EU AI Act moves into enforcement phase with new compliance rules

The shift to active enforcement

The European Union's AI Act officially entered into force on August 1, 2024. While the law was established as a framework, it is now moving into a broader application phase that grants the European Commission’s AI Office and national authorities real enforcement powers.

As scworld.com reported, this transition means that AI governance can no longer be viewed as a project for the distant future. Organizations must now navigate a series of phased deadlines rather than a single compliance date, with several obligations already becoming active.

Prohibited AI practices and specific literacy requirements began applying on February 2, 2025. These were followed by governance requirements for general-purpose AI models on August 2, 2025, creating a rolling schedule of legal obligations for businesses.

New transparency and deadlines

A major expansion of enforcement occurred on August 2, 2026, which introduced further transparency requirements. Under Article 50, certain AI interactions must be disclosed to users, and synthetic content—material generated or manipulated by AI—must be clearly identifiable.

There is a limited transition period for systems already on the market before August 2, 2026, which gives them until December 2, 2026, to meet these marking and detection rules. This creates a complex timeline where different products have different windows for compliance.

The next major milestone for high-risk AI systems is scheduled for December 2, 2027. Systems embedded in regulated products have an even later deadline of August 2, 2028, but experts warn that this extra time should not be seen as a reason to delay building necessary capabilities.

The high cost of non-compliance

The financial stakes for failing to follow the AI Act are substantial, moving the conversation from IT departments to the boardroom. For prohibited AI practices or specific data-related infringements, the maximum penalty can reach €35 million or 7% of worldwide annual turnover, whichever is higher.

Other breaches of the regulation carry a maximum penalty of €15 million or 3% of worldwide annual turnover. These figures are designed to ensure that the cost of non-compliance outweighs the cost of establishing proper governance structures.

Furthermore, providing incorrect or misleading information to authorities can result in fines of up to €7.5 million or 1% of worldwide annual turnover. These penalties highlight that the AI Act is an enterprise risk issue involving significant legal exposure.

Solving the visibility problem

One of the primary hurdles for organizations is identifying 'shadow AI,' which refers to technology used by employees without official oversight. AI can enter a company through various channels, including recruitment platforms, marketing systems, and even simple employee experimentation with cloud services.

To meet compliance standards, organizations need to create a meaningful AI inventory. This inventory should not just list software but must identify the system provider, the business purpose, the owner, the data processed, and the risk classification of the tool.

Without a clear inventory, it is nearly impossible to demonstrate compliance to regulators. Companies must move beyond having a simple AI policy and instead prove they know exactly what tools are being used and who is accountable for them.

Integrating AI into risk management

Effective AI governance should not exist in a vacuum as an isolated compliance program. It needs to be integrated with existing frameworks like ISO/IEC 27001, privacy protocols, supplier risk management, and internal audits.

For example, if an employee uploads confidential data to an external AI service, the issue spans multiple departments. It involves information classification, data protection, access control, and employee awareness training, rather than just a single AI technicality.

Organizations should focus on building evidence of their processes. This includes maintaining records of assessments, approvals, training logs, and technical documentation. The goal is to be able to produce evidence of control when challenged by an auditor.