The European Union AI Act reaches its full application date on August 2, 2026. With six days remaining, the regulatory landscape is defined by a mismatch: a comprehensive legal framework exists, but the mechanisms required to enforce it are largely absent. The law is binding. The infrastructure to verify compliance is not in place.
The current state of the EU AI Act is defined by three distinct gaps: institutional, organizational, and regulatory. Together, they leave high-risk AI systems operating in a market where the rules are written but the enforcement capacity has not materialized.
The institutional gap starts with Member States. As of late 2025, 12 had missed the deadline for appointing competent authorities — the bodies responsible for conformity assessments and technical documentation oversight under Articles 9-17. Nineteen had not appointed single points of contact. France, Germany, and Ireland had not enacted the required national legislation. The European AI Office coordinates, but it cannot substitute for localized enforcement. Without national authorities, there is no one to verify whether a high-risk AI system in the EU meets the Act’s requirements for risk management, data governance, or human oversight.
The organizational gap runs deeper. A Responsible AI Labs survey from April 2026 found that 78% of organizations had not taken meaningful steps toward compliance. More than half lack a basic AI inventory. Technical documentation — the foundation of the conformity assessment process — typically requires three to six months to build. The August 2 deadline is six days away.
The regulatory gap is the most recent and arguably the most disruptive. The AI Omnibus regulation entered into force in July 2026, extending high-risk deadlines to December 2, 2027, and product-integrated systems to August 2, 2028. But the original August 2, 2026 deadline remains legally binding for obligations not explicitly deferred. Which obligations fall into which bucket is not always clear. This compliance fog leaves organizations guessing about what applies now and what can wait.
Industry alignment is fractured. Twenty-six organizations — including Amazon, Anthropic, Google, IBM, Microsoft, OpenAI, Mistral AI, Cohere, and Aleph Alpha — have signed the GPAI Code of Practice, which offers a presumption of conformity. Meta has publicly declined. Separately, each Member State is required to establish at least one AI regulatory sandbox by August 2, 2026, under Article 57. That obligation, too, is unlikely to be met universally.
The security consequences are concrete. The Act mandates standards for accuracy, robustness, and cybersecurity for Annex III systems — biometrics, critical infrastructure, employment, law enforcement, migration, justice. But no competent authority exists in most Member States to verify whether providers are meeting those standards. Standardized security requirements without a verification mechanism produce a trust deficit, not security.
The financial exposure is real. Penalties for prohibited practices reach EUR 35 million or 7% of global annual turnover. Other obligations carry fines up to EUR 15 million or 3%. These apply extraterritorially: US companies placing AI systems on the EU market or providing outputs within the EU face the same obligations and the same penalties as domestic firms. Compliance costs for large enterprises run $8-15 million, with third-party certification exceeding $50,000 per system.
The pattern mirrors what Forkast documented in the SB 53 regulatory vacuum and the OpenAI rogue agent analysis (Post 128360). Legal mandates that lack operational enforcement infrastructure do not produce security — they produce gaps.
Six days from now, the EU AI Act will be law. The enforcement infrastructure will not be ready. The Omnibus extensions will not be resolved. The competent authorities will not exist in most Member States. The 78% of organizations that have not started compliance will not suddenly become compliant. The result is a market bound by rules that no one is positioned to enforce — at least not yet.