I am instinctively allergic to tech regulation written by people who have never shipped anything. A lot of the EU AI Act fits that description. It is late, convoluted, and parts of it will age badly. And yet, reading through what actually takes effect in 2026, I keep landing somewhere uncomfortable: most of it is the kind of thing the industry should have done on its own and did not.
What is actually landing
Strip away the acronyms and 2026 brings four concrete obligations for anyone shipping AI into the EU:
- Publish a summary of what your model was trained on, including how copyrighted material was handled.
- Respect copyright opt-outs. If a creator reserved their rights, you check, and you exclude or license.
- Label AI-generated text, images, audio, and video as artificial.
- Keep records and be able to show your work.
Penalties run up to 10 million euro or 2% of global turnover. That is real money, and it is aimed mostly at the model providers, not the small studio using their API.
Why I cannot just dunk on it
Look at that list again without the reflexive eye-roll. Tell people what you trained on. Do not ignore a creator who explicitly opted out. Label the fake video as fake. None of these are radical. Most of them are things a reasonable person would assume were already true, and was surprised to learn were not.
The Act best ideas are just the promises the industry made in blog posts and never kept.
The training-data transparency rule exists because labs treated their training sets like state secrets while quietly hoovering up everyone work. The copyright fights now grinding through the courts, the New York Times against OpenAI, Getty against Stability, are what happens when an industry decides permission is a problem for later. Regulation is what "later" looks like.
Where it will go wrong
None of this means the Act is good, exactly. It is vague where it needs precision and precise where it needs flexibility. "High-risk" categories will trap boring, safe systems in paperwork while genuinely reckless deployments find the gaps. Compliance will be easiest for the giants who can afford lawyers and hardest for the small teams doing interesting work, which is the opposite of what anyone wanted. And labeling rules assume a clean line between "AI-generated" and "human-made" that dissolves the moment you actually work this way.
The honest verdict
I would have written it differently. I would have written less of it. But I have stopped pretending the alternative was some golden age of responsible self-governance, because I watched the last three years and it was not. The Act is a clumsy answer to a real problem the industry refused to answer itself. Messy, late, and probably necessary. I can hold all three of those at once, and if you love this technology, you should too. The fastest way to get worse regulation is to keep giving regulators reasons to write it.