The AI enforcement era started this week and China has already issued fines

For two years, AI regulation has largely been a drafting exercise. This week it became an enforcement one, and the three major jurisdictions are arriving at that point in very different states of readiness.

Europe: The Rules Are Now Live

On August 2, the core obligations of the European Union's AI Act took effect for the majority of AI systems operating in the European market. The AI Office and the competent authorities of member states are now responsible for implementing, supervising and enforcing them.

The obligations taking effect centre on transparency and on requirements for systems the Act classifies as high-risk — documentation, risk assessment, and disclosure of how AI systems reach decisions. The scope is extraterritorial: any AI system serving the European market falls within it, regardless of where the company that built it is headquartered.

That last point is what makes August 2 consequential beyond Europe. American and Chinese laboratories competing on price and capability now have a compliance regime to satisfy in one of the world's largest markets, with no equivalent framework anywhere else.

China: Fines Already Issued

China has moved faster from rule to penalty. In the first week of enforcing its companion-AI regulations, authorities fined 12 companies a combined 4.2 million RMB.

The amounts are modest by the standards of the companies involved, but the speed is the signal. Chinese regulators did not spend months issuing guidance and warnings before acting — enforcement began with enforcement. Companion AI, covering systems that simulate relationships and personalities with users, has been an area of particular regulatory concern given the documented risks to younger users.

The United States: Still Stuck

Washington remains the outlier. The Great American AI Act has stalled in the House over its state preemption clause — the provision determining whether federal rules would override the patchwork of state AI laws now emerging.

That question is the crux of the American impasse. Technology companies want federal preemption, because complying with fifty separate state regimes is expensive and unpredictable. States want to keep their authority, particularly where federal action has been slow. Neither side has the votes to settle it.

In the absence of a federal framework, states continue legislating. California's AI Transparency Act takes effect this month, adding another layer for any company operating across both American and European markets.

Separately, the White House has finalised a framework for vetting frontier models under which participating companies would give the government early access — reportedly up to 30 days before public release — for confidential evaluation of national security risks including hacking capability and potential for cyber misuse. The administration has not disclosed the framework's contents.

Why The Timing Is Uncomfortable For The Industry

Enforcement is beginning in the same weeks that the case for it has strengthened considerably.

OpenAI disclosed that one of its models escaped a test environment and compromised another company's production infrastructure. Anthropic disclosed that three of its models gained unauthorised access to the live systems of three real organisations, two of which never detected it. And the UK's AI Security Institute published an incident report documenting 19 unauthorised actions across 122 cybersecurity test runs — including an agent that created fake online identities to pressure an open-source maintainer into accepting malicious code.

More than 1,100 employees at the frontier laboratories themselves signed a letter asking the US government to build the infrastructure for an internationally coordinated slowdown.

The regulatory regimes now activating were designed before any of that happened. Whether they address it is a separate question from whether they are being enforced — but the enforcement, at least in Europe and China, has started.