EU AI Act high risk rules enter into force, first enforcement week begins across the bloc
Enzo Reno ·
The European Union began enforcing the AI Act’s high risk requirements this week, with obligations that took effect on August 1 now applying across the 27 member states. Companies selling or deploying high risk AI in the EU must complete conformity assessments, affix the CE mark, and meet strict governance and transparency rules, or risk penalties and product withdrawals.
This matters immediately because the rules cover widely used enterprise systems, including employment screening, education tools, credit scoring, critical infrastructure management, law enforcement uses, and migration control listed in Annex III. The European Parliament set maximum fines at up to 35 million euros or 7 percent of worldwide annual turnover for banned practices, and up to 15 million euros or 3 percent for other violations, with enforcement by national authorities coordinated by the European Commission’s AI Office.
What changes this week
High risk providers must implement risk management, data governance, human oversight, logging, and cybersecurity measures, and must publish detailed instructions for use, according to the Commission’s guidance. They also need a post market monitoring plan and must report serious incidents to regulators within defined timelines, which the final text sets at 15 days for key cases.
General purpose model rules started to apply in August 2025, so model providers like OpenAI, Google, Anthropic, and Meta already face separate transparency and systemic risk duties for powerful models, as the Commission has stated. What is new this week is the legal gate for placing high risk systems on the EU market, which now requires documentation, testing, and CE marking before deployment.
Who is exposed and what to watch
Large enterprise vendors in HR and finance, such as Workday, SAP, Oracle, and Experian, need attestations and technical files ready for EU customers. Cloud providers have published AI Act alignment guides, including Microsoft, Google Cloud, and AWS, and many enterprises are adopting ISO or IEC 42001 management system controls as a baseline, according to industry groups and national standards bodies.
Regulators have signaled they will scrutinize biometric categorization and remote proctoring, along with automated hiring and credit decisions. Meta’s 2024 decision to pause training on EU user data after an Irish Data Protection Commission intervention under GDPR showed the region’s appetite for early oversight, and similar geofencing or feature changes are possible this week as vendors adjust portfolios.
For technology leaders, the AI Act’s high risk phase cements compliance as a product requirement in Europe’s 450 million person market. It will influence model selection, data retention, and vendor contracts beyond the EU, since global firms tend to standardize on the strictest regime to simplify engineering and audits.