Enforcement of the EU AI Act - When can it start?

The EU AI Act (Act) entered into force on 2 August 2024, becoming the world's first comprehensive AI regulation (see our Quick Guide to the EU AI Act).

Although the Act entered into force in 2024 and will apply in full from 2 August 2026, it provides for phased application. The provisions on prohibited AI and AI literacy started to apply on 2 February 2025, the provisions on new general-purpose AI (GPAI) models will start to apply from 2 August 2025 and, subject to some exceptions, the remaining provisions on high-risk AI systems (HRAIS) and transparency will start to apply from 2 August 2026.

What is currently less certain is when regulators will be able to enforce these various provisions. It has been reported that regulators will be able to investigate and sanction breaches of the applicable provisions of the Act from 2 August 2025. Indeed, recent guidelines from the European Commission state that rules on governance, enforcement and penalties will all "become applicable on 2 August 2025".

The express provisions of the Act, however, suggest that the position is less straightforward and that the enforcement powers may not be available until a year later, on 2 August 2026.

Governance structure for the Act

The Act contains a complex, multi-tiered framework for enforcement with different regulators taking responsibility for different AI technologies. Subject to some exceptions:

• Provisions relating to AI systems are to be enforced chiefly by market surveillance authorities in Member States (MSAs), which Member States are required to designate by 2 August 2025.

• Provisions relating to GPAI models are to be enforced centrally by the EU AI Office, part of the European Commission, which was established in February 2024.

The provisions in relation to this governance structure are set out in Chapter VII of the Act and will apply from 2 August 2025 (Article 113(a)), before the full application of the Act. Some Member States have already started to designate their MSAs.

Enforcement of the Act

Separate from the establishment of a governance structure under Chapter VII (Governance), Chapters IX (Market Surveillance) and XII (Penalties) of the Act provide for a variety of powers for the AI Office and MSAs to investigate and sanction breaches of the Act.

Article 74 of the Act gives MSAs the power to investigate AI systems (e.g. potentially prohibited AI) pursuant to Regulation (EU) 2019/1020 (the Market Surveillance Regulation or MSR).  Article 99 of the Act requires Member States to lay down rules on penalties of up to 7% of total worldwide annual turnover and other enforcement measures.

Articles 88 to 93 of the Act similarly give the AI Office a range of powers to enforce the provisions relating to GPAI models and Article 101 empowers the AI Office to impose fines of up to 3% of total worldwide annual turnover for infringements of those provisions.

However, these investigatory powers should not apply in full from 2 August 2025, as has been widely reported. Article 113 (Entry into force and application) specifies early application dates for various parts of the AIA. However, it does not specify an early application date for Chapter VII (Market Surveillance). The default date of application therefore applies and the rules on enforcement in Chapter VII (Market Surveillance), including Article 74 for AI systems and Articles 88 to 93 for GPAI models, apply only from 2 August 2026. This suggests that MSAs and the AI Office will not be entitled to investigate (still less sanction) operators until then.

Furthermore, it appears unlikely that regulators could impose penalties until 2 August 2026. Although Chapter XII (Penalties) containing the provisions on penalties generally applies from 2 August 2025, those provisions merely say that Member States must put in place rules on sanctions for AI systems by 2 August 2026 (rather than allowing such sanctions to be imposed from that date). Moreover, Article 113(b) specifically provides that the provisions for fines for GPAI models do not apply until 2 August 2026.

The fact that these investigatory powers apply only from 2 August 2026 is unsurprising given the general position that the Act applies from 2 August 2026. As Recital (179) explains, rules on governance structures (as opposed to enforcement) are applicable from 2 August 2025 to ensure that the infrastructure related to governance (e.g. MSAs) is operational before 2 August 2026, while provisions on Member State penalties apply from 2 August 2025 to ensure that Member States implement rules on penalties before 2 August 2026.

What happens next?

Taking all of this together, suggestions that investigations and penalties under the Act may start from 2 August 2025 are surprising. Not only is there doubt as to whether regulators will be entitled to investigate breaches of the Act at that stage, but also as to whether powers to levy sanctions will be available.

It is hoped that the EU AI Office and other regulators will clarify the timeline for investigation and enforcement under the Act. Until then, uncertainty will remain as to when organisations will start to be the subject of investigations and sanctions under the Act.