The EU AI Act Is Fully In Force: What Every AI Company Must Know Now

The EU AI Act is now fully operative, and the grace period is over. After more than two years of phased implementation, the high-risk AI provisions that form the law's commercial core became applicable in August 2026, bringing the world's first comprehensive AI regulation to its full force. Every company building AI products for the European market — and many that do not think of themselves that way — is now operating under a legal framework with real teeth: mandatory conformity assessments, ongoing monitoring obligations, and fines that scale to a percentage of global revenue. The enforcement era has started, and the first major test cases are a question of when, not whether.

A Law Built in Phases

The EU AI Act was published in the Official Journal of the European Union in July 2024 and entered into force on 1 August of that year, but the legislature designed it with a staged rollout that gave companies time to adapt. Prohibitions on the most dangerous AI practices — government-run social scoring, real-time biometric surveillance in public spaces, manipulation of behavior through subliminal techniques — applied from February 2025. Obligations for general-purpose AI models arrived in August 2025. The high-risk AI system requirements, the layer that affects the widest range of commercial applications, became binding in August 2026. By November 2026, every phase of the regulation is live, and what was once a planning problem for legal teams is now an operational problem for product and engineering teams.

The EU AI Act Compliance Stack

The Act organizes AI risk into four distinct layers, and the layer a product occupies determines the entire compliance architecture it must support. At the base sit prohibited AI practices — the outright bans that have been in force since February 2025, covering social scoring, subliminal behavioral manipulation, and indiscriminate biometric surveillance in public spaces. Above that sits the high-risk layer: AI systems in enumerated use cases that must meet rigorous ongoing obligations before and during deployment. Above that is the GPAI tier: foundation models made available broadly, subject to their own transparency and systemic-risk requirements. At the top sits a category of systemic-risk models — the most capable large language models trained above a compute threshold — that carry the most demanding obligations of any AI product class in the world.

Each layer is additive, not exclusive. A company deploying a large GPAI model for HR screening sits in both the GPAI tier and the high-risk layer simultaneously, triggering obligations from both. The compliance stack is not a checklist you work through once; it is an architecture that must be maintained as the product evolves, the user base changes, and the regulation's implementing acts develop. Understanding which layer your product occupies — and which combination of layers applies — is the foundational question from which all other compliance work follows.

What 'High-Risk' Actually Means for Commercial AI

The Act's high-risk category is defined by use case, not by technical architecture or model capability. The category covers AI deployed in critical infrastructure management, education and vocational training, employment and worker management, access to essential services like credit and insurance underwriting, law enforcement and criminal risk assessment, migration and border control, and the administration of justice. The defining principle is social consequence: a system qualifies as high-risk when its decisions materially affect people's lives, livelihoods, or access to services. For any company using AI automation in HR hiring, credit decisioning, tenant screening, medical diagnosis support, or public-service delivery, that classification is not theoretical — it applies directly and immediately.

The compliance obligations that follow are substantial and ongoing. High-risk system providers must conduct conformity assessments before deployment, establish and maintain risk management systems throughout the product lifecycle, implement data governance practices for training and test data, log system operation for audit purposes, provide transparency documentation to users and operators, design in human oversight capabilities sufficient for meaningful human review, and register their systems in a public EU database before placing them on the market. This is a compliance architecture that must remain live and current, not a checklist you complete at launch and set aside.

The GPAI Layer: When the Model Itself Is Regulated

The EU AI Act introduces a category that has no real precedent in earlier product regulation: the general-purpose AI model, or GPAI. Any AI model trained for a wide range of tasks and made available through APIs, integrated products, or deployment tools falls into this category — and that description covers most of the foundation models underpinning the current generation of AI-native applications. The implication is significant: the regulation reaches not just the application built on top of a model but the model itself, creating compliance obligations that sit at the infrastructure layer of the artificial intelligence stack.

GPAI model providers must publish summaries of training data sufficient to support copyright compliance, document their models' capabilities and limitations, and maintain technical documentation for the downstream operators who build on their infrastructure. For models trained above a compute threshold of ten to the twenty-fifth floating-point operations — the threshold that separates standard GPAI from systemic-risk models — the obligations escalate considerably. These high-compute models face adversarial testing requirements, evaluation against agreed benchmarks, incident reporting obligations to national authorities, and cybersecurity measures proportionate to their risk profile. The practical effect is that the most capable generative AI models now carry both a standard compliance package and an elevated tier of ongoing obligations that have no sunset date.

