AI Policy · European Union · Global Tech
The EU AI Act Is Now Enforced: What Every Tech Company Needs to Know in 2026
Fines of up to 35 million euros or 7 percent of global annual turnover are now on the table. The grace periods are over, the compliance windows have closed, and regulators across Europe are actively reviewing systems. Here is what changed, what it means, and which companies are already drawing attention.
When the European Union's Artificial Intelligence Act was formally adopted in August 2024, most of the technology industry exhaled. The hardest deadlines, they noted, were still years away. Compliance teams could be built gradually. Vendors could update documentation over time. The urgency could wait.
That calculation has now expired. The Act's provisions for high-risk AI systems, which cover everything from hiring tools and credit scoring algorithms to medical diagnosis software and critical infrastructure management, became fully enforceable earlier this year. National market surveillance authorities across the EU have begun active reviews. The first formal investigations have been opened. And the enforcement architecture that Brussels spent three years building is operational.
The window to get ready has closed. What remains is the window to get compliant or face the consequences.
What the Act Actually Requires
The AI Act organizes AI systems into four risk tiers, each carrying different obligations. Understanding which tier a given system falls into is the first task every compliance team must complete, and the answer is not always obvious.
Banned outright. Social scoring systems, real-time biometric surveillance in public spaces, AI that manipulates vulnerable people. Any system in this category must be shut down immediately.
Examples: Social credit scoring, subliminal manipulation, mass biometric surveillance
Permitted with heavy compliance obligations. Mandatory conformity assessments, human oversight requirements, detailed technical documentation, and registration in an EU database.
Examples: Hiring AI, credit scoring, medical diagnosis tools, autonomous vehicles, critical infrastructure
Transparency obligations apply. Users must be informed they are interacting with an AI. Chatbots, deepfake generators, and emotion-recognition systems fall here.
Examples: Chatbots, deepfakes, emotion detection, synthetic content generation
No mandatory requirements, but voluntary codes of conduct are encouraged. The vast majority of AI applications fall into this category.
Examples: Spam filters, AI-powered games, recommendation engines, search algorithms
The Compliance Burden Is Real
For companies operating high-risk AI systems, the compliance requirements are substantial. They include a conformity assessment before deployment, ongoing monitoring once live, detailed technical documentation covering training data, model architecture, and performance metrics, registration in the EU's AI database, and the designation of a human oversight mechanism that can intervene if the system produces harmful outputs.
For multinational technology companies that have been operating AI products in the EU without formal compliance structures, this represents a significant operational lift. Legal counsel at several large US technology firms have described the compliance process as comparable in scope to GDPR implementation, which cost the industry billions of euros between 2016 and 2018.
The difference is that the AI Act's enforcement architecture includes fines that significantly exceed those of GDPR for certain violations. An AI system classified as unacceptable risk that continues to operate after the prohibition deadline faces a fine of up to 35 million euros or 7 percent of global annual turnover, whichever is higher. That figure has concentrated minds in a way that early compliance guidance did not.
Who Is Already Drawing Scrutiny
Formal investigations have been opened in Germany, France, and the Netherlands targeting AI systems used in employment screening, insurance risk assessment, and consumer credit decisions. None of these cases have reached conclusion, but their existence signals that enforcement is not theoretical.
Notably, the Act applies not only to companies headquartered in the EU but to any organization that deploys AI systems that affect people in EU member states. That extraterritorial reach means American and Asian technology companies with European operations face the same compliance obligations as their European counterparts. Several prominent US startups have already announced they are pausing certain AI product features in EU markets while they complete conformity assessments.
What Companies Should Do Right Now
For technology companies that have not yet conducted a formal AI inventory, the priority is clear: identify every AI system that touches EU residents, classify it by risk tier, and determine which ones require formal conformity assessments. This process alone takes weeks for most organizations of any complexity.
The companies that are best positioned are the ones that treated the AI Act as an engineering and product challenge rather than a legal one. They built logging, monitoring, and override capabilities into their systems from the beginning. They documented their training data and model choices with the understanding that those documents would be reviewed. They are not scrambling now because they did not defer.
For everyone else, the scramble is underway. The question is whether it is fast enough.
Related Editorial
Daniel Simao
Editor in Chief, TechGlobal.news
Daniel Simao covers AI policy, emerging technology platforms, and the global economic implications of automation. He founded TechGlobal.news to provide technology readers with a more deliberate, signal-first news experience.