EU AI Act Enforcement in 2026: First Cases, Fines, and What Changed

When the EU AI Act passed in 2024, the compliance timeline seemed generous. Two years felt like enough time to understand the rules, assess systems, and adapt practices. By mid-2026, companies that didn't take that window seriously are finding out what enforcement actually looks like. The first notable cases are underway, the European AI Office is issuing guidance at pace, and the penalty framework is no longer theoretical.

Where Enforcement Stands in July 2026

The EU AI Act phased in gradually. The prohibitions on unacceptable-risk AI systems—social scoring, real-time biometric surveillance in public spaces, and systems that exploit psychological vulnerabilities—took effect in August 2024. High-risk system requirements for biometrics, critical infrastructure, education, employment, and essential services came into force progressively through 2025 and early 2026.

By July 2026, the high-risk provisions are fully applicable. The European AI Office, established as the central enforcement body, has moved from guidance-writing to active investigation. National market surveillance authorities in Germany, France, and the Netherlands have opened formal inquiries.

The First Significant Cases

Automated hiring tool investigation (Germany): A major recruitment software vendor's AI-powered CV screening system came under investigation by Germany's Federal Network Agency after complaints from trade unions that the system systematically disadvantaged candidates from certain educational backgrounds. The investigation is ongoing, but it signals that employment-sector AI faces immediate regulatory attention. Under the Act, AI systems used in hiring decisions are classified as high-risk and must meet strict requirements including transparency, human oversight, and bias testing.

Biometric access control fine (Belgium): A retail chain operating stores across the EU was fined €4.2 million for deploying a facial recognition-based entry management system at warehouse locations without meeting the Act's requirements for biometric categorization systems. The company had classified the system as "non-AI" access control, a characterization the Belgian enforcement authority rejected.

Credit scoring algorithm dispute (France): A major French bank's AI credit scoring model is under examination for allegedly failing to meet the Article 13 transparency requirements mandating that high-risk AI systems provide meaningful explanations of outputs. The bank disputes the classification, arguing its model falls below the risk threshold. The outcome will clarify how financial institutions must document model decisions.

What High-Risk Means in Practice

The Act's high-risk classification is the compliance pressure point for most businesses. Systems in this category must:

• Undergo conformity assessments before deployment
• Maintain technical documentation covering training data, performance metrics, and testing protocols
• Implement human oversight mechanisms that allow review and override of AI decisions
• Log operations in ways that allow reconstruction of outputs
• Register in the EU database of high-risk AI systems
• Apply CE marking where appropriate

The challenge many companies face is that internal AI systems built before the Act came into force were never designed with these requirements in mind. Retrofitting documentation, logging, and human oversight mechanisms to existing production systems is technically complex and expensive.

The General-Purpose AI Model Tier

One of the less-anticipated battlegrounds has been the GPAI (General-Purpose AI) provisions. Large AI models—including GPT-5, Claude Opus 4, and Gemini—face their own obligations:

• Technical documentation requirements
• Compliance with EU copyright law (an active area of litigation)
• Systemic risk assessment for models exceeding 10^25 FLOP threshold

OpenAI, Anthropic, and Google have each submitted documentation to the AI Office, but the adequacy of those submissions is under active review. The AI Office has indicated it expects ongoing cooperation and updated disclosures as models are modified.

Compliance Costs Are Real

Enterprise legal teams and consultancies report that AI Act compliance for companies operating multiple high-risk systems is running €500,000 to €2 million annually for mid-sized organizations, and significantly more for large enterprises. The costs break down roughly as:

• Legal and classification work: Determining which systems are high-risk requires specialized legal analysis. Many systems that companies assumed were low-risk have been reclassified.
• Technical documentation: Building and maintaining conformity assessment documentation is an ongoing engineering effort, not a one-time exercise.
• Audit and testing: Third-party conformity assessments for certain system categories require accredited auditors.
• Human oversight implementation: Adding human review layers to previously autonomous systems means real operational cost.

Some companies are choosing to withdraw AI features from EU markets rather than incur compliance costs. This has prompted debate about whether the Act risks creating a two-tier AI market—more capable in the US, constrained in Europe.

What's Actually Working

Despite the complexity, some aspects of the regime are working as intended:

Incident reporting is surfacing real problems. The Act's serious incident reporting requirements have led to disclosure of several AI failures that would previously have been handled quietly. This transparency is producing the kind of systemic learning the Act intended.

Procurement decisions are changing. EU public sector bodies and large private organizations are now including AI Act compliance status in procurement criteria. This is driving vendors to document and certify systems that would otherwise have remained opaque.

The Codes of Practice are proving useful. The voluntary codes developed with industry input have given many companies a practical compliance pathway that the Act's abstract requirements didn't provide on their own.

What Companies Should Do Now

If you're operating AI systems in the EU and haven't completed a systematic AI Act assessment:

1. Complete an AI inventory. You need to know every AI system operating in your organization before you can assess risk classification.
2. Classify each system. Map systems against the Act's Annex III high-risk categories and the GPAI provisions.
3. Prioritize high-risk systems. Start remediation with employment, credit, and biometric systems—these are attracting the most enforcement attention.
4. Document proactively. Even where enforcement hasn't reached your sector yet, contemporaneous documentation is far easier than retrospective reconstruction.
5. Brief your board. Maximum fines reach €35 million or 7% of global annual revenue—these are figures that require board-level awareness.

The broader regulatory picture in AI Regulation in 2026: What New Laws Mean for Your Business covers the global context, including US and UK approaches that differ significantly from the EU's framework.

EU AI Act enforcement in 2026 is not theoretical. Companies that moved early on compliance are managing it as a normal cost of operating AI systems in Europe. Those that waited are now navigating investigations and retrofitting systems under time pressure. The lesson from the first case cycle is consistent: proactive compliance is substantially cheaper than reactive remediation.