Enforcement powers under the EU AI Act have applied since 2 August 2026. Three months later, the pattern of how enforcement actually starts is becoming visible, and it does not begin with a fine. It begins with a letter asking you to explain yourself. Knowing who would send that letter, and what happens if your answer is wrong, matters more right now than memorising the maximum penalties.
Who enforces what
Enforcement is split three ways, according to the Commission:
- The European Commission's AI Office enforces the rules for providers of general-purpose AI (GPAI) models. Since the Digital Omnibus it also supervises AI systems built on a provider's own GPAI model (or one from the same group), subject to carve-outs, and AI systems integrated into very large online platforms and search engines designated under the Digital Services Act.
- National competent authorities designated by each member state enforce the rules for all other AI systems. For most companies, including most high-risk and Article 50 cases, this is who you would hear from.
- The European Data Protection Supervisor covers AI systems used by EU institutions.
National set-up is uneven. Some member states have passed implementing laws and named their authorities in recent weeks; others are still working on it. Your exposure depends on where you place systems on the market, not only where you are established.
The first enforcement actions are requests for information
In mid-October, Executive Vice-President Henna Virkkunen said the Commission had taken its first enforcement actions under the AI Act: requests for information to providers of the most advanced models, following a series of reported incidents involving AI agents. As of early November, no AI Act fine has been reported.
That is how regulatory enforcement normally starts, and it is the step most companies will meet first. A request for information is not an accusation. But it is not harmless either: under the AI Act, supplying incorrect, incomplete or misleading information to an authority can itself be fined, up to €7.5 million or 1% of worldwide annual turnover. For requests issued by formal Commission decision, failing to reply at all can also be fined.
The draft procedural rules: longer exposure
On 12 October 2026 the Commission opened a consultation (closing 9 November) on a draft implementing regulation setting out procedures for AI Office enforcement. As reported, the draft:
- Keeps the five-year limitation period for fines but lets investigative steps (requests for documents or explanations, access to evaluate a system, inspections, opening proceedings) interrupt it and restart the clock, up to a cap of ten years, with suspensions possible beyond that.
- Sets out the right to be heard and access to the file after preliminary findings, with business secrets redacted and confidential material shared only with a limited circle of external advisers.
The draft has not been adopted and applies to AI Office proceedings, not national ones. The direction is still clear: every request you receive can extend how long a past decision stays open to sanction. Records you cannot produce in a year or two are a real risk.
The fine tiers, for context
- Prohibited practices: up to €35 million or 7% of worldwide annual turnover.
- Most other obligations (high-risk requirements, Article 50 transparency, GPAI): up to €15 million or 3%.
- Incorrect or misleading information to authorities: up to €7.5 million or 1%.
For SMEs and start-ups, the lower of the fixed amount and the percentage applies. Our AI Act fine calculator works out the cap for your turnover.
How to be ready for a request
- Know what AI you run. An inventory of every AI system you provide or deploy, with its purpose and owner. Our free AI inventory template gives you the columns; developers can generate a first draft from the codebase with ai-act-scan.
- Write down each system's risk tier and why. The reasoning, with the article or Annex III point, is what an authority will ask for first.
- Keep evidence of what is already due: AI literacy measures (Article 4), Article 50 notices and marking, and confirmation that nothing you do falls under the prohibitions.
- Name one person who answers regulators, so a request does not sit in a shared inbox past its deadline.
EuroComply's free EU AI Act assessment gives you step 2 in about 3 minutes: the risk tier, the article behind each finding and the documents that tier requires, in a form you can keep on file.