EU's toughest AI Act rules take effect 2 August, fines up to 7% of turnover

Full enforcement of the EU AI Act's high-risk provisions begins 2 August 2026 (CEST), and the penalties attached are steeper than GDPR's: up to €35 million or 7% of global annual turnover for the most serious violations, compared with GDPR's €20 million or 4% ceiling.

What "high-risk" actually covers

The phrase does a lot of work, so it is worth pinning down. The Act sorts AI systems into tiers by the harm they could do, and the high-risk tier, the one whose rules now bite, is defined by use case rather than by how clever the model is. A simple algorithm making consequential decisions about people is high-risk; a sophisticated model writing marketing copy is not, and the 7% ceiling applies the same way to both once a system is in scope.

The listed high-risk uses include AI in recruitment and worker management, credit scoring and access to essential services, education and exam grading, biometric identification, critical infrastructure, law enforcement and migration. The common thread is that a wrong output changes someone's life rather than merely annoying them, which is why these uses carry the heaviest obligations.

The obligations that now apply

Deployers and providers of high-risk systems face a concrete checklist rather than a principle. They must run a risk management system across the model's lifecycle, document training data and guard against bias, keep logs that make decisions traceable, provide clear information to the humans overseeing the system, ensure meaningful human oversight exists, and meet standards of accuracy and robustness. For many organisations the binding constraint is not the model but the paperwork proving all of that, which did not previously have to exist.

Why the fine ceiling is the headline

Separately, the European Data Protection Board has made the right to erasure under GDPR Article 17 a key enforcement priority this year, and regulators are increasingly testing websites proactively rather than waiting for complaints.

The 7% figure is deliberately set above GDPR's 4%, and the signal is intentional: Brussels has decided AI misuse warrants a harder cap than data misuse. For a large multinational, 7% of global turnover is an existential number rather than a cost of doing business, which is the entire point. GDPR established that turnover-based fines change boardroom behaviour in a way fixed sums never did, and the AI Act borrows that lever and pulls it harder.

Extraterritorial reach is the part outsiders miss

The Act applies based on where the AI's output is used, not where the company sits. A US firm screening EU job applicants, or a model whose decisions affect EU residents, falls inside it regardless of having no European office. This is the same extraterritorial design that made GDPR a global standard, because the cheapest way to comply with the strictest market is usually to apply its rules everywhere, and we have covered that regionalisation pressure in Apple building a separate AI stack for China and the EU's own chatbot disclosure rules.

The compliance cost nobody budgeted

The under-discussed burden is cost, and it falls unevenly. Large firms absorb a compliance function; small ones feel it as a tax on building anything high-risk at all. Industry estimates for high-risk AI compliance have run into six figures per system for documentation, assessment and ongoing monitoring, which is trivial for a bank and potentially fatal for a startup selling an AI hiring tool. That asymmetry is a deliberate policy choice with a side effect: the rules that protect people from reckless AI also raise the barrier to entry, which tends to entrench the incumbents who can afford the paperwork.

Vendors are already responding by splitting products, offering an EU-compliant configuration alongside a lighter one elsewhere, the same regionalisation the industry adopted for data years ago.

The enforcement question

A law is only as real as its enforcement, and that is where the honest uncertainty sits. GDPR took years to produce its largest fines, as regulators built capacity and tested cases, and the AI Act's supervisory structure across 27 member states is newer still. Expect a slow start followed by precedent-setting cases, rather than a wave of 7% fines on day one.

What is already visible is movement, with the first enforcement action targeting biometric surveillance and the bloc simultaneously adjusting some deadlines through a digital omnibus. European regulators have also grown bolder on adjacent data cases, from a €403 million GDPR location-data fine against Google to France fining IQVIA over health data, which is the enforcement muscle the AI Act will draw on.

Why this matters: if your organisation builds or deploys AI systems that touch EU users, even from outside the EU, the compliance clock is now running under a tighter deadline, and a higher fine ceiling, than most GDPR-only obligations you may already track.

The practical first move is classification: work out whether any AI you build or use falls in the high-risk list, because everything else follows from that answer. Most organisations discover they have less high-risk exposure than they feared and more undocumented AI than they realised, and the documentation gap is the one that takes months to close.

What to actually do about it

For a team facing the deadline, the sequence that works is unglamorous. Inventory every AI system in use, including the ones bought as features inside other software, because the obligation attaches to use not procurement. Classify each against the high-risk list. For anything high-risk, the gap is almost always documentation rather than the model itself, so the work is assembling risk assessments, data lineage and oversight procedures that can survive a regulator asking to see them. Most organisations find this takes months, which is why starting after the deadline rather than before it is the expensive path. The firms that treated the AI Act like GDPR, a programme rather than a panic, are the ones not scrambling now.

Key takeaways

• High-risk provisions of the EU AI Act enforce from 2 August 2026, with fines up to €35 million or 7% of global turnover, above GDPR's €20 million or 4%.
• "High-risk" is defined by use case, not sophistication: recruitment, credit, education, biometrics, critical infrastructure and law enforcement are in; marketing copy is not.
• Obligations are largely documentary: risk management, data governance, logging, human oversight and robustness standards that must be provable.
• The 7% ceiling deliberately exceeds GDPR's 4% to signal that AI misuse is treated as more serious than data misuse.
• Reach is extraterritorial, based on where the output is used, so non-EU firms touching EU users are covered.
• Expect enforcement to start slowly then set precedents, as GDPR did, with the first AI Act action already targeting biometric surveillance.
• Classify your AI against the high-risk list first; the documentation gap is what takes months to close.