Institutional Archetype

THE BLUEPRINT — The archetype is the statute that regulates a technology by drawing its map in advance. The AI Act does not train a model, run a platform, or remove a post. It sorts every AI system in the Union into four tiers — unacceptable (banned: public social scoring, certain real-time biometric identification, manipulative systems, workplace and school emotion recognition), high-risk (conformity assessment, logging, human oversight), limited (transparency — label the chatbots and the deepfakes), minimal (untouched) — and attaches fines of up to 35 million euros or 7 percent of global annual turnover to the sorting. That is the structural power: not any single enforcement action, but authorship of the categories inside which every AI deployment decision in the world’s largest regulated market is now made. The blueprint’s quietest feature is the one worth reading twice: the banned tier’s exceptions. Real-time biometric identification is prohibited — except for kidnapping victims, imminent terrorist threats, and suspects of serious crimes. The infrastructure is not forbidden. Its activation conditions are pre-authorized.

Mandate & Origin

The Act was proposed by the European Commission in April 2021, agreed in trilogue on 8 December 2023, adopted by Parliament on 13 March 2024 and by Council on 21 May 2024, and published as Regulation (EU) 2024/1689 on 12 July 2024, entering into force 1 August 2024 with staggered application. The record names its authors: co-rapporteurs Brando Benifei (S&D, Italy) and Dragoş Tudorache (Renew, Romania) for Parliament; Carme Artigas, Spain’s Secretary of State for Digitalization, leading the Council side of trilogue; Commissioner Thierry Breton and Executive Vice-President Margrethe Vestager for the Commission. The architecture, from the statute’s own text:

• Risk tiers: unacceptable → high-risk → limited → minimal, with obligations scaled to tier.
• Frontier/GPAI: general-purpose models above a 10^25-FLOP training-compute presumption carry “systemic risk” duties; open-source models get partial exemptions — but not systemic-risk frontier models (Article 53(2)).
• Penalties: up to EUR 35M or 7 percent of global turnover for prohibited practices; up to EUR 15M or 3 percent for GPAI breaches.
• The carve-out: Article 2(3) exempts AI systems used “exclusively for military, defence or national security purposes, regardless of the type of entity” — anything a member state declares national-security is out of scope. Civil-society groups (Access Now, EDRi, Amnesty) pushed for narrower language; member states with strong intelligence services kept it broad.

The dates, the tiers and the fines, in the Commission’s own words. The Commission’s AI Act page says “The AI Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with some exceptions”: “prohibited AI practices and AI literacy obligations entered into application from 2 February 2025” and “the governance rules and the obligations for GPAI models became applicable on 2 August 2025.” Of the bottom tier it says “The AI Act does not introduce rules for AI that is deemed minimal or no risk” (Commission: AI Act). The money is on the enforcement page: “Infringements involving prohibited AI practices are subject to the highest penalties,” “of up to €35 million or 7% of the offender’s total worldwide annual turnover, whichever is higher”; “Other breaches, including of the obligations for GPAI models, may result in fines of up to €15 million or 3% of total worldwide annual turnover, whichever is higher”; and for AI systems that answer a request for information wrongly, “up to €7.5 million or 1% of worldwide annual turnover, whichever is higher.” For a general-purpose model the AI Office can also ask a provider to “restrict the public availability of a model” (Commission: Enforcement of the AI Act). The Commission’s FAQ states the compute line and the carve-out in its own sentences: models “trained using a total amount of computational resources that exceeds 10^25 FLOP are presumed to pose systemic risks,” and “AI systems that are exclusively designed for military, defence or national security purposes are also exempt regardless of the type of entity carrying out those activities” (Commission: Navigating the AI Act). The grace period for models already on the market is one line: “By 2 August 2027, providers of GPAI models placed on the market before 2 August 2025 must comply” (Commission: guidelines for GPAI providers). The Union-law text itself, Regulation (EU) 2024/1689, is cited above through the Commission’s pages, since EUR-Lex puts a challenge in front of automated readers.

