The EU AI Act created an entirely new regulatory architecture to govern artificial intelligence across Europe. At the centre of this architecture sits the EU AI Office — the first dedicated AI regulatory body in the world. But the AI Office is only one piece of a multi-layered enforcement structure. This guide explains who does what, who has authority over your organisation, and how enforcement is likely to work in practice.
- The EU AI Office operates within the European Commission and has direct enforcement authority over General Purpose AI (GPAI) model providers — regardless of where they are headquartered.
- National Market Surveillance Authorities (NMSAs) enforce the Act against high-risk AI providers and deployers within their member state’s jurisdiction.
- The AI Board coordinates consistency across member states; the Advisory Forum provides stakeholder input; the Scientific Panel advises on GPAI model assessments.
- Enforcement priority will focus on the highest-risk sectors first — healthcare AI, law enforcement tools, and financial services AI will likely attract early scrutiny.
The EU AI Office: What It Is and What It Does
The EU AI Office was established by the European Commission in February 2024 — before the EU AI Act itself entered into force — signalling the Commission’s intent to have enforcement infrastructure operational well ahead of compliance deadlines. It operates as a distinct body within the Commission’s Directorate-General for Communications Networks, Content and Technology (DG CONNECT).
The EU AI Office’s Core Functions
The Full EU AI Act Governance Architecture
The EU AI Act establishes four distinct governance bodies, each with a different role in the regulatory ecosystem. Understanding which body has authority over your organisation is essential for knowing who you may be accountable to.
How EU AI Act Enforcement Actually Works in Practice
Understanding the formal structure is one thing. Understanding how enforcement will work in practice — especially in the early years — is what matters for compliance planning. Here are the key mechanisms:
Market Surveillance Activities
NMSAs conduct proactive market surveillance — reviewing AI systems in their jurisdiction to assess compliance, even without a specific complaint or incident. The NMS methodology is risk-prioritised: authorities will focus first on AI systems that pose the greatest potential for harm. For the first enforcement cycle (2026–2028), expect heightened scrutiny on healthcare AI, financial services AI, HR recruitment tools, and AI used in public-sector decision-making.
Complaint-Based Investigations
Individuals, organisations, and member state authorities can file complaints with NMSAs or the EU AI Office. Unlike GDPR, there is no individual right to bring a private action — enforcement remains with public authorities. However, civil society organisations and affected individuals can provide detailed complaint documentation that triggers formal investigations. The European Digital Rights (EDRi) network and similar civil society groups have already signalled their intention to bring strategic enforcement complaints against the highest-profile AI deployments.
GPAI Model Evaluations
For GPAI model providers, the EU AI Office has the power to request access to model documentation, conduct independent evaluations, and commission the Scientific Panel to assess systemic risks. The GPAI Code of Practice provides a framework for voluntary cooperation with these evaluations. Organisations that have signed the Code of Practice and follow its procedures benefit from a presumption of compliance — reducing their enforcement exposure significantly.
Incident-Triggered Enforcement
Serious incidents must be reported by providers within 15 days. When an incident is reported — or when a serious incident becomes public through other means — NMSAs and the AI Office have authority to launch immediate investigations. High-profile AI failures in healthcare, financial services, or public safety are likely to become the catalysts for the Act’s first major enforcement actions.
| Enforcement Mechanism | Triggered By | Lead Body | Possible Outcome |
|---|---|---|---|
| Proactive market surveillance | Routine NMSA activity | National NMSA | Fine, corrective measure, or market withdrawal order |
| Complaint investigation | Complaint by individual, NGO, or authority | National NMSA or AI Office | Investigation, fine, corrective action, public disclosure |
| Serious incident investigation | Incident report or public disclosure | National NMSA + AI Office | Urgent investigation, emergency corrective order, market suspension |
| GPAI model evaluation | AI Office initiative or Scientific Panel referral | EU AI Office + Scientific Panel | Corrective measures, model modification requirements, market access restriction |
| Cross-border joint investigation | AI system operating across multiple member states | AI Office coordinating multiple NMSAs | Coordinated enforcement, joint penalties, EU-wide corrective orders |
Enforcement Priorities: What to Expect in 2026 and 2027
National Market Surveillance Authorities cannot audit every AI system simultaneously. Their enforcement activities will be risk-prioritised. Based on the Act’s text, the AI Office’s published priorities, and precedent from GDPR enforcement, here is what organisations should expect:
- Prohibited AI practices still in operation
- Healthcare AI with patient safety implications
- Biometric surveillance systems
- GPAI models with systemic risk designation
- AI used in public-sector decision-making on benefits and services
- AI in financial services (credit, insurance underwriting)
- HR recruitment and employment AI
- AI systems with reported serious incidents
- High-volume consumer-facing AI with transparency violations
- Education AI and proctoring tools
- AI in migration and border management
- Law enforcement predictive tools
- General purpose AI deployed in regulated sectors
Lessons from GDPR: What Early AI Act Enforcement May Look Like
GDPR enforcement history provides useful — if imperfect — guidance for anticipating EU AI Act enforcement patterns. In GDPR’s early years, enforcement focused on the most visible violations by the largest organisations: Google (€50M by CNIL, 2019), British Airways (£20M by ICO, 2020), and WhatsApp (€225M by DPC, 2021). The pattern was high-profile cases that established precedent and signalled regulatory seriousness.
EU AI Act enforcement is likely to follow a similar trajectory — early cases will target well-known AI deployments in sectors with the highest public sensitivity. Healthcare AI failures, biometric surveillance by major retailers, and discriminatory outcomes from widely-used financial AI are all candidates for early enforcement actions.
One key difference from GDPR: the EU AI Office’s direct jurisdiction over GPAI model providers means major AI companies (OpenAI, Google DeepMind, Meta AI, Mistral, and others) face direct Commission-level oversight from day one — not the fragmented national-authority enforcement that allowed some GDPR violations to go unpunished for years.
Practical recommendation: Do not wait for enforcement to begin before investing in compliance. The organisations that will face the highest enforcement risk are those that — like many GDPR violators in 2018 — believed enforcement was unlikely and delayed action. The EU AI Office has made clear that it intends to be an active regulator from August 2026, not a passive one.
For a complete overview of the Act’s requirements and deadlines, see our EU AI Act Summary 2026.
