If You Can Cherry-Pick Which Codes to Sign, That's Not Regulation — That's a Menu
On August 2, 2026, the EU's AI Office officially launched enforcement of the General-Purpose AI provisions of the EU AI Act, marking the world's first comprehensive AI regulation entering its real execution phase with legal powers to demand technical documentation, conduct model evaluations, issue corrective orders, and levy financial penalties. Meta has spent over a year refusing to sign the GPAI Code of Practice — backed by roughly 26 signatories including Google, OpenAI, and Microsoft — while quietly signing the separate Code of Practice on Transparency of AI-Generated Content just five days before enforcement began on July 28, 2026, a code with 180 to 190 organizational signatories across IT, telecoms, education, and retail. This selective compliance strategy is not a sign of resistance or defiance — it is the output of a cold cost-benefit calculation, and the fact that it is entirely legal under the EU's own regulatory structure exposes a fundamental architectural flaw in how the code system was designed. The EU AI Office faces a severe institutional asymmetry: overseeing companies worth hundreds of billions in annual revenue with just over 140 staff, an annual budget of roughly €46.5 million, and two key leadership positions still unfilled. Whether the AI Act achieves genuine regulatory effectiveness will ultimately depend on whether the EU can close this capacity gap and structurally repair the voluntary code framework before cherry-picking becomes the default industry strategy — a question that GDPR and DMA precedent suggests will only be answered over the course of years, not months.