Funding & Backers

A statute has no funders; it has a lobbying ledger, and this one’s is public. The EU Transparency Register recorded OpenAI, Anthropic, and Google as direct meeting participants with Commission AI officials during the Act’s drafting; Corporate Europe Observatory’s October 2025 accounting put the tech industry’s Brussels lobbying at a record 151 million euros. The single best-documented purchase: in September 2022 OpenAI sent the Commission a seven-page white paper arguing GPT-3 should not be classified high-risk. TIME obtained it by freedom-of-information request and published in June 2023 — nine months during which OpenAI’s public posture was “regulate us, please.” The final text dropped the earlier-draft language classifying general-purpose systems as inherently high-risk and moved them into a separate, lighter regime built around codes of practice. The white paper asked; the statute answered. And the European flank ran through Mistral AI, whose EU policy lead Cédric O — France’s own former digital minister, barred by the French transparency authority HATVP until May 2025 from lobbying his former colleagues — lobbied them anyway against the foundation-model chapter, with a Mistral equity stake reported at roughly 23 million euros. The blueprint was drawn in public. The hands holding the other end of the pencil are in the register.

The enforcer’s side of the ledger. The Commission describes the AI Office as “established within the European Commission,” responsible with national market surveillance authorities for “implementing, supervising and enforcing the AI Act,” and says it “employs more than 125 staff” (Commission: governance and enforcement of the AI Act; Commission: European AI Office). The DSA pays for its supervisory arm with a fee on the supervised, capped at 0.05 percent of net income; the Commission pages read for this file name no equivalent fee on general-purpose model providers. The Board that coordinates the national authorities is “composed of representatives from the EU Member States,” the Advisory Forum is “representing a diverse selection of stakeholders, both commercial and non-commercial,” and the Scientific Panel is “an expert advisory body made up of 60 independent AI experts.” The funding question for this statute is therefore not who pays the enforcer; the pages read give no sign that the graded do. The ledger that matters is the one above, the lobbying that shaped the text, and the enforcement tier’s own dependence on Member States: the Commission itself says “Effective enforcement will also depend on Member States ensuring that national competent authorities are properly designated and adequately resourced” (Commission: IP/26/1714, 31 July 2026).

Institutional Voice & Intent

The voice is the proportionality register — the grammar of “risk-based approach,” “trustworthy AI,” and “legal certainty for businesses.” The statute speaks in tiers and conformity assessments, and the proportionality is real on its face: the Act regulates uses, not the technology, and the minimal-risk tier — the vast majority of AI systems — is untouched.

Stated intent: Protect health, safety, and fundamental rights from AI harms; harmonize one rulebook across 27 member states; ban the unacceptable, constrain the dangerous, label the synthetic; get ahead of a transformative technology before the catastrophe instead of after it.

Observed intent: Operate as an implementation calendar for who may build what — a compute threshold that makes open-sourcing frontier models into the European market economically irrational below the compliance capacity of a major corporation, a national-security carve-out that exempts whatever a member state declares exempt, and an export mechanism (the Brussels Effect, the same gravity that made GDPR the global privacy default) that ships the categories worldwide whether or not anyone else votes on them.

Gap: The stated and observed intents overlap wherever “high-risk” means the unarguable cases. The gap opens at the moat. The 10^25-FLOP line does not measure harm; it measures scale — and above it, compliance costs that incumbents absorb and entrants cannot. The companies that could afford compliance lobbied for the regime that made compliance mandatory, and the documented drafting history shows the heaviest provisions landing where the lobbying pushed them. Whether the blueprint is a guardrail or a moat is not decidable from the text, because it is both, simultaneously, in the same clauses. That is not a flaw in the design. That is the design working for everyone who paid into it.

Interest: What each position the Union’s AI regime argues pays, documented, with the Commission’s own best case. The positions are the Commission’s, quoted from its own releases and pages; the statute has no author to profile beyond the institutions named. Interest is a documented fact about a position, never a claim about motive.

