EU AI Act enforcement has started

At its 1 September 2026 press briefing, the European Commission confirmed that its first information requests had been sent to more than 30 AI companies, addressing safety and security alongside copyright and transparency. This confirms the Commission’s statement, not a finding that those companies infringed the law. Information requests must not be presented as imposed penalties.

The highest AI Act penalty tier can reach €35 million or 7% of global annual turnover for specified infringements; it is not a universal fine for every GPAI breach. But the fine is not the real story. The real story is that documentation is now evidence: what used to be an internal governance folder is something a regulator can ask you to produce.

Most companies I meet can describe what their AI system is supposed to do. Far fewer can show what it actually did — which decisions it made, on what data, and where a human intervened.

Make an honest inventory. Every AI system in use, built or bought, and the role you hold for each one: provider or deployer. Vendor tools count.

Pick the three systems closest to a person's life — hiring, credit, care, pricing — and ask for the audit trail, not the demo. If nobody can produce it in a week, that is your finding, not the regulator's.

Treat AI literacy as a leadership duty, not a training line item. A board that cannot ask a hard question about a model cannot govern one.

Regulation does not slow transformation down — unclear ownership does. When I led digital at Coop, the projects that moved fastest were the ones where someone could explain exactly what a system did and who was accountable for it.

If your leadership team needs a shared picture of what the AI Act demands, start with a keynote on AI and leadership and follow up with AI advisory on the systems closest to your customers.

Before buying another compliance tool, separate two questions: which obligations apply to this particular use, and what evidence can the organisation actually retrieve? Ask the legal team to assess the first and the system owner to demonstrate the second. A folder labelled compliant should not substitute for either exercise.

Use one real decision as a walkthrough. Identify the input, the system version, the output, the person authorised to review it and the route for challenging it. Mark missing evidence explicitly rather than filling the gaps with a description of how the process ought to work.

The trade-off is between collecting everything and collecting what serves a defined purpose. Agree access, retention and accountability with the relevant specialists. More records should not become an excuse for unnecessary personal data collection.

Treat that as a question to resolve, not an assumption in the procurement process. Ask the supplier which responsibilities it accepts, which records it provides and what happens when its model changes. Have counsel check the allocation against your actual use, rather than treating a contract as proof of compliance.

What should the board receive? A short list of unresolved decisions, named owners and evidence still missing. The Göta kanal board case offers a useful boardroom perspective; AI advisory can help frame priorities, without replacing system-specific legal advice.