Tech

EU Tightens AI Rules as Tech Giants Face Fines

New enforcement phase targets non-compliant models

Von ZenNews Editorial 14.05.2026, 20:29 8 Min. Lesezeit

EU Tightens AI Rules as Tech Giants Face Fines

The European Union has entered a new enforcement phase of its Artificial Intelligence Act, placing major technology companies on notice that non-compliant AI systems face penalties of up to 35 million euros or seven percent of global annual turnover, whichever is higher. Regulators across the bloc are now actively reviewing high-risk and general-purpose AI models, with initial compliance deadlines already passed and formal investigations expected to follow.

The move represents the most significant regulatory escalation in AI governance to date, affecting companies including Google, Meta, Microsoft, Apple, and a growing number of European AI developers. According to analysis from Gartner, fewer than half of large enterprises deploying AI systems in regulated sectors were fully compliant with the Act's requirements at the time the first enforcement obligations took effect. The pressure is now intensifying across the industry.

Lesen Sie auch

Key Data: The EU AI Act classifies AI systems into four risk tiers — unacceptable, high, limited, and minimal. High-risk systems, which include those used in healthcare, critical infrastructure, employment, education, and law enforcement, face the strictest requirements. General-purpose AI models with over 100 million parameters that are made available to third parties must comply with transparency, documentation, and safety testing obligations. Fines for the most serious violations reach 35 million euros or 7% of global turnover. Prohibited AI practices — such as real-time biometric surveillance in public spaces without specific exemptions — attract the highest penalties. The EU AI Office, established within the European Commission, is the primary supervisory body for general-purpose models.

What the AI Act Actually Requires

The EU Artificial Intelligence Act is the world's first comprehensive legal framework regulating artificial intelligence as a category of technology. It applies to any company that places an AI system on the EU market or whose AI systems affect people within the EU — meaning it applies to non-European companies operating in the bloc, not just domestic developers.

The Risk-Tiered Compliance Model

The Act organises AI systems by risk level rather than by technical type. At the highest tier sit prohibited applications — AI systems that pose an unacceptable threat to fundamental rights. These include social scoring systems used by governments to evaluate citizens' behaviour, AI that exploits psychological vulnerabilities, and most forms of real-time remote biometric identification in publicly accessible spaces. These are banned outright.

High-risk systems occupy the next tier and carry the most extensive compliance requirements. Before deploying a high-risk AI system, providers must conduct conformity assessments, maintain detailed technical documentation, register the system in a new EU-wide database, ensure human oversight mechanisms are in place, and demonstrate that the system was trained on data meeting quality standards. Systems making decisions in recruitment, credit scoring, medical devices, and border control all fall into this category.

General-Purpose AI Under Scrutiny

A significant addition to the regulatory framework covers general-purpose AI models — large language models and foundation models of the kind that power tools like ChatGPT, Gemini, and Claude. Companies providing these models must publish technical documentation, comply with EU copyright law, and release summaries of training data. Models deemed to pose systemic risk — a category defined partly by computational training thresholds — face additional obligations including adversarial testing and incident reporting to the EU AI Office. According to Wired, this provision has generated considerable lobbying pressure from US technology firms who argue the requirements are disproportionate relative to the stage of technical development.

The Enforcement Timeline and Who Is at Risk

The Act is being rolled out in phases. Prohibitions on unacceptable-risk AI applications became applicable first. Requirements for general-purpose AI models followed. High-risk system obligations are phasing in over a longer period, though providers are expected to begin compliance preparations immediately and are already subject to the EU AI Office's oversight activities.

Which Companies Face the Most Exposure

Large technology companies with AI products widely deployed across European markets face the broadest exposure. According to IDC research, enterprise adoption of AI tools in EU member states has accelerated sharply in recent years, meaning the pool of potentially non-compliant deployments is substantial. Companies including Google DeepMind, Meta AI, Microsoft Azure AI, Amazon Web Services, and Apple — all of which offer AI-integrated services in the EU — must ensure their general-purpose model offerings meet transparency and documentation standards.

European companies are not exempt. French AI developer Mistral AI, which produces highly capable open-weight models, has engaged with EU policymakers on the regulatory implications for open-source and open-weight model distribution. Officials have indicated that even open-weight models may carry obligations if they exceed defined capability thresholds and are made broadly accessible. The EU AI Office is expected to publish further clarifications on open-model compliance in the coming months, officials said.

For context on how these requirements interact with emerging UK policy, see our coverage of UK regulatory obligations for large technology firms and how transatlantic compliance frameworks are beginning to diverge.

The EU AI Office: Europe's New AI Watchdog

The EU AI Office, headquartered within the European Commission in Brussels, serves as the central enforcement body for general-purpose AI models. It has the authority to request model documentation, commission independent evaluations, and — in cases of confirmed systemic risk — impose remediation orders and fines. Member state authorities retain enforcement responsibility for high-risk AI systems deployed within their jurisdictions, creating a two-tier enforcement structure.

