EU AI Act Enforcement September 2026: What to Do Now

The EU AI Act passed in 2024 and its enforcement timeline has been rolling out across 2025 and 2026. In September 2026, businesses operating AI systems in or affecting EU markets are no longer in a grace period — several significant compliance deadlines have passed, and the enforcement machinery is operational. The question is no longer whether compliance is necessary but whether your compliance program is adequate.

Where EU AI Act Enforcement Stands

The EU AI Act entered into force in August 2024. Its compliance requirements have rolled out in phases:

• February 2025: Prohibitions on unacceptable-risk AI systems took effect — systems that manipulate users subliminally, exploit vulnerabilities, and certain biometric categorization systems are banned
• August 2025: Rules for general-purpose AI models (including large language models) became applicable
• August 2026: High-risk AI system requirements in sectors including employment, education, essential services, and law enforcement are now in effect

September 2026 is the first month in which the full weight of high-risk requirements applies to organizations that hadn't previously been in scope. For many companies, this is the enforcement moment they've been preparing for — or haven't.

Which AI Systems Are Now Regulated

The EU AI Act's approach is risk-based. Understanding which tier applies to your systems is the starting point for compliance.

Unacceptable risk (banned): Real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions), social scoring systems, manipulation of behavior through subliminal techniques.

High risk (mandatory requirements, conformity assessment): AI systems used in:

• Recruitment, promotion, and HR decisions
• Access to education and educational assessment
• Essential services including credit scoring and insurance
• Law enforcement and border control
• Critical infrastructure management
• Administration of justice

General-purpose AI (transparency and documentation requirements): Large language models and foundation models with certain capability thresholds.

Limited and minimal risk (mostly voluntary codes of practice and transparency obligations): Chatbots, recommendation systems, most consumer-facing AI.

For most businesses deploying commercial AI tools like AI accounting tools or customer service AI, the relevant tier is limited risk with some transparency obligations. The high-risk category applies most directly to HR systems, credit decisioning, and access to essential services.

Compliance Deadlines That Have Passed

As of September 2026, the following deadlines have come and gone:

• Banned AI practices were prohibited from February 2025
• General-purpose AI (GPAI) model obligations — documentation, transparency, copyright summaries, cybersecurity — have applied since August 2025
• High-risk systems in Annex III (employment, education, essential services) must now meet full requirements

If your organization is deploying AI in high-risk categories and has not yet conducted conformity assessments, established risk management systems, implemented data governance practices, and registered systems in the EU database, you are out of compliance.

What Penalties Businesses Face

The enforcement mechanism includes fines scaled to the severity of the violation and the size of the organization:

• Up to €35 million or 7% of worldwide annual turnover for violations related to prohibited AI practices
• Up to €15 million or 3% of worldwide annual turnover for violations of high-risk system requirements
• Up to €7.5 million or 1.5% of worldwide annual turnover for providing incorrect or misleading information to authorities

National market surveillance authorities in each EU member state are responsible for enforcement. The European AI Office handles enforcement for GPAI model obligations. Several member states have stood up their enforcement agencies and begun accepting complaints.

Early enforcement has focused on documenting violations rather than issuing maximum penalties — but that phase is ending as authorities have had time to operationalize their processes.

How US Companies Should Respond

The EU AI Act applies extraterritorially to any company whose AI systems are used in the EU or affect EU residents. US companies that sell AI products in the EU, use AI systems that process EU resident data, or operate AI in employment or financial decisions affecting EU residents are in scope.

The practical response for US companies in September 2026:

1. Map your AI systems: Identify every AI system your organization uses or sells, document its purpose, and classify its risk tier under the Act
2. Prioritize high-risk systems: Conduct conformity assessments for systems in regulated categories
3. Document GPAI model use: If you integrate third-party AI models (GPT-5, Claude, etc.) into products, ensure the model providers have complied with GPAI obligations and obtain their documentation
4. Establish governance processes: Ongoing risk management, monitoring, and incident response for high-risk systems

Several US technology companies have publicly committed to EU AI Act compliance and are using it as a framework for broader global AI governance. The regulation is influencing policy discussions in the UK, Australia, and other jurisdictions, making early compliance work adaptable.

Building an EU AI Act Compliance Program

For organizations that are behind on compliance in September 2026, the priority order is:

1. Stop any prohibited practices immediately: No grace period, full liability
2. Conduct a risk classification audit: Know which systems are high-risk before any other step
3. Engage legal counsel with EU AI Act expertise: This is complex, jurisdiction-specific regulatory work
4. Implement documentation requirements: The Act requires significant ongoing documentation — risk management systems, data governance records, conformity assessments
5. Register high-risk systems: The EU database registration requirement is now in effect

The AI regulation landscape is broader than the EU. See our overview of AI regulation in 2026 for context on how EU rules interact with emerging frameworks in the US, UK, and other jurisdictions.

The bottom line for September 2026: EU AI Act compliance is no longer optional or aspirational. Enforcement is real, the deadlines for most high-risk systems have passed, and organizations that act now face significantly lower risk than those that wait.