• A voluntary Code as the route to compliance (the General-Purpose AI Code of Practice). Position: the Commission calls it “a voluntary tool,” published “on July 10, 2025” in “three separately authored chapters: Transparency, Copyright, and Safety and Security,” the last for the most advanced models only (Commission: GPAI Code of Practice). What it pays: the signatory list names AI Studio Delta, Aleph Alpha, Almawave, Amazon, Anthropic, Black Forest Labs, Bria AI, Cohere, Domyn, Dweve, Fastweb, Google, IBM, LINAGORA, Microsoft, Mistral AI, Open Hippo, OpenAI, Pleias, Reflection AI, ServiceNow and WRITER, and says xAI signed only the Safety and Security chapter; the document is the AI Office’s own instrument, so the office’s reading of the duties becomes the vocabulary of every signatory’s compliance file. Best case, the Commission’s: it is “designed to help industry comply” without being a rule. Convergence: the labs’ own words split. Anthropic: “After review, Anthropic intends to sign the European Union’s General-Purpose AI Code of Practice,” adding it is “still developing best practices for assessing the systemic risks identified in the Code” (Anthropic, 21 July 2025). Google: “We will sign the EU AI Code of Practice” (Google, Kent Walker, 30 July 2025). Meta’s name is not on the published list.
• Moving the high-risk dates (the AI Omnibus). Position: the Commission proposed on 19 November 2025 that “The timeline for applying high-risk rules is adjusted to a maximum of 16 months, so the rules start applying once the Commission confirms the needed standards and support tools are available” (Commission: IP/25/2718); Executive Vice-President Henna Virkkunen on the 7 May 2026 agreement: “we make it easier to innovate without lowering the bar on safety” (Commission: IP/26/1024). What it pays: providers and deployers in the listed areas, “biometrics, critical infrastructure, education, employment, migration, asylum and border control,” get until 2 December 2027, and “Certain privileges for small and medium-sized enterprises are extended to small mid-cap companies.” Best case, the Commission’s: “This sequencing will help ensure that technical standards and other support tools are in place before the rules start to apply.” Convergence: none documented in the first-hand sources read; the industry letters that asked for a pause were reported by the press and were not read here.
• Labelling and marking AI output (the transparency rules of 2 August 2026). Position: “Deepfakes (images, videos, or audio that have been edited or generated using AI) will have to be labelled,” and the Commission says the rules “give businesses clearer obligations and a practical way to show compliance” (Commission: IP/26/1714). What it pays: the Code of Practice on transparency of AI-generated content is the compliance route, and the Commission counts “more than 180 organisations” among its first signatories. Best case, the Commission’s: the measures “are intended to reduce deception and manipulation.” Convergence: Anthropic says it “signed the EU Code of Practice on Transparency of AI-Generated Content in July 2026” because “As of August 2, the EU requires AI providers serving its market to mark AI-generated content” (Anthropic: Claude text watermarking); Meta posted on 28 July 2026 that it is signing the same code because “it’s increasingly important that people have tools to help them identify it” (Meta newsroom). Meta, absent from the first list, signs the second.
• More Commission competence over systems built on general-purpose models. Position: “The Commission AI Office’s enforcement powers will be strengthened to support oversight of certain AI systems, including those built on general-purpose models and those embedded in very large online platforms and very large search engines” (Commission: IP/26/1024). What it pays: the Commission’s own office, which now supervises the systems offered by the same provider as a general-purpose model and those inside services designated under the DSA, a remit that touches the services the DSA file lists, among them ChatGPT, designated on 31 August 2026. Best case, the Commission’s: the interplay with product-safety law was “clarified, avoiding duplication.” Convergence: the same Commission supervises the same platforms under both statutes.
• The opposing faction’s position: the Act and the Code risk slowing Europe. Position: Google signs while saying it “remain[s] concerned that the AI Act and Code risk slowing Europe’s development and deployment of AI,” naming “departures from EU copyright law, steps that slow approvals, or requirements that expose trade secrets” (Google, 30 July 2025); Meta’s newsroom, summarising a talk by Joel Kaplan in February 2025, says he wants the EU to move away from an “overbearing approach to tech regulation” (Meta newsroom, 7 February 2025). What it pays: the three items Google names sit beside the three duties the Commission’s July 2026 release lists for every general-purpose provider, “a copyright policy,” a “sufficiently detailed summary of the content used to train” the model, and documentation for authorities; a narrower reading of them would lighten exactly those three duties. Best case, Google’s: it commits to work with the AI Office so the Code stays “proportionate and responsive.” Convergence: Google, which signed, and Meta, which is not on the list, are both on record against the weight of EU tech regulation, in Google’s case the weight of this one; the Commission’s own best case, in its releases, is that the three duties are the baseline.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

