How Is the EU AI Act Enforced?

Who enforces the AI Act?

Enforcement is divided by subject matter, not by a single regulator. At Union level, the AI Office, established within the Commission, has central responsibilities for general-purpose AI models and, following Regulation (EU) 2026/1744, for specified AI systems assigned to Union-level supervision. In each Member State, national competent authorities, including a notifying authority and at least one market surveillance authority, supervise AI systems on their territory, with a single point of contact for coordination. For EU institutions, bodies, offices and agencies, the European Data Protection Supervisor acts as the supervisory authority, except in relation to the Court of Justice acting in its judicial capacity. The European Artificial Intelligence Board coordinates Member States and advises the Commission and Member States, while the Scientific Panel and Advisory Forum support enforcement with independent expertise and stakeholder input. An organisation should therefore identify, for each system, which authority is relevant, rather than assuming one regulator covers the whole Act.

When did enforcement start?

Enforcement powers began applying on 2 August 2026 for provisions already in application, as the Commission AI Act Service Desk timeline states. That date covers enforcement concerning general-purpose AI models, prohibitions, transparency rules and AI literacy, within the respective competences of the AI Office and national authorities. It did not make every provision enforceable at once: high-risk requirements apply later, from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems, and enforcement of those requirements follows their application dates. A compliance team should therefore connect each obligation to its application date and to the authority that enforces it, rather than using one blanket enforcement date. An obligation can exist before its enforcement mechanism becomes available, and a later application date does not suspend enforcement of duties that are already applicable. The dated provision, not the general calendar, is what determines exposure.

For the broader regulatory framework, see enforcement and market surveillance.

What can a market surveillance authority do?

A market surveillance authority carries out market surveillance under Chapter IX and Regulation (EU) 2019/1020, and it can evaluate whether an AI system presents a risk, require the relevant operator to take corrective action, and, where non-compliance persists, restrict or prohibit the system being made available, or ensure it is recalled or withdrawn. In carrying out an evaluation, the authority can require access to information and documentation, and in defined circumstances to data, including training, validation and testing datasets, and to source code, subject to the safeguards in the Act. The authority can also require the operator to provide information about the supply chain, the conformity assessment and the post-market monitoring system. Those powers are significant, and they are why documentation, logs and registration records should be kept in a form that can be produced promptly. An operator that cannot produce its records when asked will face a harder enforcement conversation than one that can.

How do penalties fit into enforcement?

Penalties are the financial consequence of infringement, set by Member States within the ceilings fixed by Article 99, and they sit alongside corrective action rather than replacing it. An authority can order a system to be brought into compliance and a Member State can impose a penalty for the infringement, and the two consequences address different things: the first fixes the market position, the second sanctions the breach. Article 99 fixes three tiers of maximum fines for undertakings, with the higher of a fixed sum or a percentage of worldwide annual turnover, and a lower-of rule for small and medium-sized enterprises and start-ups, which Regulation (EU) 2026/1744 extended in defined respects to small mid-caps. General-purpose AI fines under Article 101 are separate and are imposed by the Commission. Penalty amounts must be effective, proportionate and dissuasive, and the Act lists factors the authority must consider, including the nature, gravity and duration of the infringement and any cooperation. The figures are addressed in detail in the guides on Articles 99 and 101.

What routes exist for people affected by an AI system?

People affected by an AI system have routes that do not depend on the operator volunteering information. Any natural or legal person having grounds to consider that an infringement has occurred may submit a complaint to the relevant market surveillance authority under Article 85, and complaints must be taken into account for market surveillance purposes and handled under the authority's dedicated procedures. Persons subject to a decision taken by a deployer on the basis of the output of a high-risk system have a right to an explanation under Article 86, subject to its conditions and exceptions. Persons reporting infringements are protected under Article 87, and the Act provides for judicial remedies alongside administrative ones. Those routes mean that an enforcement issue can reach an authority through a complaint, a whistleblower report or an authority's own surveillance, not only through the operator's self-reporting. An organisation should therefore treat complaints and explanations as part of its enforcement exposure, not as customer service alone.

Continue with the role and powers of the AI Office.

What does this guide not decide?

This overview does not decide which authority supervises a particular system, what powers that authority will exercise, or what penalty or corrective action would follow from a particular infringement. Those questions depend on the system, the provision, the Member State and the facts, and they require the consolidated text of Chapters VII and IX and the national implementation measures to be checked for the specific case. The guide also does not cover enforcement under other law, such as data protection, consumer protection or product safety law, which can run in parallel and can involve different authorities and remedies. Where enforcement exposure is in issue, confirm the position with a competent authority or legal adviser, and keep the classification, documentation and monitoring records that an authority would ask to see.

Frequently asked questions

Continue through this AI Act cluster

• enforcement and market surveillance
• the role and powers of the AI Office
• national competent authorities under Article 70
• penalties under Article 99
• the right to lodge a complaint under Article 85
• EU database, registration and post-market monitoring