EU AI Act high risk rules now apply, banks and HR tech face first real compliance week

The European Union’s AI Act high risk requirements are now in effect across the bloc, and enterprises that use AI for credit scoring and recruitment enter a decisive week for compliance. Starting today, large buyers and vendors must decide whether to keep systems online in the EU or suspend them until documentation and controls meet the law.

The single most important change is procedural. Providers and deployers must register high risk AI in the EU database before market placement, maintain logging and human oversight, and run post market monitoring, according to the European Commission. Fines can reach 35 million euros or 7 percent of global annual turnover for banned practices, and up to 3 percent for other violations, under the Act.

What to watch before Tuesday meetings

CIOs at banks and employers should demand Annex IV technical documentation from model providers and integrators, plus evidence of a conformity assessment where required. Creditworthiness and recruitment are listed as high risk uses in Annex III, which triggers obligations regardless of model family, including foundation models accessed through APIs from OpenAI, Google, Anthropic, or Cohere.

Procurement leaders will look for audit ready tooling. IBM’s watsonx.governance became generally available in December 2023, and Amazon’s Guardrails for Bedrock reached general availability in 2024, both marketed for policy enforcement and lineage tracking. Scale AI said in May 2024 that it raised 1 billion dollars at a 13.8 billion dollar valuation to expand data curation and model evaluation, a sign of demand for testing and documentation capacity.

National authorities will apply the rules alongside the European AI Office, which sits in the Commission’s DG CONNECT. Data protection agencies including France’s CNIL and Spain’s AEPD have already taken action on AI under GDPR, such as Spain’s 2024 order against Worldcoin’s data processing, which signals a willingness to intervene when controls are weak.

Why this matters now

High risk obligations took effect two years after the Act entered into force in August 2024, and they collide with rapid enterprise uptake. Gartner has projected that by 2026 more than 80 percent of enterprises will use generative AI APIs and models, up from less than 5 percent in 2023. IDC estimates global spending on AI systems will surpass 300 billion dollars in 2026, which means regulated uses will account for a larger share of budgets and scrutiny.

For the broader technology landscape, compliance ready offerings and clear documentation become competitive features, not add ons. Vendors that can pair model performance with audit trails, risk controls, and European registrations will win regulated workloads first, which will influence cloud selection, model choice, and services spend through year end.