EU AI Act Enforcement in 2026: The Year Compliance Got Real
August 2026 is when the EU AI Act's high-risk provisions become fully applicable. The Code of Practice, supervisory authorities, conformity assessments, and the 7% turnover fines that finally have teeth.
The EU AI Act — Regulation (EU) 2024/1689 — entered into force in August 2024, but for most enterprises the consequential date is August 2, 2026. That is when the high-risk system provisions become fully applicable across the union, when the obligations on conformity assessments and post-market monitoring start to bite, and when fines move from theoretical to plausible. The General-Purpose AI rules for new models kicked in August 2025; the legacy GPAI grace period runs to August 2027. Everything in between happens this year.
This is the year EU AI Act compliance moved from a slide in a board deck to a budget line.
The phased timeline, where we actually are#
The Act phased in across four windows. February 2025 brought the prohibitions on social scoring, untargeted facial-image scraping, and emotion recognition in workplaces and schools. August 2025 turned on the General-Purpose AI obligations for models placed on the market from that date — training-data summaries, copyright policies, technical documentation, and for “systemic risk” models above the 10^25 FLOP threshold, the heavier evaluation and incident-reporting duties.
August 2, 2026 is the deeper cut. The full high-risk system regime applies to AI systems used in credit decisioning, employment screening, education ranking, critical infrastructure, biometrics, law enforcement, migration, and the Annex II product safety regulations. From that date, placing a non-conforming high-risk system on the EU market is itself an infringement. August 2027 is the final tail, primarily for AI embedded in regulated products under the New Legislative Framework.
For most enterprises, August 2026 is the deadline that matters.
The Code of Practice on General-Purpose AI#
The General-Purpose AI Code of Practice, finalized in 2025 after a multi-stakeholder drafting process led by the European AI Office, is the operational bridge between the Act’s text and what frontier model providers actually do. The Code covers three chapters: transparency, copyright, and safety and security for systemic-risk models. Signatories include Anthropic, Google DeepMind, Microsoft, OpenAI, and Mistral; Meta declined to sign the safety chapter, citing scope concerns.
The Code is voluntary but functionally not. The Act’s own Article 56 says adherence to the Code can be used to demonstrate compliance. Non-adherence does not exempt providers from the obligations — it just means they have to demonstrate compliance another way, which in practice means more bespoke regulatory engagement. The market has converged on signing.
For deploying enterprises the Code matters because it shapes what model providers will disclose, what evaluations they will run, and what incident channels exist. The training-data summary template, for instance, sets a floor on what is published about copyright-covered training material.
The supervisory architecture#
The Act’s enforcement structure has three layers. At EU level, the European AI Office (inside the European Commission, Directorate-General for Communications Networks, Content and Technology) handles GPAI provider supervision directly. The European Artificial Intelligence Board coordinates the national supervisory authorities. The European Data Protection Board continues to handle the GDPR overlap, with the EDPB-AIB joint opinion mechanism for cases where both regimes apply.
At member-state level, each country designates one or more national competent authorities. The split varies. France named the CNIL as the lead with sectoral authorities (ACPR, AMF) for financial services. Germany has the Bundesnetzagentur coordinating with BfDI and the state DPAs. Italy designated AgID and ACN. Spain stood up the AESIA — a brand-new dedicated AI agency — which is the most assertive structural choice in the union.
At sectoral level, the existing financial, medical-device, and product-safety regulators retain their authority for AI inside their domains. A high-risk AI system inside a medical device is supervised by both the AI Act competent authority and the EU Medical Device Regulation’s notified body, with coordination obligations on both sides.
For builders, the practical answer to “who do I notify” depends on the system, the sector, and the member state.
Conformity assessment in practice#
For most high-risk AI systems, the conformity assessment is internal — the provider self-assesses against the technical requirements (Articles 9 through 15), produces the technical documentation (Annex IV), and registers the system in the EU database. For certain biometric systems and AI embedded in regulated products, third-party notified-body assessment is required.
The technical documentation requirements are extensive: intended purpose, system architecture, training methodology, data governance, performance metrics, accuracy and robustness measures, human oversight design, post-market monitoring plan. The EU AI Office published harmonized templates in early 2026; using them is not mandatory but is the path of least resistance.
