EU AI Act Enforcement Begins: What Every Tech Company Must Know

The Clock Has Started#

After years of drafting, negotiation, and a phased rollout, the EU AI Act entered its first enforcement phase on August 1, 2026. The regulation — the world's first comprehensive AI law — is now actively monitored, with national authorities empowered to audit, sanction, and ban AI systems that fall short of its requirements.

This isn't regulatory theater. The first enforcement actions are already being investigated.

What the AI Act Actually Requires#

Risk Classification#

The act classifies AI systems into four tiers:

1. Unacceptable risk — banned outright (social scoring, real-time biometric surveillance in public spaces)
2. High risk — requires conformity assessment, documentation, and human oversight
3. Limited risk — transparency requirements only (must disclose AI interaction to users)
4. Minimal risk — no requirements, but voluntary codes of conduct encouraged

High-Risk Systems: The Full List#

High-risk designation covers AI used in:

• Employment decisions (hiring, promotion, termination)
• Credit scoring and insurance underwriting
• Educational assessment
• Medical device classification and diagnostic support
• Critical infrastructure management
• Law enforcement and justice systems
• Border control

If your company deploys AI in any of these categories and serves EU users, you're in scope.

The Compliance Checklist#

For high-risk AI systems, companies must demonstrate:

• Technical documentation covering system architecture, training data, and performance metrics
• Risk management system with ongoing monitoring and incident response
• Human oversight mechanisms — a human must be able to intervene, override, or shut down the system
• Transparency — users must be informed they're interacting with AI
• Data governance — training data must be documented for relevance, bias, and representativeness
• Robustness testing against adversarial inputs and distribution shifts

The Fines Are Real#

Non-compliance with high-risk provisions: up to €30 million or 6% of global annual turnover, whichever is higher.

For context: a mid-size company with €500M in revenue faces a maximum fine of €30M. For a company like Google, 6% of global turnover would exceed €17 billion.

"We are not interested in making examples — we are interested in compliance. But where compliance is absent, we will act." — EU AI Office statement, July 2026

Which Companies Are Already in Trouble#

The EU AI Office has confirmed it is investigating three unnamed companies for potential violations related to AI-powered hiring systems and one for a medical diagnostic tool. Formal decisions are expected in Q4 2026.

US tech companies operating in the EU have largely scrambled to retrofit documentation requirements. The consensus among compliance attorneys is that most large tech companies are approximately compliant on documentation but lagging on human oversight mechanisms.

What to Do If You're Affected#

1. Audit your AI deployments — map every AI system touching EU users against the risk tier classification
2. Prioritize high-risk systems — the enforcement timeline is now, not next year
3. Appoint an EU AI compliance officer — similar to GDPR's DPO requirement, someone needs to own this
4. Engage a notified body — for conformity assessments, you'll need third-party certification for some high-risk categories
5. Document everything — the bar for technical documentation is high; retroactive documentation is harder and less credible

The window for "we're working on it" has closed. Enforcement has begun.