The question in that headline is fair, and it is not rhetorical. Two things are true at the same time. The Union now has inspectors, deadlines and fines where it previously had only a long text. It also depends on companies outside its jurisdiction to let those inspectors look at the models that matter most.
What is enforceable since August
Enforcement of the AI Act became possible in August 2026, after several rounds of delay. The obligations that came due first are the transparency rules in Article 50: deepfakes and other synthetic media have to be labelled visibly, and machine-generated content has to carry a marking that a machine can read.
The heavier duties were postponed. Under the Digital Omnibus on AI (Regulation EU 2026/1744), the high-risk obligations for systems listed in Annex III now start on 2 December 2027. Schools, hospitals, HR departments and public offices that expected audits this year have roughly fourteen more months to prepare. The Commission's own overview of the framework reflects the revised calendar.
Thirty-plus information requests
What has already changed is the paperwork. The Commission has issued more than 30 formal requests for information to AI providers, covering copyright, cybersecurity and safety. Voluntary draft codes of practice and self-assessment are no longer the working framework. General-purpose AI sits under binding compliance, supervised centrally by the Commission's AI Office and by national market surveillance authorities, with fines available.
A request for information is not a finding. It is a demand for documents, and it shows where regulators are looking: training data, copyright, and what happens when a model is misused.
The months-long wait to test a US model
The clearest limit appeared with Anthropic's "Mythos". The Commission asked for access so its own experts could examine the model, and the request was not met within the usual timeframe. Why is contested: neither Brussels nor Anthropic has published a full account of the delay, and the explanations that have circulated point in different directions.
So the enforcement chain has a weak link that no fine can fix. A regulator can order a company to hand over documents. It cannot easily compel a model owner outside the EU to open a system for inspection, and if a provider simply declines to serve the European market, the fine stays theoretical.
Critics point to two further gaps: the research and testing phase, before a system is placed on the market, and the years after a model is sold, when new versions, fine-tunes and plug-ins change behaviour faster than any compliance file is updated.
What a document actually costs
Compliance work is paid for in tokens, and the price spread between models is now wide enough to matter for a small firm. Take a realistic job: a 300-page report at about 500 words per page, which is roughly 150,000 words. At the usual ratio of about 1.33 tokens per word, that is close to 200,000 input tokens.
| Model | Input price per 1M tokens | Cost for 200,000 input tokens |
|---|---|---|
| Mistral Large 4 | $0.68 | $0.14 (about €0.12) |
| DeepSeek-V4.1-Flash | $0.15 to $0.30 | $0.03 to $0.06 (about €0.03 to €0.05) |
| GLM-5.3-Flash | $0.075 | $0.015 (about €0.014) |
| Meta Muse Glimmer | open weights | hardware and electricity only |
Every figure above was taken from the provider's own pricing page in October 2026. Flagship US models are not listed, because the input prices we had could not be confirmed against the providers' current pages, and an estimated row would be worse than no row.
Euro figures are converted at about €1 = $1.10 and rounded. Output is the expensive half. Mistral Large 4 charges $2.09 per million output tokens, so a 2,000-token summary adds about $0.004. DeepSeek-V4.1-Flash, at $0.60 per million output tokens, turns the same summary into roughly $0.001. For a law firm or a municipality reading long documents every day, that difference decides which vendor gets the contract.
Open weights as an alternative
For a European organisation that does not want case files leaving the building, open weights are the practical route. Mistral Large 4, released on 6 October 2026, is priced at $0.68 per million input tokens and $2.09 per million output tokens through the API, and its weights can be run on EU-hosted sovereign infrastructure. DeepSeek-V4.1-Flash publishes open weights at $0.15 to $0.30 per million input tokens and $0.60 to $1.20 per million output tokens. Meta's Muse Glimmer is an open-weights release.
Running any of them locally is not free. You pay in hardware and electricity instead of per token, and the quality trade-offs are real. We keep a running record of what local models handle well and badly on our own hardware on the AI Arena page.
Where the scepticism comes from
Whether the AI Act is fit for purpose is now a testable question, and the testing has only just begun. The 30-plus information requests are requests. The high-risk regime does not bite until December 2027. The one frontier model Europe wanted to examine took months to reach.
For anyone selling AI into the EU, the incentive structure is clearer than the speeches. Market access is the lever. A provider that wants European customers files the documents. A provider that does not leaves the AI Act with little to grip. Article 50 labelling is the part of the law a European creator is most likely to meet first, and it is in force now.
Does the AI Act apply to a small European business that only uses AI tools?
The heaviest duties sit with providers, the companies that build and place models on the market. Deployers still carry transparency duties in some situations, and the Article 50 labelling rules apply to anyone publishing synthetic or manipulated content. A small studio that posts an AI-generated clip has to mark it.
Can the European Commission actually fine a company based in the United States?
It can open a case and impose a fine through the AI Office for general-purpose models, and national authorities can act within their own markets. Collecting that money from a company with no EU presence is the difficult part. In practice the leverage is market access: a provider that wants European customers accepts European supervision.
Which models can I run on my own computer?
Open-weight models are the ones to look at: DeepSeek-V4.1-Flash, Meta's Muse Glimmer, and Mistral's weights on EU-hosted infrastructure. Hardware needs depend on the model size, and hardware cost replaces per-token cost.