The AI Act is the second load-bearing statute of the European wing, and it inherits the machinery of the first. Its enforcement arm for frontier models is the EU AI Office, which has its own file; its sibling statute, the Digital Services Act, supplied the template — systemic-risk assessments, turnover-percentage fines, Commission-level supervision of the largest actors — and, in January 2026, supplied the courtroom too: the Union’s first proceedings against a frontier AI system (X’s Grok, over AI-generated non-consensual imagery) ran under the DSA, because the AI Act’s teeth had not yet engaged for that class of system. The Act completes the Western regulator set this drawer tracks — the UK AI Security Institute grades on voluntary access, US CAISI grades at the administration’s pleasure, and Brussels alone holds statutory fine authority over the models themselves. Brazil, Canada, and India are drafting against it. The rollout is tracked line-by-line on the AI Governance Tracker, and the full research base is The AI Governance Ratchet.

Actions & Leadership Choices

Founding purpose, judged on evidence — and the defense at full strength. The AI Act is the first serious attempt to govern a transformative technology before the catastrophic harm rather than after. Every prior technology in this drawer’s record — platforms, financial rails, biometrics — was regulated only after the bodies and the scandals. The harms it answers are real and documented: deepfake fraud, election manipulation, biometric surveillance creep. The attempt is genuine, the people who wrote it are not stupid, and the proportionality defense is honest: most AI systems in Europe face no obligation at all.

The enforcement record, where the conduct shows. The record to date is a calendar, not a docket. The prohibited-practices ban became applicable 2 February 2025; the GPAI obligations on 2 August 2025; the Commission published the final GPAI Code of Practice on 10 July 2025 — voluntary, a compliance-signalling instrument; the high-risk regime, originally due 2 August 2026, was deferred by the May 2026 Digital Omnibus to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in regulated products. And as of mid-2026, not a single public fine had been issued under the Act. The enforcement arm stood up, the national authorities stood up, the code was published and signed — the infrastructure is real, legally blessed, and fully staffed before it has prosecuted anyone. When Europe finally moved against a frontier system, it reached for the older statute instead. The capability is built first. The case comes later, if it comes at all.

The enforcement start, in the Commission’s own release. On 31 July 2026 the Commission announced: “From 2 August 2026, the European Commission’s AI Office, together with national authorities, will begin enforcing the Artificial Intelligence (AI) Act.” It adds “The AI Office can now enforce the AI Act’s rules for providers of general-purpose AI (GPAI) models,” and lists the risks it has in mind for the most advanced models, among them “loss of control, cyber offence, harmful manipulation and threats to fundamental rights.” It splits enforcement of the transparency rules and the prohibited practices three ways: the AI Office for systems offered by the same provider as the underlying general-purpose model and for systems integrated into designated very large platforms and search engines, the national authorities for the rest, and the European Data Protection Supervisor for Union institutions. It names the tools, a Complaint Tool, a Whistleblower Tool and a 60-member Scientific Panel, and “Professor Alessandro Abate of the University of Oxford’s Department of Computer Science” as Lead Scientific Adviser. It announces no investigation, request or penalty against any named provider. Executive Vice-President Henna Virkkunen is quoted: “Europe anticipated this development” (Commission: IP/26/1714). The entire public enforcement record under the Act is therefore a start date. By October the Office had moved past the start date: “The AI Office has already requested and received serious incident reports and sent requests for information on security practices” (Commission, 12 Oct 2026). No recipient is named.

