EU AI Act obligations for high risk and general purpose models begin this week, raising compliance stakes for tech and finance

The European Union begins enforcing key provisions of the AI Act this week, forcing technology vendors and major deployers in finance, health care, and public services to meet new safety and transparency rules. Companies operating or selling AI systems in the bloc face penalties of up to 7 percent of global turnover for serious violations, according to the European Commission.

This matters now because the first binding obligations on high risk systems and general purpose AI models start to bite, triggering audits, documentation checks, and market surveillance by national authorities and the Commission’s AI Office. Enterprises with credit scoring, hiring, medical device, education testing, and critical infrastructure models must confirm risk management, data governance, human oversight, logging, and incident reporting, and must register high risk systems in the EU database.

What changes this week

Providers of general purpose AI must publish technical summaries of training content and compute, supply downstream documentation, and enable model‑level safeguards. The Act also introduces an enhanced regime for models deemed to present systemic risk, tied in part to training compute thresholds reported during negotiations at 10 to the power of 25 floating point operations, with more rigorous evaluation and reporting obligations, according to the final legislative text and Commission briefings.

Cloud platforms and model vendors are moving early. Microsoft, Google Cloud, and AWS have expanded governance toolkits built around Azure AI Content Safety, Google Vertex AI’s governance features, and Amazon Bedrock Guardrails, and are preparing EU declarations of conformity where they act as providers. The exposure is broad, since cloud market leaders are the default channel for enterprise AI. Synergy Research reported in 2024 that AWS held about 31 percent of global cloud infrastructure spend, Microsoft had about 25 percent, and Google had about 11 percent.

Banks, insurers, and large employers with EU operations are the immediate flashpoint. Supervisors can require conformity assessments and pull non compliant systems from the market. For budgeting, IDC forecast worldwide AI spending to reach about 300 billion dollars in 2026, with a growing share tied to governance, risk, and compliance.

Enterprise playbook by Tuesday

Executives should inventory AI systems that touch EU users, decide whether to pause or geofence features, and confirm supplier attestations for any embedded models, including OpenAI, Anthropic, Google, Meta, and Mistral. Legal teams should prepare fundamental rights impact assessments for high risk use cases, align on a reporting process for serious incidents, and validate that product teams can surface explanations and user notices in production.

The shift marks a new phase in AI deployment where regulatory readiness becomes a competitive filter for platforms and applications, and where model documentation and supply chain assurances influence enterprise buying just as much as raw performance.