The Extraterritorial Reach Most Founders Underestimate

Like GDPR, the EU AI Act applies based on where AI outputs are used, not where the company deploying the AI is incorporated. Any provider placing an AI system on the EU market, or whose system's output is used in the EU to affect EU persons, is fully within scope regardless of their registered address. If your AI hiring tool is used to screen candidates in Germany, you are within scope. If your AI credit-scoring API powers a lender in France, you are within scope. If your AI content moderation system flags posts for a Dutch social platform, you are within scope. Incorporation in California is not a shield, and there is no de minimis exemption based on company size for the high-risk category.

The enforcement mechanism is built for this extraterritorial reality. EU member states each designate national competent authorities who can investigate, audit, and fine companies operating in their territory, reaching companies with no EU establishment through requirements to appoint an EU representative. Administrative fines — up to €35 million or 7% of global annual turnover for the most serious violations — are designed to be material even for large companies and punishing for smaller ones. The digital transformation of compliance is therefore not an optional enhancement for EU-facing AI products; it is a legal obligation with quantified maximum penalties.

The Provider-Operator Split and What It Changes

The Act draws a commercially important distinction between providers, the companies that develop and place AI systems on the market, and operators, also called deployers, the businesses that put those systems to use in specific contexts. A company that builds an AI hiring tool is a provider; the employer that uses it in their recruitment process is an operator. Both carry obligations under the Act, but those obligations differ in kind, and the split has started reshaping procurement dynamics across the enterprise AI market.

Operators are responsible for assessing whether a third-party AI system is high-risk in their specific deployment context, maintaining operational logs, ensuring their staff is appropriately trained, and conducting fundamental rights impact assessments before deploying high-risk systems. This means that buying a third-party AI tool and using it does not transfer the compliance burden entirely to the vendor — the buyer owns a share of it. The enterprise procurement conversation now routinely includes AI Act compliance documentation in the same way GDPR compliance status became a standard due-diligence item for data processors. Providers who can supply clean, complete conformity documentation have a commercial advantage; those who cannot are encountering legal hesitation at the enterprise buying stage.

Why Compliance Is Becoming a Competitive Differentiator

The companies that treated the EU AI Act as a future problem now face the prospect of scrambling — or of becoming an example in the first major enforcement action. The companies that invested in compliance infrastructure during the grace period are, by contrast, in a position to compete rather than defend. That gap is already widening, and it has an interesting secondary effect: in regulated verticals, compliance capability is functioning less like a cost center and more like a moat.

Enterprise buyers in regulated industries — financial services, healthcare, insurance, public sector — were already demanding audit trails, transparency documentation, human oversight mechanisms, and incident reporting capabilities before the Act came into force. The Act has formalized those demands into legal requirements, which means companies that built to those standards early now have documented proof of compliance as a sales asset. For software-as-a-service platforms serving HR, fintech, or healthcare, compliance documentation has entered the standard enterprise procurement checklist alongside SOC 2 and ISO 27001. The companies that built compliance into the product architecture rather than bolting it on after the fact face substantially lower retrofit costs and structurally better go-to-market positioning.

Risks

Several genuine uncertainties remain that operators and investors should track without trying to resolve prematurely. Classification guidance from the European AI Office continues to develop through implementing acts and official opinions; companies that have assessed a system as limited-risk may find interpretations shift, requiring retroactive compliance work. Enforcement patterns will initially focus on the most visible harms in the highest-impact categories, which means violations in more obscure applications may go unaddressed for years — but compliance is not optional because enforcement is probabilistic. The EU AI Act also sits within a broader regulatory stack: GDPR imposes its own requirements on AI systems that process personal data, sectoral regulations in finance and healthcare add further obligations, and the interaction between these frameworks creates complexity that a single conformity assessment cannot resolve. Companies operating across multiple EU member states face the additional challenge of inconsistent interpretations from different national competent authorities, and the harmonization of enforcement practice will take years to mature.

The Bottom Line

The EU AI Act's full implementation is the most consequential regulatory development in artificial intelligence since the technology became commercially mainstream. For founders and operators, the message is direct: if your AI product touches credit, hiring, health, infrastructure, or any other high-risk use case, and that product reaches EU users, you are now operating under binding legal obligations with significant penalty exposure. If you build or deploy a large-scale generative AI model above the systemic-risk compute threshold, you face an additional and ongoing tier of requirements. The compliance window closed in August 2026, the enforcement apparatus is operational, and the first landmark case will function as the regulation's true market launch. The companies that built compliant products during the grace period will find the regulation a moat; the ones that did not will find it an existential cost.

Related

• The EU AI Act''s High-Risk Clock Has Run Out
• Sovereign AI Strategies: Why Nations Are Building Their Own Models
• Agentic AI Workflows: What Actually Ships in Enterprise

Sources

• Regulation (EU) 2024/1689 — The EU Artificial Intelligence Act
• European AI Office — European Commission
• EU AI Act: First Regulation on Artificial Intelligence — European Parliament