The amendment, in three Commission documents. The proposal of 19 November 2025 tied the high-risk rules to the availability of standards, with a ceiling of 16 months (Commission: IP/25/2718). The political agreement of 7 May 2026 replaced the conditional trigger with fixed dates, 2 December 2027 for the listed areas and 2 August 2028 for “systems integrated into products such as lifts or toys,” and, in the Commission’s words, added a prohibition on AI systems that generate “non-consensual sexually explicit and intimate content or child sexual abuse material” (Commission: IP/26/1024). The Commission’s AI Act page says the amendment “entered into force on 27 July 2026,” six days before enforcement began (Commission: AI Act). The amendment moved the deadlines of the tier with the most commercial exposure outward by sixteen months, and moved a new prohibition and wider Commission competence inward.

The rollback test. The counter-evidence gets its paragraph: the ratchet reading predicts no reversals, and the wider record shows some — California’s SB 1047 was vetoed, the US AI Diffusion Rule was rescinded, Biden’s AI executive order was revoked outright. The AI Act itself, though, has moved in one direction only: proposed, agreed, adopted, in force, phasing in. No provision has been repealed. A statute of this size does not roll back; it gets amended, interpreted, and extended — and its categories (“systemic risk” arrived here from the DSA) have so far only propagated.

CONDUCT verdict: STATUTE-INSTRUMENT — CAPABILITY BUILT FIRST, CASE PENDING. A genuine first-mover statute with an honest proportionality defense, whose documented drafting was shaped by the regulated at record lobbying spend, whose banned tier ships with pre-authorized exceptions, whose compute threshold functions as an incumbents’ moat, and whose entire penalty apparatus was staffed and standing for two years before its first case. Judgment on what the machine does waits on the machine doing something; the machine itself is the finding.

Alliance Map

These run at the same time. The labs on the Code list are the labs the AI Office can now evaluate and fine; the same Commission supervises the largest platforms under the DSA and the AI Office’s remit reaches the systems inside them; the office’s ability to enforce depends, by its own release, on Member States resourcing authorities it does not control; and the identity layer both regimes assume, eIDAS 2.0, is built by the same Commission on its own timetable. The enforcement office of the model-control rulebook is, for now, a staffed department with a start date and no docket. The overlap is the finding, not a coordination claim.

Reach Assessment

Institutional: Maximum within its class. The first comprehensive horizontal AI law on earth, with fine authority over every frontier model sold into the world’s largest regulated market, and the drafting template for the jurisdictions writing theirs.

Memetic: Maximum. The Act’s categories — high-risk, systemic risk, GPAI, the compute threshold — are now the vocabulary of the global AI-governance debate, including in countries that will never enforce a line of it. The Brussels Effect does not export enforcement; it exports the grammar, and owning the grammar is upstream of every argument conducted in it.

Civilizational: High. The statute does not build AI systems and does not write their refusals. It decides which systems may exist in Europe, at what compliance cost, under whose audit — and it pre-authorizes the conditions under which the banned tier’s biometric machinery may be switched on. The recurring lesson of this file’s drawer, in statutory form: the category is the excuse, the capability is permanent, and a blueprint never resigns.

