EU AI Act high risk rules enter enforcement this week, putting HR and credit AI under immediate scrutiny
Enzo Reno ·
Europe’s new AI Act moves from text to teeth this week, as enforcement of high risk requirements begins across the bloc and national authorities start checking enterprise deployments. The European Commission and member state regulators will prioritize systems used in hiring, credit scoring, critical infrastructure, and health, where violations can draw fines up to 7 percent of global annual turnover according to the Commission.
This matters now because many large employers and banks have production AI in scope, yet the pipeline of designated Notified Bodies and harmonised standards remains incomplete. Providers must still show technical documentation, human oversight, data governance controls, and post market monitoring for systems placed on the EU market.
What to watch by Tuesday
Expect procurement and rollout freezes on EU HR and risk models that lack a clear conformity path. Vendors with large European footprints, including Workday in HCM, SAP SuccessFactors, Oracle Fusion HCM, and UKG, face immediate requests for training data lineage, bias testing, and robustness evaluations from national market surveillance authorities.
Financial institutions are preparing audit trails for credit decisioning models and explaining how humans can override automated outputs. The Commission’s AI Office, set up to supervise general purpose AI and coordinate national enforcement, has said providers can rely on existing ISO and IEC management standards while EU harmonised standards are being finalized, but that does not delay obligations. CEN and CENELEC continue work on AI-related standards that will later be cited in the Official Journal.
Why model and infrastructure choices are in play
General purpose model obligations started earlier, in 2025, which is why OpenAI, Google, Anthropic, and Mistral publish model cards and safety system summaries today. The AI Office can request additional information from model providers, including risk assessments and system performance under stress tests, and can escalate through national authorities if downstream deployers report issues.
Cloud governance tooling will be tested. AWS made Guardrails for Amazon Bedrock generally available in April 2024, Microsoft offers Azure AI Content Safety and governance controls, and Google’s Vertex AI includes policy and lineage features. Hardware cost pressure persists, with Nvidia supplying more than 80 percent of data center AI accelerators according to Omdia in 2024 and its Blackwell platform announced on March 18, 2024 now influencing inference planning.
For the broader tech landscape, compliance maturity becomes a competitive feature in enterprise AI, not an afterthought. Procurement teams will favor auditable stacks and certified partners, accelerating consolidation around vendors that can document risk controls across jurisdictions while shifting MLOps roadmaps toward logging, evaluation, and human oversight at scale.