The conformity-assessment work overlaps with mature engineering practice — model cards, evaluation suites, monitoring dashboards — but formalizes them into auditable artifacts. The engineering teams we work with are typically 60 to 70 percent of the way there from existing MLOps practices; the gap is documentation discipline and the specific accuracy-and-bias testing required by Annex IV.
The fines and the realistic enforcement trajectory#
The headline numbers are well-known. Article 99 sets maximum administrative fines at 35 million euros or 7 percent of global annual turnover, whichever is higher, for prohibited-practices infringements. 15 million euros or 3 percent for high-risk non-compliance. 7.5 million euros or 1.5 percent for incorrect information to authorities.
The realistic enforcement trajectory through 2026 and 2027 is not maximum-fine cases against frontier labs. It is more likely to look like: targeted enforcement against the most-visible deployers in high-risk sectors, particularly where there is a concurrent GDPR or sectoral regulator interest; structured engagement with GPAI providers through the AI Office on documentation and evaluation gaps; and a long enforcement tail building case law on the boundaries of “high-risk” classification.
The first significant fines are expected late 2026 into 2027 as cases work through. The precedent that matters is not the amount — it is which interpretations of the Act survive the European Court of Justice.
What enterprises deploying AI in the EU need in 2026#
We’ve worked through the compliance map with clients across financial services, healthcare, and product organizations. The pattern that ships is roughly this:
An AI inventory. Every deployed and planned system catalogued, with the use case, the model behind it, the data it processes, and the risk-tier classification. The classification work is more legal than technical and benefits from a single shared rubric across the organization.
A risk-management process for high-risk systems. Not a one-time exercise — a documented, recurring process with named owners and review cadence. The Annex IV technical documentation lives inside this.
A data-governance posture aligned with both GDPR and AI Act expectations. The DPIA you already do for GDPR covers most of the AI Act risk assessment for the same system if you extend it to cover bias and representativeness.
Human-oversight design for any system that touches consequential decisions. The Act expects designed-in mechanisms — the human-on-the-loop, the override capability, the audit trail — not a policy document saying humans review outputs.
Post-market monitoring and incident response. Performance over time, drift detection, the channel for reporting serious incidents to the national authority.
Vendor management for foundation-model providers. Their compliance posture is part of yours. The Code of Practice signatories make this easier; the non-signatories require more bespoke diligence.
The GDPR-AI Act overlap#
The two regimes overlap heavily but do not collapse into each other. The EDPB Opinion 28/2024 on AI models and personal data — issued late 2024 and operationally referenced throughout 2025 and 2026 — set out how processing of personal data in AI training and inference is assessed under GDPR. Legitimate interests is available as a legal basis but requires the three-part necessity test, and the Opinion was explicit that anonymity claims for trained models require careful justification.
For deployers, the practical answer is: do both. A well-executed GDPR DPIA, extended to cover the AI Act risk-management requirements, satisfies most of the documentation overlap. Where the regimes diverge — particularly on bias testing and post-market monitoring — extend the existing artifacts rather than building parallel ones.
What gets built and what gets bought#
The compliance-tech market grew up fast in 2025. Credo AI, Holistic AI, Fairly AI, Trustible, and the established GRC vendors (OneTrust, ServiceNow, IBM Watson Governance) all ship AI Act modules. None of them are a substitute for the underlying engineering and legal work, but for organizations with many deployed AI systems they reduce the documentation overhead materially.
The build-versus-buy line we tend to land on with clients: the inventory, classification, and documentation workflow benefits from a tool; the model evaluation, monitoring, and incident-response capability needs to be wired into the engineering stack and not lifted into a separate compliance plane.
Where pdpspectra fits#
Our data engineering practice builds AI systems for enterprises with EU exposure — the conformity-assessment-ready documentation, the evaluation harnesses, and the monitoring infrastructure that make the August 2026 deadline a non-event rather than a fire drill.
Related reading: Germany’s AI Act implementation, US state AI regulation in 2026, and enterprise AI rollout roadmap.
August 2026 is the deadline that matters. Talk to our team about your AI Act readiness — the technical documentation, the evaluation harness, and the monitoring stack.