EU AI Act enforcement has started

On 1 September 2026 the European Commission confirmed it had sent the first requests for information under AI Act enforcement to more than 30 AI companies. The requests cover two areas: safety and security of general-purpose and frontier models, and copyright and transparency.

In parallel, the European AI Office — working with 24 national market surveillance authorities, led by France's CNIL, Germany's BfDI and Spain's AESIA — opened its first scheduled wave of compliance inspections. Three high-risk system types are in scope: automated resume screening, algorithmic credit assessment, and AI medical triage.

The European Artificial Intelligence Board put enforcement at the centre of its ninth meeting on 17 September, without adopting any new rule or moving any deadline.

Non-compliance carries fines of up to €35 million or 7% of global annual turnover. But the fine is not the real story. The real story is that documentation is now evidence: what used to be an internal governance folder is something a regulator can ask you to produce.

Most companies I meet can describe what their AI system is supposed to do. Far fewer can show what it actually did — which decisions it made, on what data, and where a human intervened.

Make an honest inventory. Every AI system in use, built or bought, and the role you hold for each one: provider or deployer. Vendor tools count.

Pick the three systems closest to a person's life — hiring, credit, care, pricing — and ask for the audit trail, not the demo. If nobody can produce it in a week, that is your finding, not the regulator's.

Treat AI literacy as a leadership duty, not a training line item. A board that cannot ask a hard question about a model cannot govern one.