EU AI Act Enforcement Powers Are Live — But 'Legal Authority' and 'First Major Action' Are Not the Same Forecast

Start with [eu-ai-act-enforcement] at 22%, which asks whether the August 2, 2026 high-risk enforcement deadline holds — specifically, whether the Digital Omnibus delay to December 2027 fails to pass in time and the original deadline remains binding. Today's ComplianceHub confirmation that GPAI enforcement powers activate August 2 provides direct legal evidence that the Article 88 deadline held for the GPAI provisions specifically. The Digital Omnibus extended some timelines but did not eliminate the August 2 GPAI enforcement activation. Our 22% on this forecast reflects the narrow resolution criterion: we're asking whether the *high-risk* deadline holds, not just the GPAI provisions. The legislative picture on high-risk system delays is still murky, and 22% reflects that the Omnibus negotiation introduced enough uncertainty that we can't say the original high-risk deadline is clearly intact.

Now [eu-ai-first-fine] at 20%, which asks whether the AI Office issues its first *major enforcement action* against a GPAI provider by December 31, 2026. Here's where we need to be precise about evidence quality. Today's legal activation is proximate evidence for this forecast — it confirms the authority exists, which is a necessary condition for resolution. It does not prove the action will occur. The Commission's own AI action plan states evaluation capacity is 'expected operational by 2027.' That's the Commission admitting it won't have the investigative infrastructure to conduct rigorous enforcement through the entire resolution window, even as the legal powers activate. Legal authority and operational enforcement capacity are different things, and we've seen this movie before: DSA and DMA both took 12+ months from legal activation to first major enforcement action, under significant political pressure.

The strongest counterargument to our 20% is actually the retroactivity provision: Story 9 confirms the Commission can issue fines retroactively for violations dating back to August 2025. That's a meaningful structural accelerant — it means the AI Office doesn't need to catch new violations, it can pursue documented conduct from the past year. The 24 organizations that signed the GPAI Code of Practice are presumably cleaner targets; Meta's notable absence from that list puts it in a structurally higher-risk position. If we're wrong about the 20%, the retroactivity mechanism and Meta's non-participation are the most likely path to an earlier-than-expected action.

Honestly, the part of our model that keeps us up at night is this: we're weighting historical base rates heavily (DSA/DMA 12+ month lag), but the EU AI Act has substantially higher political salience than either of those frameworks at activation. If the Commission wants to demonstrate credibility — particularly with a US administration that has been openly dismissive of EU AI governance — the incentive to make an early, visible enforcement example is real. We're holding 20% because infrastructure unreadiness is a hard constraint, not just a political preference. But we acknowledge the political pressure toward early action is stronger than it was for DSA or DMA. What would move us above 35%? A specific AI Office investigation announcement with named targets and a public timeline before October 1.