EU AI Act high risk rules now in force, Brussels to surface first registry entries this week

The European Commission will begin publishing entries from its new EU database for high risk AI systems this week, marking the first visible test of the bloc’s Artificial Intelligence Act since key obligations took effect in August across the European Union. Companies offering AI in regulated uses, including hiring, medical devices, credit scoring, education, and critical infrastructure, must complete conformity assessments, apply CE marking, and register systems before they are placed on the EU market.

The timing matters for enterprise buyers and vendors heading into a dense fall conference season, including Salesforce’s Dreamforce in San Francisco this week, where CIOs will press for concrete compliance roadmaps. Failure to meet the AI Act can carry penalties of up to 35 million euros or 7 percent of global annual turnover for prohibited practices, and up to 15 million euros or 3 percent for other infringements, according to the Commission.

What companies must do now Providers of high risk systems must implement risk management and data governance processes, produce technical documentation, enable logging, and ensure human oversight and cybersecurity, then file details in the EU database managed by the Commission’s AI Office in Brussels. The AI Office, which the Commission has said will staff roughly 140 specialists, will coordinate with national authorities on supervision and will oversee rules for general purpose models with systemic risk.

Large enterprise vendors are in scope immediately. SAP’s SuccessFactors, Workday, Oracle, and IBM supply AI features for recruiting and worker evaluation that fall under Annex III of the law for employment use cases. Siemens, Schneider Electric, and Philips embed AI in industrial control and medical products, which must clear sector specific conformity routes and carry CE marking under the AI Act and existing product safety frameworks.

Enforcement and risk Member state market surveillance authorities are preparing inspections and will rely on harmonized standards developed by CEN and CENELEC. Industry group DigitalEurope has warned of potential capacity gaps in notified bodies, and the Commission has signaled it can issue common specifications if standards lag, a tool written into the regulation.

For global tech, the week signals a shift from pilots to regulated deployment. Procurement will increasingly demand CE marked AI and verifiable model documentation, and cloud or model suppliers such as Microsoft, Google, OpenAI, Anthropic, and Meta face sharpened due diligence from European customers who must now evidence compliance in their own stacks.