Score basis. Atk 8 is reach: the AI Office and the national authorities began enforcing the Act on 2 August 2026, the Commission’s enforcement page sets fines of “up to €35 million or 7%” for prohibited practices and “up to €15 million or 3%” for general-purpose model providers, and every such provider must document its model, keep a copyright policy and publish a training-content summary (Commission: Enforcement of the AI Act; Commission: IP/26/1714). It is not a 9 because the Commission’s own release announces a start date and no case: the fining power exists and has not been exercised against a named provider. Def 9 is funding insulation: the enforcing office is “established within the European Commission,” the Commission pages read name no supervisory fee on the providers, and the change to the timetable the Commission describes came from the Parliament and the Council (Commission: governance and enforcement). It is not a 10 because enforcement “will also depend on Member States ensuring that national competent authorities are properly designated and adequately resourced,” in the Commission’s words, and the high-risk dates were moved by sixteen months in an amendment the Commission calls simplification. Hp 9 is entrenchment: a Regulation of the Parliament and the Council applies in all Member States, and the amendment that arrived added a prohibition and widened the Commission’s powers while moving two deadlines (Commission: IP/26/1024). Peers on the same values: UK Online Safety Act at 8/9/9, hazard 84, which has a statutory regulator that has already enforced, where this file’s statute has a regulator with a start date and a wider remit over the models themselves; and BlackRock at 8/9/9, hazard 84, an asset manager with no statutory authority over any provider, where this file’s subject is the statute. The two points of hazard above them are the model-level fine authority. One step below, EU AI Office at 8/8/7, hazard 82, holds the same enforcement power with less insulation and less durability, because an office can be reorganised by the Commission that houses it and the statute cannot. One step above, the EU Digital Services Act at 9/9/9, hazard 88, has already fined three named platforms, which is the reach this file’s statute has not yet shown. The values hold.

Sources: Regulation (EU) 2024/1689 — EUR-Lex; Regulatory framework for AI — European Commission; The AI Act — artificialintelligenceact.eu (FLI); Implementation timeline — artificialintelligenceact.eu; Article 2 — artificialintelligenceact.eu; Article 53 open-source terms — EUR-Lex; Artificial Intelligence Act — European Parliament Legislative Train Schedule; Council and Parliament strike a deal on the first worldwide rules for AI — Council of the EU, 9 Dec 2023; Exclusive: OpenAI Lobbied the E.U. to Water Down AI Regulation — TIME, 20 Jun 2023; Big Tech lobbying is derailing the AI Act — Corporate Europe Observatory, Nov 2023; Trojan horses: how European startups teamed up with Big Tech to gut the AI Act — Corporate Europe Observatory, Mar 2024; Revealed: Tech industry now spending record €151 million on lobbying the EU — Corporate Europe Observatory, 29 Oct 2025; Mistral AI’s Cédric O Pushed to Loosen EU’s AI Rules — Bloomberg, 13 Dec 2023; Introduction to the Code of Practice — artificialintelligenceact.eu; Enforcement of Chapter V under the EU AI Act — artificialintelligenceact.eu; EU Commission to open proceedings against Grok — RTÉ, 26 Jan 2026; EU investigation into Grok may expose problems with DSA — Compliance Week; The AI Act: application timeline and Omnibus — European Commission; Enforcement of the AI Act — European Commission; Navigating the AI Act — European Commission FAQ; European AI Office — European Commission; Governance and enforcement of the AI Act — European Commission; General-Purpose AI Code of Practice — European Commission; Guidelines for providers of GPAI models — European Commission; Commission proposes the Digital Omnibus, IP/25/2718, 19 Nov 2025; EU agrees to simplify AI rules, IP/26/1024, 7 May 2026; Commission starts enforcing AI Act rules, IP/26/1714, 31 Jul 2026; Anthropic to sign the EU Code of Practice, 21 Jul 2025; How Claude’s text watermarking works — Anthropic; We will sign the EU AI Code of Practice — Google, 30 Jul 2025; Meta is signing the EU AI Act Code of Practice on Transparency of AI-Generated Content, 28 Jul 2026; Joel Kaplan on EU Regulation and Innovation — Meta, 7 Feb 2025; EU AI Office; EU Digital Services Act; eIDAS 2.0 / EUDI Wallet.