EU AI Act Enforcement Begins for High-Risk Systems: What Businesses Must Know

What Happened

The European Union's AI Act has now entered a significant enforcement phase covering high-risk AI applications. This includes AI systems used in hiring and recruitment, credit scoring, educational assessment, and critical infrastructure. Businesses operating in the EU or selling to EU customers must now demonstrate compliance or risk fines of up to 30 million euros or 6 percent of global annual turnover.

What Counts as High-Risk

The rules are not just for large technology companies. If your business uses AI tools to screen job applicants, assess customer creditworthiness, or make decisions that significantly affect people's lives, you likely fall under these requirements. This includes third-party software you have integrated into your operations.

Key Obligations

Businesses using high-risk AI must maintain documentation explaining how the system works, conduct risk assessments, ensure human oversight is in place, and register certain systems with EU authorities. You also need to inform people when consequential decisions about them have been made using AI.

Why This Matters for UK Businesses

While the UK is no longer subject to EU law directly, UK businesses that serve EU customers or operate in EU markets must comply. The UK government is watching these developments closely and is expected to introduce its own framework in the coming months.

What To Do

Start by auditing which AI tools your business currently uses and what decisions they inform. Speak to a legal adviser familiar with the AI Act if you operate in or sell to EU markets. Many compliance software providers have released tools specifically designed to help businesses document and manage AI use. Acting now is far less costly than responding to an investigation later.