Investigative Powers and Cooperation Mechanisms

The AI Office can conduct its own investigations, require companies to hand over internal testing results and technical specifications, and coordinate with national competent authorities. It can also require companies to take corrective action before a formal fine is issued, though regulators have indicated they will not indefinitely accept slow compliance. According to MIT Technology Review, the AI Office's establishment was closely watched by technology governance researchers as a test of whether the EU could build effective institutional capacity to oversee frontier AI systems, a technically complex and rapidly evolving domain.

The question of how enforcement scales practically remains open. Critics of the Act, including some AI safety researchers, have argued that the EU's focus on documentation and risk classification may not adequately address the most serious long-term risks from advanced AI systems. Proponents counter that establishing baseline accountability and transparency obligations is a necessary first step. For analysis of related early regulatory efforts in the UK, see our piece on UK plans to impose strict AI safety rules on technology companies.

Industry Response: Compliance Costs and Strategic Repositioning

Technology companies have been building out legal and compliance teams specifically focused on the AI Act. Several large US firms have hired dedicated EU AI compliance counsel and established internal review boards tasked with cataloguing AI deployments against the Act's risk taxonomy. The compliance cost is not trivial — Gartner has estimated that for large enterprises with multiple AI products across regulated sectors, achieving full AI Act compliance may require multi-million-euro investments in documentation infrastructure, testing regimes, and staff training.

Open Source and the Compliance Burden Debate

One of the most contested areas of implementation concerns open-source AI models. Smaller developers and academic institutions have raised concerns that documentation and conformity requirements create barriers that disproportionately disadvantage non-commercial actors and open-source communities, while large corporations with dedicated legal departments can absorb compliance costs more easily. The EU has indicated some flexibility in how obligations apply to genuinely open models used for research, but the boundaries remain contested.

Industry groups including DigitalEurope, which represents major technology companies operating in the EU, have submitted formal feedback to the European Commission urging further guidance on implementation timelines and calling for regulatory sandboxes — controlled testing environments where new AI systems can be trialled with reduced regulatory friction before full market deployment. Some member states have begun establishing such sandboxes at a national level.

Company / Model	AI Products in EU Scope	Risk Classification (Approximate)	Key Compliance Obligation	Estimated Exposure
Google DeepMind	Gemini (general-purpose LLM), Vertex AI	General-purpose / Systemic risk candidate	Training data transparency, adversarial testing	Up to 7% global turnover
Meta AI	Llama model family, Meta AI assistant	General-purpose (open-weight)	Technical documentation, copyright compliance	Up to 7% global turnover
Microsoft	Azure OpenAI, Copilot suite	General-purpose / High-risk deployments	Conformity assessment for high-risk use cases	Up to 7% global turnover
OpenAI	GPT-4o, ChatGPT, API services	General-purpose / Systemic risk candidate	Incident reporting, safety evaluations	Up to 35M euros or 7% turnover
Mistral AI	Mistral Large, Mixtral (open-weight)	General-purpose	Documentation; open-model guidance pending	Dependent on final open-source guidance
Apple	Apple Intelligence, on-device AI features	Limited / General-purpose	Transparency obligations for integrated AI	Up to 7% global turnover

The Broader Regulatory Context: A Global Race to Govern AI

The EU's enforcement escalation is unfolding against a backdrop of intensifying AI governance activity in multiple jurisdictions. The United Kingdom has taken a sector-specific regulatory approach, relying on existing regulators — including the Financial Conduct Authority, the Information Commissioner's Office, and the Care Quality Commission — to apply AI oversight within their respective domains, rather than creating a single AI law. This divergence between the EU's horizontal legislative model and the UK's distributed approach has significant implications for companies operating across both markets.

For an overview of how these UK-side obligations are taking shape, our reports on UK AI safety rules advancing ahead of US legislation and the broader EU landmark compliance rule framework provide detailed context on the parallel regulatory trajectories.

US Policy and the Transatlantic Divergence

In the United States, federal AI regulation remains fragmented. Executive orders have directed federal agencies to assess AI risks and procurement practices, and several congressional proposals have been introduced, but no comprehensive federal AI law comparable to the EU Act is currently in force. This creates an asymmetry in which US-headquartered companies face binding EU obligations for their European operations without equivalent domestic compliance requirements at home. According to Wired, this dynamic has accelerated lobbying activity in Brussels by US technology firms seeking to shape the technical standards that will determine what systemic risk actually means in practice.

The EU's enforcement phase marks a turning point: AI governance is moving from policy debate to legal reality. Whether the framework succeeds in improving the safety and accountability of AI systems deployed across Europe — without stifling the innovation that the bloc's own technology sector depends upon — will be determined not in regulatory documents but in the practical outcomes of the investigations, audits, and enforcement decisions that are now beginning in earnest. For further reading on the EU's earlier compliance deadline announcements, see our report on EU AI compliance deadlines and what they mean for technology firms.