The Enforcement Era Begins
Updated 2 September 2026: this article was revised to reflect the AI Omnibus (in force 27 July 2026), which moved Annex III high-risk obligations to 2 December 2027 and Annex I product-embedded systems to 2 August 2028.
On August 2, 2025, the EU AI Act's penalty regime officially activated, marking the beginning of a new era in artificial intelligence regulation. For the first time, organizations deploying AI systems across the European Union face concrete financial consequences for non-compliance — fines that can reach up to €35 million or 7% of global annual turnover, whichever is higher.
This milestone represents the culmination of years of regulatory development and positions the EU as the global leader in AI governance. The penalties are structured across three tiers, reflecting the severity of violations and creating a clear incentive structure for compliance.
Three-Tier Penalty Structure
The EU AI Act establishes a graduated penalty framework that mirrors — and in many cases exceeds — the GDPR's fine structure. At the highest tier, violations related to prohibited AI practices carry fines of up to €35 million or 7% of global turnover. The second tier covers other obligation violations at €15 million or 3% of turnover. The lowest tier addresses misleading information provided to authorities at €7.5 million or 1% of turnover.
For SMEs and startups, the regulation provides proportionate caps to avoid existentially threatening penalties, though the expectations for compliance remain unchanged. This graduated approach signals the EU's intent to enforce rigorously while acknowledging the diverse landscape of AI deployers.
Member State Readiness Gap
Despite the August 2025 deadline, the readiness of EU Member States to enforce the AI Act varies dramatically. As of late 2025, only 3 Member States have fully designated their national competent authorities, with 10 in partial implementation and 14 still pending. This creates a fragmented enforcement landscape that organizations must navigate carefully.
National authorities, the European Commission, and the European Data Protection Supervisor all have enforcement powers. Organizations operating across multiple Member States face the added complexity of potentially different national implementations and enforcement priorities.
GPAI Models: A Temporary Reprieve
Providers of general-purpose AI (GPAI) models received a temporary reprieve: Commission enforcement powers and fines for GPAI-specific obligations only became available on 2 August 2026. GPAI models already on the market before 2 August 2025 have a transition period extending to 2 August 2027.
However, this shouldn't be mistaken for an invitation to delay preparation. The documentation requirements, training data summaries, and copyright compliance obligations are already in effect. Organizations should treat this transition period as an opportunity to build robust compliance frameworks rather than a reason to postpone action.
What Organizations Must Do Now
For enterprises deploying AI systems in the EU, the activation of penalties means immediate action is required. First, conduct a comprehensive AI system inventory — you cannot comply with regulations for systems you haven't identified. Second, classify each system against the Act's risk tiers: unacceptable (prohibited), high-risk, limited-risk, and minimal-risk.
Third, for high-risk systems, begin preparing the mandatory documentation: technical documentation, risk management systems, data governance frameworks, and human oversight mechanisms. The AI Omnibus moved the Annex III high-risk date to 2 December 2027 (Annex I product-embedded systems: 2 August 2028), but this documentation takes months to build and the date is closer than most organizations realize.
Arcus automates this entire process — from AI system inventory and risk classification to documentation generation and continuous regulatory monitoring across 15 live jurisdictions.