The number — the EU AI Act already binds you, and a transparency breach costs up to 15 million euros or 3% of global turnover

Two obligations under the EU AI Act already apply. Article 4 (AI literacy), since 2 February 2025, requires that teams be trained in AI and that the company can prove it: a record, not an intention. Article 50 (transparency), since 2 August 2026, requires that content and decisions produced by AI be identifiable. A breach of that transparency falls under Article 99, which provides for up to 15 million euros or 3% of global annual turnover (the prohibited practices of Article 5 rise to 35 million euros or 7%, and incorrect information to 7.5 million euros or 1%); for an SME, the lower amount applies. What a leader should be able to show today comes down to four items: an inventory of AI uses, including the ones no one declared; a charter; a training record; and the labeling of generated content. One point on timing: the provisional “Omnibus” agreement (May 2026) gives generative AI already on the market before 2 August 2026 until 2 December 2026 to add machine-readable marking (Article 50(2)). The Institute’s read: governance is not a brake on execution, it is what makes it defensible, to a board, to a client, to a regulator.

Source: Regulation (EU) 2024/1689 on artificial intelligence, Articles 4, 50 and 99.

Further reading: The EU AI Act: what applies to your business, and when · Chief AI Officer (CAIO): Role and Alternatives.