AI Act enforcement has quietly begun: a readiness checklist for non-EU firms

At a glance: In late August 2026, the European Commission's AI Office sent formal information requests to more than 30 companies that build general-purpose AI models, its first use of new enforcement powers. On 9 October, Executive Vice-President Henna Virkkunen said Europe is "well equipped" to handle the risks of very capable models. The AI Act applies to non-EU providers and deployers whose AI is used in the EU, so firms worldwide need a readiness plan.

The news

The EU AI Act has moved from rulebook to enforcement. The European Commission's AI Office confirmed on 29 August 2026 that it had sent formal requests for information to more than 30 companies that build general-purpose AI models. The Commission has not named the companies. The requests asked about safety and security measures, with follow-up questions on transparency and copyright obligations.

The requests came within a month of the Commission gaining enforcement powers over general-purpose AI model providers. Obligations on those providers have applied since 2 August 2025; the Commission's power to fine them applies from 2 August 2026.

In an interview published on 9 October, Henna Virkkunen, the Commission's Executive Vice-President for tech sovereignty, said of the safety and security of very capable models: "we in Europe are well equipped for that." She added that "the AI Act covers the whole life cycle of these models", rejected claims from some companies that the rules are already outdated, and said she is assessing the responses to the information requests. She noted that the most capable models come from the US and China and said the Commission had also sent requests to Chinese providers.

What the fines look like

The headline figure often quoted for the AI Act is a fine of up to 7% of global turnover. That ceiling exists, but it applies to the most serious category: breaches of the Act's prohibited AI practices, where fines can reach €35m or 7% of worldwide annual turnover, whichever is higher.

For providers of general-purpose AI models, the relevant ceiling is different. The Commission may fine them up to 3% of worldwide annual turnover or €15m, whichever is higher, for infringing the Act, failing to comply with a request for information, supplying incorrect, incomplete or misleading information, or refusing access for an evaluation.

Other operators, including deployers of high-risk AI systems and those bound by transparency duties, face fines of up to €15m or 3% of turnover. Supplying incorrect or misleading information to authorities can bring fines of up to €7.5m or 1%.

The practical point: a weak answer to an information request is itself a finable offence.

The timetable has changed

In July 2026 the EU adopted the Digital Omnibus on AI, which amends the AI Act. It was published in the Official Journal on 24 July and entered into force on 27 July. Key dates are now:

• Prohibited practices: in force since 2 February 2025. New prohibitions added by the Omnibus, covering AI used to create non-consensual intimate imagery and child sexual abuse material, apply from 2 December 2026.
• General-purpose AI model obligations: since 2 August 2025, with Commission fining powers from 2 August 2026.
• Transparency duties (Article 50): from 2 August 2026, including telling people they are interacting with AI. Machine-readable marking of synthetic content has a grace period to 2 December 2026 for systems placed on the market before 2 August 2026.
• High-risk systems listed in Annex III (such as recruitment and credit scoring): postponed from August 2026 to 2 December 2027.
• High-risk AI in regulated products (Annex I): postponed to 2 August 2028.

Why non-EU firms are in scope

The AI Act reaches beyond Europe's borders. It applies to providers placing AI systems or general-purpose models on the EU market wherever they are established, and to providers and deployers located outside the EU where the output of their AI system is used in the EU.

A US lender scoring European applicants or a Gulf airline with a chatbot serving European passengers may both have obligations, depending on the use.

Agents and the enforcement pattern

Virkkunen's comments came amid concern about AI agents acting in ways their developers did not intend. In WCRC's reading, the August requests point to a pattern likely to repeat: a publicised incident or risk, followed by a formal request for documentation. For companies that deploy agents built on third-party models, the exposure is indirect but real. If a provider's response led to an evaluation, required mitigation or restriction of a model in the EU, deployers depending on that model would feel it.

The more direct duties on deployers, including transparency today and high-risk obligations from late 2027, also apply when an agent does the work. An agent that screens job applicants is still a recruitment system.

A readiness checklist

The following are WCRC suggestions, not legal advice. Firms should take advice for their own circumstances.

1. Inventory AI use touching the EU. List every AI system and agent whose output reaches people or businesses in the EU, including vendor tools.
2. Classify each use. Is it prohibited, high-risk under Annex III or Annex I, subject to transparency duties, or minimal risk? Record the reasoning.
3. Fix transparency now. Article 50 duties already apply. Check that customers know when they are dealing with AI, and that synthetic content will be marked by 2 December 2026.
4. Ask your model providers. Ask whether they received a Commission information request, how they are responding and what would happen to your service if a model were restricted in the EU.
5. Build an evidence file. Keep documentation on model choice, testing, human oversight and monitoring ready to produce at short notice.
6. Tighten agent controls. Review permissions, credential scope, logging and anomaly detection for agents; monitoring designed for human users may miss machine-speed activity.
7. Use the extra time for high-risk systems. The December 2027 date is a reprieve, not an exemption. Start conformity work now.
8. Document AI literacy. The Act expects providers and deployers to support AI literacy among staff who operate AI; keep records of training.

What it means for leaders

• AI Act enforcement is live; a poor answer to a regulator's request can itself be fined.
• Being headquartered outside the EU does not remove exposure if your AI's output is used in the EU.
• Your risk includes your suppliers: ask model providers about their regulatory position and your contingency.
• Transparency duties apply now; high-risk obligations follow in December 2027 and August 2028.
• Treat agents as AI systems under the Act, classified by what they do, not how they are built.

Quick answers

Q: Has the EU started enforcing the AI Act? A: Yes. In late August 2026 the Commission's AI Office sent formal information requests to more than 30 general-purpose AI model providers, its first use of enforcement powers that took effect in August 2026.

Q: What are the maximum fines under the EU AI Act? A: Up to €35m or 7% of worldwide turnover for prohibited practices; up to €15m or 3% for general-purpose AI model providers and for most other operator obligations; up to €7.5m or 1% for misleading information.

Q: Does the EU AI Act apply to companies outside the EU? A: Yes. It covers providers placing AI on the EU market wherever they are based, and non-EU providers and deployers whose AI output is used in the EU.