The EU AI Act Is Enforcing Now. Most Organizations Are Not Ready

At a Glance

• EU AI Act Compliance 2026 is now active, with binding obligations already in force for General-Purpose AI (GPAI) models since August 2025.
• Most enterprises lack an AI system inventory, risk classification, and governance infrastructure required under the EU AI Act.
• The regulation mandates continuous AI risk management, not one-time compliance assessments.
• Organisations modifying foundation models may legally become AI providers under the EU AI Act, inheriting full compliance responsibility.
• High-risk AI systems require documentation, human oversight, audit trails, and incident reporting—all provable under regulatory review.
• The biggest risk is not non-compliance intent, but lack of visibility into AI systems across the enterprise.

The date that changed everything for enterprise AI compliance was August 2, 2025. Not because
regulations were announced — they had been announced years earlier. But because on that date,
the governance obligations for General-Purpose AI models became binding under the EU AI Act.
The European AI Office gained full enforcement powers. And organizations that had been
treating AI governance as a future project discovered they had no time left.

Most companies still have not processed what this actually means operationally.

How AI Let me be direct: the EU AI Act is not a data privacy regulation with an AI flavour. It is a structural
mandate that reaches into how AI systems are built, documented, monitored, and shut down. The
penalties are not a deterrent. They are an execution mechanism. Non-compliance with
prohibited AI practices can trigger fines of up to €35 million or 7% of total worldwide annual
turnover — whichever is higher. That exceeds even the GDPR’s headline penalties of €20
million.

And this is not theoretical. The European Commission has already stated that transition periods
and postponements are not on the table. The timeline is fixed. Enforcement is live.

What the EU AI Act Actually Requires

The Act takes a risk-based approach that most boardrooms have understood in the abstract but
not translated into operations. Here is what it actually requires at the enterprise level:

First, a complete AI system inventory. If your organization deploys AI in recruitment, credit
decisions, healthcare diagnostics, critical infrastructure management, law enforcement, or
education — those systems are classified as high-risk, and you are legally obligated to maintain
documentation, conduct conformity assessments, and register them in an EU database. The
question is not whether you have such systems. The question is whether you know which ones
they are.

Second, risk management infrastructure. Every high-risk AI system must have a functioning risk
management system — not a document, a system — that operates continuously throughout the
entire lifecycle of the model. This includes ongoing monitoring for model drift, bias, and
unexpected outputs.

Third, technical documentation and traceability. Every high-risk system must be accompanied
by documentation detailed enough to allow post-hoc assessment by a regulator. This means
version histories, training data summaries, validation records, and audit logs. If you cannot
produce this documentation within a regulatory review window, you are not compliant —
regardless of how carefully the system was built.

Fourth, human oversight mechanisms. High-risk AI systems must be designed so that humans
can meaningfully intervene, override, or halt operations. This is not checkbox language. It is an
architectural requirement that must be provable under audit.

Fifth, incident reporting. Serious incidents and malfunctions affecting high-risk AI systems
must be reported to national market surveillance authorities. Organizations need to know what
constitutes a reportable incident before one happens, not after.

The GPAI Layer That Most Companies Have Missed

General-Purpose AI models — the large language models, multimodal systems, and foundation
models that organizations are integrating into nearly every workflow — carry their own distinct
compliance obligations under the Act. Since August 2025, providers of GPAI models must
maintain technical documentation, publish transparency reports, and for high-impact models,
conduct thorough systemic risk assessments.

Here is the operational trap that most enterprises have not caught: if you substantially modify a
GPAI model — through fine-tuning, retraining, or significant technical adjustments — you may
legally become the provider. That means every compliance obligation that applies to the original
model developer now applies to you. Legal teams that have not reviewed their fine-tuning
operations for this exposure are sitting on undisclosed liability.

The Inventory Problem Is the Governance Problem

The most consistent governance failure I see across organizations is not a technology failure. It is
a visibility failure. Organizations cannot govern what they cannot see. And right now, most
organizations cannot see theirAI systems clearly

This is not negligence. It is the predictable result ofAI adoption moving faster than governance
capacity. AI tools have proliferated across departments — marketing, HR, finance, legal,
operations — often without central oversight, without risk classification, and without
documentation. Some of these tools are vendor-provided SaaS products. Some are internally
built. Some have been connected to proprietary data in ways that no single person in the
organization fully understands.

Under the EU AI Act, this is not an operational inconvenience. It is a compliance gap. And when
the regulator asks to see your AI inventory and your risk classification methodology, “we are still
working on that” is not an acceptable answer.

The Timeline Is Fixed. The Gap Is Not

The August 2026 deadline — when the Act becomes fully applicable for most operators —
sounds distant until you map it against the time required to build genuine compliance
infrastructure. Conducting an AI inventory across a mid-to-large enterprise typically takes
weeks. Risk classification requires legal and technical expertise working in coordination.
Documentation systems need to be built or procured. Monitoring infrastructure needs to be
deployed. Human oversight mechanisms need to be designed into systems that, in many cases,
were not built with this requirement in mind.

Organizations that begin this process in the second half of 2026 will be building their compliance
infrastructure while regulators are already conducting reviews.

The Contrarian Case for Moving First

The organizations that treat the EU AI Act as a burden to be minimized are thinking about this
wrong. The Act creates a governance baseline that, once reached, becomes a competitive
differentiator. Banks, insurers, healthcare systems, and public sector bodies that can
demonstrate documented, auditable, continuously monitored AI governance are better
positioned in procurement decisions, partnership negotiations, and regulatory relationships.

More concretely: the organizations that build AI inventory and risk management infrastructure
early will deployAI faster in the long run. The institutions paralyzed by compliance uncertainty
— unable to get AI initiatives approved because no one can assess the risk — are the ones for
whom governance becomes a blocker rather than an enabler.

The EU AI Act is not the enemy of AI adoption. The absence of governance is.

What Needs to Happen Now

Executives reading this need to ask four questions in the next thirty days. First: do we have a
complete, current inventory of every AI system operating in our organisation — including
vendor-provided tools, internal models, and any GPAI models that have been modified? Second:
Have we classified each of those systems under the EU AI Act’s risk categories, and do we have
documentation that can survive regulatory review? Third: Do we have a continuous monitoring
infrastructure for our high-risk systems, or are we relying on periodic manual reviews? Fourth: if
the European AI Office contacted our organisation tomorrow and requested documentation of
Our AI governance posture, could we respond with confidence?

If the answer to any of these is no, the gap is real and the timeline is moving.

FAQs