Enforcement Is Here
After years of debate and an extended transition period, EU AI Act enforcement for high-risk systems began in January 2026. For enterprises that have been watching from the sidelines, the waiting period is over. Regulators in several member states have issued their first formal notices, and the legal teams that advised “we’ll deal with it when enforcement starts” are now scrambling.
This is not a compliance exercise for its own sake. The AI Act’s requirements — transparency, documentation, human oversight, and bias testing — are also engineering best practices. Companies that treat compliance as an engineering constraint rather than a legal exercise will find the work less disruptive.
Who Is Affected
The AI Act’s obligations apply to organisations that develop, deploy, or import AI systems that fall into regulated categories. High-risk categories include:
- AI used in credit scoring and financial decisions
- AI used in employment screening and HR decisions
- AI used in access to education
- AI used in safety-critical systems (medical devices, infrastructure)
- Biometric identification systems
If your organisation uses AI in any of these areas and serves EU customers or operates in EU member states, the Act applies to you.
The Compliance Checklist
Conformity Assessment High-risk systems require a documented conformity assessment before deployment. This includes a technical description of the system, a description of the training data and its provenance, and evidence of testing for discriminatory outputs.
Risk Management Documentation Maintain a risk management system that identifies risks throughout the system’s lifecycle, not just at deployment. The documentation must be updated whenever the system is modified.
Data Governance Training data for high-risk systems must meet quality criteria, be free of discriminatory patterns, and be documented. This requires a data audit process that many organisations do not currently have.
Human Oversight High-risk AI systems must be designed to allow effective human oversight. This means more than a human in the loop — it means a human who has enough context and authority to override the system’s outputs.
Incident Reporting Serious incidents involving high-risk AI must be reported to national supervisory authorities within 15 days. Define what constitutes a serious incident in your context before an incident occurs.
Transparency for Interacting Users Users who interact with AI systems must be informed they are doing so, unless it is obvious from context. This applies to chatbots, recommendation systems, and automated decision tools.
What to Do This Quarter
For most enterprises, the priority actions are:
- Inventory your AI systems and classify them by risk level under the Act’s taxonomy.
- Identify your highest-risk systems and assess whether existing documentation meets conformity assessment requirements.
- Assign compliance ownership — the Act requires a named responsible person for high-risk systems.
- Review your data governance practices for systems that use personal data in training.
The organisations that will struggle most with the AI Act are those that have not previously treated AI governance as a formal practice. Start there.