EU AI Act’s €35M Fines Hit Unprepared Firms August 2, 2026

Most enterprises operating in the EU are not ready for the high-risk AI governance requirements still to come. A Vision Compliance report from April 2026 found that the vast majority of organizations had not taken meaningful steps toward foundational data-governance readiness, even as August 2, 2026 activated the Act’s transparency rules and handed the European AI Office full enforcement powers over general-purpose AI models, obligations distinct from the high-risk regime the Digital Omnibus has since pushed to December 2027 and August 2028.

The vast majority of organizations had not taken meaningful steps toward compliance, even as the EU AI Act activated its most extensive set of obligations to date and granted the European AI Office full enforcement powers.

A Phased Rulebook, Now at Full Speed

The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024, over 18 months ago, and has rolled out in stages.

Some deadlines have shifted. The Digital Omnibus on AI, which became law on June 29, 2026, pushed back certain deadlines for stand-alone high-risk systems to December 2, 2027, and for AI embedded in regulated products such as medical devices to August 2, 2028. Transparency rules for generative AI, including machine-readable watermarking, apply by December 2, 2026, for systems already on the market by August 2, 2026, with no grace period for systems launched after that date. The staggered structure was intended to give industry time to adapt, but the complexity of identifying which rules apply and when has itself become a significant compliance obstacle.

Readiness Gaps Run Deep

Data governance is where the unpreparedness is sharpest. The Kiteworks 2026 Data Security and Compliance Risk Forecast, published in July 2026, found that the vast majority of organizations could not validate data before it entered AI training pipelines, could not trace training data provenance, and that one in three lacked audit logs entirely, all foundational requirements for high-risk AI systems under the Act.

An appliedAI study cited in early 2023 found that a significant share of enterprise AI systems had unclear risk classifications.

The AI Office’s Resource Gap

The European AI Office, housed within the European Commission, is the central enforcement body for the Act, particularly for GPAI models. As of August 2026, it is staffed by more than 125 people, including technology specialists, lawyers and policy experts. Its enforcement toolkit includes the ability to request technical documentation, evaluate models, mandate corrective measures and issue fines reaching up to €35 million or 7% of global annual turnover for violations involving prohibited practices, penalties that exceed GDPR exposure in the most serious cases. For more on how those fines are structured, see our coverage of what the €35M fine regime means for unprepared enterprises.

The resourcing picture is harder to ignore when set against the industry. Global hyperscaler capital spending is projected at around $527 billion in 2026. Policy analysts at Chatham House have raised concerns that regulatory capacity may not keep pace with the computational resources, technical expertise and volume of proprietary models the private sector is producing, a gap that could constrain the Office’s ability to evaluate and independently audit the most complex systems.

The Legacy System Loophole

Under Article 111, AI systems placed on the market before the new deadlines generally do not need to comply unless they are “substantially modified.” MEP Sergey Lagodinsky of Germany’s Greens has called this a loophole: high-risk AI systems deployed before the December 2, 2027, or August 2, 2028, deadlines could remain outside the Act’s direct oversight indefinitely unless they undergo significant alterations. Laura Caroli, a former co-negotiator of the AI Act, has pointed to AI used in hiring as a prime example, systems in use before December 2, 2027, could be exempt, even as the Act specifically targets employment as a high-risk domain.

The practical result is a two-tiered system, where older unmodified deployments operate under lighter rules than newer ones. Companies facing a costly compliance overhaul have an incentive to keep legacy systems running with minimal changes, staying just below whatever threshold regulators determine constitutes “substantial modification.” The Digital Omnibus delayed some deadlines but left this non-retroactivity principle intact, creating a structural gap the Act has not resolved.

Agentic AI and the Oversight Problem

Agentic AI, systems capable of taking multi-step actions autonomously, poses a specific enforcement challenge that existing compliance frameworks were not built for. Human oversight mechanisms designed for more static models are difficult to apply to systems that operate across extended sequences of actions without pause. Regulators are responding by pushing for stricter logging and interruption requirements, but these place additional technical demands on developers who are already struggling with the foundational infrastructure. The Kiteworks data on training-data provenance is instructive here: if organisations cannot trace where their training data came from, they are a long way from the continuous audit trails that agentic systems will require. The five compliance demands for high-risk AI now in effect make that gap concrete.

Litigation and the Burden of Proof

At the WLF Litigation Summit in Dubai in January 2026, Patrick Rode argued that the EU AI Act fundamentally shifts the burden of proof in AI-related disputes. Companies operating high-risk AI in employment or credit scoring will need to demonstrate human oversight proactively, maintain comprehensive technical documentation, conduct algorithmic impact assessments and ensure system accuracy and robustness. Without that documentation, defendants face a difficult position when AI systems fail or cause harm.

The FTC has brought enforcement actions covering both consumer and business-to-business AI-related claims.

The US Regulatory Picture

In the United States, the SEC has identified AI-related misrepresentations as a priority enforcement area, pursuing actions against investment advisors for misleading claims about their AI use. The FTC and SEC actions together point to a regulatory posture where accurate representation of AI capabilities is treated as a legal obligation, not a marketing preference.

At the procurement level, the General Services Administration proposed new acquisition rules for AI that drew significant pushback from major technology companies including Palantir Nvidia and Microsoft as of August 2026. Their concern centred on the potential exclusion of open-source AI and the imposition of “unbiased AI principles” they argued were not technically feasible. A letter co-signed by more than 230 companies in July 2026, including Meta and Google, urged the protection of open-weight models, warning that the GSA’s approach could shift regulatory responsibility to entities unable to meet it. The episode illustrates how definitional ambiguity in AI policy can create compliance friction even before a rule reaches enforcement.

Building Compliance In, Not On

The clearest lesson from the readiness data is structural: organisations that treat compliance as a post-deployment legal review are already behind. InData Labs, writing in August 2026, argued for integrating risk classification, technical documentation, human oversight mechanisms, training data governance and bias testing as core deliverables from the start of the design cycle, not as retrofits. Organisations with mature GDPR compliance frameworks, particularly in data governance and impact assessments, appear better placed for AI Act readiness, though the two regimes differ in important respects.

The European AI Office’s 125-person team will need to grow, and its technical expertise will need to keep pace with the systems it is tasked with evaluating. Collaboration between regulators, industry and academia on practical, harmonised technical standards is the part of this that cannot be delayed, legislative language does not translate into engineering tasks without it. The compliance gap the readiness surveys document is not just an industry problem; it is also a test of whether the enforcement architecture built around the Act is adequate to the task.