AI Act Enforcement in 2026: What EU Regulators Have Signalled So Far

Updated 7 Oct 2026: Digital Omnibus on AI (Regulation (EU) 2026/1744).

# AI Act Enforcement Predictions 2026: The Signal Behind the Noise

The most reliable ai act enforcement predictions 2026 do not come from speculation; they come from what national supervisory authorities and the European Commission have already said on the record. Read those signals carefully and a clear pattern emerges: the first 18 months of serious enforcement will look a lot like the first 18 months of GDPR, heavy on guidance and investigation, lighter on fines, but with a handful of high-visibility cases designed to set the tone.

That does not mean SMEs can relax. It means they need to spend their compliance budget in the right place, right now.

# The Regulatory Calendar That Actually Matters

The AI Act entered into force on 1 August 2024. From there, obligations phase in, on a calendar the Digital Omnibus on AI (in force since 27 July 2026) partly rewrote:

• 2 February 2025: Prohibitions on unacceptable-risk AI (Article 5) and the Article 4 AI literacy duty have applied since this date. The prohibitions include social scoring and, with narrow exceptions, real-time remote biometric identification in public spaces for law enforcement.
• 2 August 2025: Rules for general-purpose AI (GPAI) model providers and governance obligations for notified bodies applied.
• 2 August 2026: The Act applies in general, including the Article 50 transparency duties, and national market surveillance authorities (MSAs) supervise it from this date.
• 2 December 2026: Two new Article 5 prohibitions added by the Omnibus apply: AI that generates or manipulates realistic intimate images, video or audio of an identifiable person without their explicit consent, and AI that generates child sexual abuse material.
• 2 December 2027: The bulk of high-risk AI obligations for Annex III systems, including those under Article 26 covering deployers, apply. The Omnibus moved them from 2 August 2026. This is now the date SME compliance officers should have circled.
• 2 August 2028: High-risk obligations for AI in regulated products (Annex I) apply.

National MSAs have supervised the Act since 2 August 2026. As they build operational experience, coordinated enforcement actions become realistic.

# What National Authorities Have Actually Said

The Netherlands' Autoriteit Persoonsgegevens (AP) has already signalled that AI systems used in HR and recruitment are a priority area, consistent with its 2023-2025 enforcement agenda on automated decision-making under the AVG. The AP has explicitly linked GDPR Article 22 obligations to emerging AI Act requirements, meaning Dutch SMEs using algorithmic hiring tools face scrutiny from two directions simultaneously.

The German BNetzA and France's CNIL have both published orientation documents indicating that healthcare diagnostics, credit scoring, and employment screening will be the first high-risk categories they examine. This tracks directly with Annex III of the AI Act, which lists these exact use cases as high-risk.

The European AI Office, which oversees GPAI models and coordinates national enforcement, has committed to publishing sector-specific guidance throughout 2025. Expect that guidance to sharpen enforcement priorities now that national supervision is under way.

# The GDPR Precedent: 80% Guidance, 20% Fines in Year One

GDPR went fully applicable on 25 May 2018. In the 18 months that followed, the pattern across EU supervisory authorities was consistent: most resources went into investigations, consultations, and guidance. Fines were real but concentrated. The first major penalty, €50 million against Google by France's CNIL, landed in January 2019, roughly eight months after applicability. Smaller fines followed, but they targeted organisations that had made no visible compliance effort at all.

The AI Act enforcement arc will almost certainly rhyme. National MSAs are still building capacity. The European Commission's digital strategy framework acknowledges that coordinated enforcement depends on member states adequately resourcing their authorities, a process that takes time.

What this means in practice: organisations that can demonstrate a documented, good-faith compliance effort are unlikely to be first-action targets. Organisations using high-risk AI with no records, no transparency notices, and no staff training are exactly the kind of cases regulators will use to establish precedent.

