Governance, enforcement & compliance
Knowing the rules is half the job. This module covers who enforces the AI Act, what non-compliance costs, when each obligation bites — and how to build a practical compliance programme.
Learning objectives
- Describe the EU and national bodies that govern and enforce the Act
- State the three tiers of penalties
- Explain the AI literacy obligation
- Lay out the implementation timeline
- Outline the first steps of an AI Act compliance programme
6.1 Who governs and enforces the Act
At EU level
- AI Office — part of the European Commission. Supervises general-purpose AI models and, since the 2026 amendments, AI systems built on a GPAI model by the same provider and AI integrated into very large online platforms and search engines. Also develops guidance, templates and codes of practice.
- European AI Board — representatives of the member states, coordinating consistent application of the Act.
- Scientific panel — independent experts who support enforcement on GPAI, including by issuing "qualified alerts" about systemic risks.
- Advisory forum — stakeholders from industry, start-ups, SMEs, civil society and academia.
At national level
Each member state designates national competent authorities — at least one market surveillance authority (which investigates and enforces) and one notifying authority (which oversees the conformity assessment bodies). Anyone can lodge a complaint with a market surveillance authority if they believe the Act has been infringed.
6.2 Penalties
| Infringement | Maximum fine |
|---|---|
| Prohibited AI practices (Article 5) | €35 million or 7% of total worldwide annual turnover, whichever is higher |
| Most other obligations (e.g. high-risk requirements, deployer duties, transparency) | €15 million or 3%, whichever is higher |
| Supplying incorrect, incomplete or misleading information to authorities | €7.5 million or 1%, whichever is higher |
| GPAI model providers (fined by the Commission, from 2 August 2026) | €15 million or 3%, whichever is higher |
For SMEs and start-ups — and, since 2026, small mid-caps — the cap is whichever amount is lower. Authorities must consider the nature, gravity and duration of the infringement, cooperation, and any action taken to mitigate harm.
6.3 AI literacy (Article 4)
Since 2 February 2025, providers and deployers have had to address the AI literacy of their staff and others operating AI systems on their behalf. As amended in 2026, the duty is to take measures to support a sufficient level of AI literacy, taking into account people's technical knowledge, experience, education and training, and the context in which the AI is used.
A role-based programme: a short foundation module for everyone (what AI is, its limits, your organisation's AI policy); deeper training for people who build, buy or oversee AI (risk classification, bias, human oversight); and records showing who has been trained on what.
6.4 The implementation timeline
- 1 August 2024
AI Act enters into force.
- 2 February 2025
Prohibitions and AI literacy apply.
- 2 August 2025
GPAI obligations, governance bodies, notified bodies and penalties regime apply.
- 27 July 2026
Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force.
- 2 August 2026
Article 50 transparency duties apply; Commission can fine GPAI providers.
- 2 December 2026
Watermarking deadline for generative AI already on the market; new nudifier and CSAM prohibitions apply.
- 2 August 2027
Legacy GPAI models (on the market before 2 August 2025) must comply; deadline for national AI regulatory sandboxes.
- 2 December 2027
High-risk obligations for Annex III systems apply.
- 2 August 2028
High-risk obligations for Annex I (regulated product) systems apply.
- 2 August 2030
Deadline for high-risk systems used by public authorities that were already on the market.
6.5 Building a compliance programme
The postponed high-risk deadlines are breathing space, not a reason to wait. Conformity assessment, documentation and data governance take time. A practical roadmap:
- Build an AI inventory. List every AI system you develop, buy or use — including AI features inside SaaS tools — with its purpose, owner and data.
- Classify each system and your role. Prohibited? High-risk? Transparency? Minimal? Are you the provider, deployer, importer or distributor?
- Stop anything prohibited. Immediately.
- Run a gap analysis against the obligations for your high-risk and transparency systems.
- Set up governance. Name accountable owners, adopt an AI policy, and create a cross-functional review group (legal, data, product, security, HR).
- Use frameworks and standards. Harmonised European standards are being developed by CEN-CENELEC JTC 21; in the meantime, ISO/IEC 42001 (AI management systems) and the NIST AI Risk Management Framework give useful structure.
- Manage suppliers. Update procurement questionnaires and contracts to get the documentation, instructions for use and incident cooperation you'll need from AI vendors.
- Train your people. Meet the AI literacy duty with role-based training.
- Document, monitor and keep up to date. Keep records, monitor systems in use and track new guidelines, standards and implementing acts.
The AI Act sets a legal floor. Organisations that treat fairness, transparency, accountability and human oversight as design principles — not checklists — tend to find compliance easier and build more trusted products. That's the focus of the next courses in the Academy.
Key takeaways
- The AI Office supervises GPAI; national market surveillance authorities enforce most other rules.
- Fines reach €35m/7% for prohibited practices, €15m/3% for most other breaches and €7.5m/1% for misleading information.
- AI literacy has applied since February 2025.
- Start with an inventory, classify systems and roles, then close the gaps — well before December 2027.