EU AI Act high risk rules start this week, putting enterprise AI deployments under formal audit

The European Union’s high risk requirements under the AI Act become enforceable across all 27 member states by the end of this week, setting a binding legal baseline for many enterprise AI deployments. Systems used for credit scoring, hiring, education testing, medical devices, and critical infrastructure now need a conformity assessment and CE marking, with penalties that can reach 35 million euros or 7 percent of global annual turnover for banned practices, according to the European Commission.

This is the compliance week that will drive go or hold decisions inside large programs. Non EU providers must also appoint an authorized representative in the bloc and prepare for inspections by national market surveillance authorities coordinated by the Commission’s AI Office in Brussels.

What changes this week Providers and deployers of high risk systems must maintain technical documentation, implement risk management and data governance, and enable human oversight, as required in the act’s Title III. They must monitor models after rollout and report serious incidents to regulators in a timely manner, with documentation ready for audit by notified bodies designated by member states.

General purpose AI providers face transparency and safety duties that interact with high risk deployments. The act requires model documentation, evaluation reporting, and a summary of copyrighted data used for training, and the AI Office can set further obligations for models that present systemic risk.

Enterprise impact EU regulated customers will push vendors for attestations before greenlighting features this quarter. Microsoft, Google Cloud, AWS, IBM, SAP, Salesforce, Oracle, and ServiceNow are already marketing EU data residency, logging, and access controls, but customers now need evidence tied to CE marking and harmonized standards rather than voluntary frameworks.

Cloud concentration amplifies the stakes. AWS held roughly 31 percent of global cloud infrastructure spend in mid 2024, Microsoft Azure 25 percent, and Google Cloud 11 percent, according to Synergy Research Group, and most enterprise generative AI services run on those platforms. ISO and IEC published ISO IEC 42001 in 2023 as an AI management system standard, and European standardization bodies CEN and CENELEC are preparing harmonized norms the Commission can reference for presumption of conformity.

The broader shift is regulatory gravity. As with GDPR, Europe’s rules are likely to set default engineering and documentation patterns for global AI rollouts, which will influence launch sequencing, vendor selection, and budget timing far beyond the bloc.