# Which Sectors Face First-Action Risk

Based on public regulator statements and the structure of Annex III, three sectors stand out for early enforcement attention:

HR and recruitment. Automated CV screening, psychometric testing tools, and performance monitoring software are already on the AP's radar in the Netherlands. If your company uses any AI-assisted hiring tool, you are a deployer under Article 26 and, from 2 December 2027, you have specific obligations around human oversight, fundamental rights impact assessments, and staff training.

Financial services. Credit scoring and insurance risk assessment appear in Annex III and are already subject to existing EBA and EIOPA supervisory frameworks. Regulators here have the institutional capacity to act quickly because the supervisory infrastructure already exists.

Healthcare. AI-assisted diagnostics and triage tools face scrutiny from both AI Act MSAs and existing medical device regulators. The overlap creates complexity, but also means regulators can piggyback on existing audit mechanisms.

If your organisation is a deployer in any of these sectors, the new high-risk dates (2 December 2027 for Annex III systems, 2 August 2028 for AI in regulated products such as medical devices under Annex I) are not abstract. They are hard lines.

# Sizing Your Compliance Investment Correctly

Here is where the GDPR comparison becomes genuinely useful for SMEs. Many companies in 2018 either dramatically over-invested (building compliance teams sized for multinationals) or did almost nothing and got caught. The sweet spot was proportionate, documented effort.

For an SME deployer under the AI Act, proportionate effort means four concrete things:

1. An AI system inventory. Know what AI tools you are using, which qualify as high-risk under Annex III, and which vendor supplied them. Article 26 places specific obligations on deployers that cannot be met without this baseline.

2. Staff training records. Article 4, as rewritten by the Digital Omnibus, requires you to take measures to support the AI literacy of staff working with AI systems. It does not require you to guarantee any specific level per person. For SMEs, this does not mean a week-long course. It means documented, role-appropriate training. A one-hour session with a sign-off sheet is a defensible starting point.

3. A transparency mechanism. Article 50 requires that individuals interacting with certain AI systems are informed. If you use a chatbot or an automated decision tool that affects employees or customers, you need a clear notice in place.

4. A Fundamental Rights Impact Assessment (FRIA) for high-risk use cases. Article 27 requires certain deployers of high-risk AI (public bodies, private entities providing public services, and those using AI for credit scoring or for life and health insurance pricing) to conduct a FRIA before deployment. Like the other Annex III obligations, it now applies from 2 December 2027. This is the single obligation most SMEs have not started on, and it is the one most likely to be checked once it applies.

The total investment for a 50-person company with one or two high-risk AI tools should not run to hundreds of thousands of euros. A structured programme over two to three months, with proper documentation, is realistic and defensible.

# Penalties Are Real, But Context Matters

The AI Act sets maximum fines at €35 million or 7% of global annual turnover for violations of prohibited practices under Article 5, and €15 million or 3% of turnover for other violations, including deployer obligations under Article 26. These are maximums. Like GDPR, actual fines will factor in the severity of the violation, whether harm occurred, and crucially, the organisation's demonstrated compliance effort.

SMEs, including start-ups, face the lower of the two figures (Article 99(6)). Since the Digital Omnibus, small mid-cap enterprises also get the lower figure for the €15 million and €7.5 million tiers, but not for prohibited practices (Article 99(6a)). For an SME with 50 employees, a 3% fine on €5 million turnover is €150,000. That is not existential, but it is serious. More damaging for many SMEs would be the reputational cost of being named in a public enforcement decision.

# One Action to Take Before the End of This Quarter

If your organisation has not yet mapped its AI tools against the Annex III high-risk categories, start there. It takes less time than most compliance officers expect, and it is the foundation for everything else: your training programme, your FRIA, your vendor conversations under Article 26.

National supervision has been under way since 2 August 2026, and the Annex III high-risk obligations apply from 2 December 2027. A structured compliance programme started today still finishes with breathing room before those high-risk obligations apply.

Run the free 2-minute compliance check at comply.khairos.ai to see which AI Act obligations apply to your organisation and where your gaps are likely to be. It is the fastest way to know whether your current effort is proportionate to your actual risk.