KDCube
← AI Industry News

EU AI Act Enforcement Hits GPAI as Agent Governance Goes Per-Action

On Aug 2 the EU AI Act's GPAI enforcement and penalty powers switch on, with fines up to 3% of global turnover or €15M as the one-year grace period ends. Meanwhile, Amazon Bedrock AgentCore's July release notes tighten tool and identity edges and Delinea ships runtime authorization that governs each agent tool...

Lead signal — the control plane moves inside the session

Highlights

  • Tomorrow the European Commission's enforcement and penalty powers over general-purpose AI (GPAI) providers switch on: fines up to 3% of global turnover or €15M under Article 101, ending the one-year grace period that ran since obligations first applied Aug 2, 2025. (EU AI Act)
  • Amazon Bedrock AgentCore's July release notes quietly shipped two operator-grade upgrades: Gateway Web Search connector v1.2.0 (request-level domain and published-date filters, 100-domain include/exclude lists) and Private Key JWT identity, with signing keys held in AWS KMS and every assertion logged to CloudTrail. (AWS)
  • Delinea launched runtime authorization that evaluates each agent tool call individually — allow, block, or escalate to a human before execution — plus just-in-time, task-scoped credentials to kill standing secrets. (Delinea)
  • The through-line since this week's Hugging Face agent-breach reporting: the control plane is racing to move enforcement inside the session, not just around the connection.

Key Signals

  1. GPAI enforcement powers and fines become applicable — Aug 2, 2026

    From tomorrow the AI Office can demand documentation, run model evaluations, order risk-mitigation or market withdrawal, and levy fines on GPAI providers — the supervisory machinery held back a year is now live. (EU AI Act, Latham & Watkins) Article 50 transparency duties (chatbot disclosure, AI-content marking, deepfake labeling) were never delayed and stand alongside it.

  2. AgentCore tightens the tool and identity edges — July 2026 release notes

    Web Search targets can now be pinned to an allowed-domain list and filtered by publish date per request, composing with existing exclude lists — meaningful for RAG grounding and prompt-injection surface. Private Key JWT replaces shared OAuth client secrets so an agent's downstream credential never leaves KMS. (AWS)

  3. Delinea makes "authorization" an action-level, per-call decision — July 29, 2026

    Instead of authorizing a connection once, the platform enforces policy on each tool call across databases, SSH, Kubernetes, and cloud consoles, distinguishing agent-driven from human-driven access at connection time. CEO Art Gilliland's framing: "the perimeter has moved to inside the session." (Delinea)

Why It Matters / What To Watch

  1. If you ship GPAI-touching apps into the EU, the compliance conversation is now an enforcement conversation.
    • Confirm your GPAI providers' documentation and Code of Practice posture, since the AI Office can now request it and fine on gaps. (Latham & Watkins)
    • Don't conflate the delayed items with the live ones — GPAI enforcement and Article 50 transparency are in force now regardless of other timeline slips. (EU AI Act)
  2. Governance is converging on per-action enforcement, and platforms are following.
    • Treat action-level authorization (Delinea) and Gateway-side policy/JIT credentials as the same pattern showing up in different layers — evaluate where enforcement should live for your agents. (Delinea, AWS)
    • Watch AgentCore's Policy and Evaluations (GA earlier in 2026) plus these July identity/tool controls as the managed-runtime answer to the same problem third parties are selling around it. (AWS)
  3. The credential-reuse lesson from the breach cycle is now a product requirement.
    • Prioritize eliminating standing agent credentials via JIT, task-scoped issuance — the exact failure mode behind recent autonomous-intrusion reporting. (Delinea)

Quick Links