A drug cannot reach a pharmacy without passing through a regulatory gate that measures its chemistry, its trials and its manufacturing line. A foundation model, by contrast, can reach a hundred million users before anyone has read its training data receipt. The European Union's AI Act was designed to close that gap. With full application now in force, the question is no longer whether the rules exist. It is whether they will reshape the market or merely reshape the paperwork around it.

The Text, Not the Headline

The Act entered into force on August 1, 2024, with a phased timetable: prohibited practices became enforceable within six months, general-purpose AI obligations on August 2, 2025, and the full regime — including high-risk system conformity assessments — on August 2, 2026. The substantive burden falls on providers of high-risk systems and on deployers in regulated sectors. The compliance cost is not a line item; it is a structural reconfiguration of how models are documented, tested and released. Providers who treat the Act as a checklist will discover, as their GDPR counterparts did, that the checklist is the beginning of the work, not the end.

The Documentation Tax on Open Weights

The most underreported consequence is the pressure the Act places on open-weight distribution. Article 53 requires providers of GPAI models to produce and maintain technical documentation, a training data summary and, for systemic-risk models, an evaluation under the AI Office's ad hoc rules. For a closed provider, this is an internal cost. For a community releasing weights publicly, it is a liability surface that scales with every downstream fork. The Stanford 2025 AI Index reported that the number of released AI models grew substantially year over year, but compliance infrastructure did not grow at the same rate. The result is a market where open-weight releases increasingly migrate through corporate intermediaries who can absorb the documentation burden — a consolidation that the Act's drafters did not intend but whose text permits.

The Red-Team Industrial Complex

Conformity assessment for high-risk systems requires documented testing, including adversarial evaluation. A new class of third-party assessors has emerged to sell this service, and their growth is the clearest leading indicator of how the Act is being priced into the market. But there is no common standard for what constitutes an adequate red team. A provider can commission a favorable assessment, publish it, and claim conformity while the underlying evaluation methodology remains proprietary. The European AI Office has begun issuing codes of practice, but the gap between the letter of the Act and the operational definition of "adequate testing" is where most compliance disputes will settle. Buyers of AI systems should treat a conformity certificate as a necessary condition, not a sufficient one, and should demand disclosure of the assessor's methodology, not merely its conclusion.

Counter-Argument: The Innovation Drag

The strongest case against the Act is not that it is toothless, but that it is too heavy for the firms it is meant to protect. European startups building foundation models face a compliance load that their American and Chinese competitors do not. The counter-argument is not speculative: venture capital has already rerouted toward jurisdictions with lighter pre-market obligations, and European AI investment as a share of global totals has declined in recent years. A regulation that succeeds in making AI safer but fails to keep a domestic industry alive serves neither objective. The Act's defenders reply that the single market is the prize, but the prize only matters if someone is building inside it.

The Brussels Effect, Tested

Anu Bradford's The Brussels Effect (Oxford University Press, 2020) documented how the EU's regulatory reach extends beyond its borders because firms standardize globally on the strictest rule they face. GDPR became the de facto global privacy baseline for this reason. The AI Act is the first serious test of whether the same mechanism works for a technology whose development cycle is measured in months, not years. Early signals are mixed. Some multinationals are adopting EU-compliant practices globally; others are bifurcating their product lines, offering a stripped-down model outside the Union. The Brussels Effect requires that the regulated market be large enough to matter. For AI, that condition holds for consumer applications but weakens for enterprise and government procurement, where sovereign preferences and security classifications already fragment the market.

What the Regulators Actually Said

The Act's architects were candid about its limits. Margrethe Vestager, then-Executive Vice-President of the European Commission, stated at the time of political agreement:

"The AI Act is not the end of the journey, but the starting point for the governance of a technology that is developing at an unprecedented pace." — European Commission press release, February 2, 2024

That framing matters. It acknowledges that the Act is a first iteration, designed to be amended as the technology and the market evolve. The AI Office has been given rulemaking authority precisely because the text cannot anticipate every deployment scenario. Practitioners should read the Act as a living framework, not a finished code.

Counter-Argument: Enforcement Theater

Skeptics argue that the Act's enforcement architecture is under-resourced relative to its ambition. The AI Office has a small staff relative to the number of models it must oversee, and national market-surveillance authorities vary widely in capacity. The risk is a two-tier regime: large providers are scrutinized, while smaller deployers — particularly in high-risk sectors like healthcare and employment — operate in a gray zone where the rules exist on paper but are rarely tested. The counter-counter is that enforcement always lags rulemaking, and that the Act's real power may lie less in fines than in the procurement standards it creates for public buyers, who will demand conformity documentation as a condition of contract.

What Operators Should Do This Quarter

  • Classify before you procure. Map every AI system in production against the Act's risk tiers. The highest-cost mistake is discovering a high-risk classification after deployment.
  • Audit the provider's documentation. Request the technical file, the training data summary and the conformity assessment. If the provider cannot produce these, treat the system as non-conforming regardless of its marketing claims.
  • Appoint a responsible officer. The Act requires deployers of high-risk systems (other than SMEs) to have sufficient human oversight. Name that human and give them authority, not just title.
  • Train the workforce on the Act's transparency obligations. Employees interacting with AI systems, and people subject to those systems, have rights under the Act. Front-line staff must know what to disclose and when.

The Six-Month Test

Regulation is not a product launch. It is a multi-decade negotiation between the state and the market. The AI Act is day one, not the finish line.