August 2 Arrived. Here's What the EU AI Act Actually Enforced, and What Got Punted to 2027.

The August 2 deadline came and went without fireworks. No dawn raids. No headlines about seven-figure fines landing on day one. The compliance apocalypse that consultancies had been selling for 18 months turned out to be more of a drizzle.

But don't confuse quiet with nothing.

I spent the week watching what platforms actually shipped, what regulators actually said, and what builders actually need to care about. The short version: the scary stuff got delayed. The annoying stuff did not. And if you're embedding AI in client-facing apps, you now have obligations that didn't exist on August 1, whether your platform mentioned them or not.

What actually changed on August 2

Three things to sort out now. None of them were optional.

Article 50: transparency obligations. If your app uses an AI chatbot, generates synthetic images, or produces AI-written content shown to EU users, you must now disclose it. The user needs to know they're interacting with an AI system. Content needs to be labelled as AI-generated. Deepfakes need to be explicitly marked.

This is not a suggestion. The maximum fine is €15 million or 3% of global annual turnover, whichever is higher. And unlike the high-risk stuff, this was not delayed.

GPAI enforcement powers. The European Commission can now open formal investigations into general-purpose AI model providers, issue binding corrective measures, and impose fines. If you're using a frontier model (think GPT, Claude, Gemini) inside your no-code app, the model provider now has regulators watching. That's mostly good news for you: someone else is getting scrutinised ahead of you.

AI literacy obligations. Article 4 has been live since February 2025 and still trips people up. It carries no dedicated fine of its own, but national authorities can sanction infringements, and regulators will weigh it against you alongside any other breach. If you deploy AI systems and can't show you've trained your staff on how they work, you've got a documentation gap.

Also worth remembering: prohibited AI practices (Article 5) have been enforceable since February 2025. Social scoring, untargeted facial image scraping, emotion recognition in workplaces and schools. All illegal in the EU already. The May 2026 Digital Omnibus deal added two more, effective December 2, 2026: AI-generated non-consensual sexual content and AI-generated child sexual abuse material. If your app touches any of these, you're not looking at a compliance deadline. You're looking at an outright ban, with fines up to €35 million or 7% of turnover.

What got punted to 2027 (and 2028)

Here's what most people actually worried about.

On June 16, the European Parliament voted 423 to 57 (with 174 abstentions) to approve the Digital Omnibus amendments. The effect: standalone high-risk AI systems under Annex III (AI used in employment screening, credit assessment, education scoring, law enforcement) now don't need conformity assessments until December 2, 2027. Systems embedded in regulated products (medical devices, machinery, etc.) get until August 2, 2028.

That's the delay everyone read about. It's real, and it matters. If you were panicking about CE marking your AI-powered HR tool before the summer, you can exhale.

But the delay created a dangerous misreading. I've spoken to builders who assumed "EU AI Act delayed" meant "nothing to worry about until 2028." That is wrong. The transparency rules, the GPAI enforcement regime, and the penalty architecture are all live right now. The Commission didn't delay the whole Act. It surgically delayed two compliance categories while leaving everything else on the original calendar.

One more twist buried in the delay, and it cuts the other way. Article 50's transparency rules all applied from August 2 with no grace period. The machine-readable marking requirement in Article 50(2) is the lone exception: systems already on the market before August 2 got a four-month transition, to December 2, 2026. Ship anything new and you owe the marking from day one. The headline was a delay. For anyone shipping generative features, there's still a hard date sitting in front of you.

What the platforms are doing (and not doing)

Here's where it gets interesting for no-code builders.

Most no-code platforms have been conspicuously quiet about the EU AI Act. Bubble points to GDPR documentation and a SOC 2 Type II certification, but I couldn't find a public EU AI Act compliance statement, transparency framework, or builder guidance specific to the August 2 obligations. Webflow has privacy documentation of its own, but nothing AI-Act-specific that I could surface. The same pattern holds across most of the no-code space: vocal on data protection, silent on AI regulation.

That matters because of how the Act assigns responsibility. If you build on a platform that doesn't handle AI transparency for you, *you* are the deployer. The labelling obligations fall on you. The disclosure requirements fall on you. The platform hosts your app; the compliance is your problem.

Stacker makes a different pitch. (I should disclose I write for nocode.tech, which is published by Stacker, so take what follows as the company's own positioning rather than something I've independently verified.) Stacker says its governance controls (permissions, audit trails, data residency, user portals) are built into the infrastructure rather than bolted on by the builder, and that for AI features this means transparency labelling, usage logging, and access controls are platform-level concerns. The argument, and I think it's the right one, is that AI governance shouldn't be something a no-code builder DIYs. It should be something the platform absorbs.

We saw this pattern with GDPR. Platforms that baked compliance into their architecture (data processing agreements, encryption defaults, deletion workflows) made their builders' lives dramatically easier. Platforms that treated GDPR as a configurable add-on created endless grey areas. The EU AI Act is going to replay that dynamic. The platforms that build compliance into the product will win. The ones that publish a blog post and call it done will leave their builders exposed.

What builders should do now

If you're a no-code builder with EU users and AI features, here's the stuff that actually matters today:

1. Label your AI interactions. If your app has a chatbot, the user needs to know it's AI. A small "Powered by AI" banner or a disclosure in the chat interface is enough. Don't overthink this. But don't skip it either. The Article 50 obligation is about transparency, not perfection.

2. Mark AI-generated content. If your app produces images, video, audio, or text that's AI-generated and shown to users, label it. Machine-readable marking (metadata, watermarking) is preferred but not enforced for deployers until December. A visible label is the minimum viable compliance step today.

3. Document your AI literacy efforts. You don't need a certification programme. But you should be able to point to something (training materials, onboarding docs, internal guidelines) that shows you've addressed Article 4. National authorities are asking for evidence, not perfection.

4. Know what you're not. Most no-code builders are deployers, not providers. You're using someone else's AI models through someone else's platform. Your obligations are lighter than OpenAI's. Don't let compliance anxiety inflate your workload.

5. Pick a platform that's thinking about this. If your platform hasn't published anything about the EU AI Act by now, ask why. The transparency obligations were telegraphed two years ago. Silence is not a great sign.

The EU AI Act's initial enforcement deadline was smaller than predicted and bigger than the headlines suggested. The high-risk stuff got punted. The transparency stuff landed. The platforms that take governance seriously are building compliance into their architecture; the ones that don't are leaving builders to figure it out alone.

If you're on a governed platform with built-in compliance infrastructure, most of this is handled for you. If you're not, the checklist above is your starting point. And the penalties for getting it wrong are real. Not theoretical, not "someday," not "they'll never come after a small builder." The fines are on the books. The regulators have their powers. And the lone grace period, for machine-readable marking, was four months, not four years.

August 2 arrived. It wasn't the apocalypse. But it also wasn't nothing.