EU AI Act Enforcement Powers Live for GPAI Providers as Senate Commerce Advances KOSA and AI Chatbot Bills

August 2026 has been a watershed moment for international AI regulation, as the EU AI Act came into general application and became enforceable on August 2. While delayed application of some parts of the Act continues, the prohibitions in Article 5, the requirements for general-purpose AI models in Articles 53 to 55 and the transparency obligations in Article 50 can all now be enforced by regulators. Some regulators, notably the European AI Office, are already active in enforcing the Act and this trend is set to continue into the Autumn.

What Article 50 Requires Now

From August 2, providers must ensure people know when they are interacting with an AI system, mark synthetic content in machine-readable form, and disclose deepfakes. The Digital Omnibus on AI also adds a new Article 5 prohibition covering AI-generated non-consensual intimate imagery. Many US teams read the high-risk delay as a full reprieve — it is not. If a company has EU market exposure through a customer base, a subsidiary or a product that reaches EU users, chatbot disclosures, synthetic media labeling and content marking obligations are live now. The 2027 extension buys time for conformity assessments, not for transparency. On the same day, California's AI Transparency Act (CATA) became operative, sharing many similarities with Article 50 and creating a de facto global standard for labeling and tracing AI-generated content.

The Senate Commerce Markup

On August 5, the US Senate Committee on Commerce, Science and Transportation unanimously advanced its version of the Kids Online Safety Act (KOSA) with AI-related child protection provisions. The Committee also adopted other measures to impose more rigorous duties on platforms and AI providers in relation to children. KOSA imposes a duty of care on "Covered Platforms" — including online platforms, games, messaging apps and streaming services used or likely to be used by minors — when designing and implementing features such as infinite scrolling, autoplay, engagement-based rewards, push notifications, in-game purchases and appearance-altering filters.

The Three AI Bills

Alongside KOSA, the Committee advanced several targeted AI chatbot child safety measures. The Children's Health, Advancement, Trust, Boundaries, and Oversight in Technology Act (the CHATBOT Act) would require "family accounts" for under-13s using AI chatbots, with configurable controls for parents including disabling push notifications, blocking financial transactions, mandating clear labeling that a chatbot is not human, imposing usage time limits and setting data-retention parameters. The Youth AI Privacy Act (YAP Act) prohibits advertising and promotional outputs to minors via chatbots where there is a material financial connection, bans profiling of minors, and restricts the use or transfer of minors' data to train algorithms except for testing and mitigating harm. The Children's Artificial Intelligence Toy Safety Act would require the National Academies of Sciences, Engineering and Medicine to conduct a study regarding AI-enabled toys.

The Cruz Amendment

Before the YAP Act vote, Cruz moved to add an amendment proposing to eliminate the bill's 30-day maximum retention period for a chatbot to recall interactions with a child user and an automatic deletion by default clause. Cruz's amendment ultimately passed 15-13 along party lines. "The bill proposes a one-size-fits-all limit on how long a chatbot may remember its interactions with a child, capping overall memory protection at 30 days," Cruz said. "A default period for memory retention makes sense, but parents must also be able to choose a different period or opt out of automatic deletion." Sen. Ed Markey, D-Mass., the YAP Act sponsor, said he opposed Cruz's amendment but was willing to allow for up to a 30-day extension of a chatbot's memory retention period.

What to Watch Through Year-End

Three checkpoints follow. The full Senate floor vote on KOSA — which previously passed 91-3 in the prior Congress — will be the first live test of whether the new AI chatbot bills travel together as a package. The European AI Office's first request-for-information to GPAI providers, expected before the end of Q3 2026, will be the first concrete enforcement action under the new Article 50 and Article 101 powers. And the Great American AI Act, a 269-page bipartisan discussion draft released August 2 by Representatives Jay Obernolte and Lori Trahan, will determine whether the US can produce a federal framework that preempts state laws for three years — the threshold question for any national AI rulemaking.