Implementation Gaps and 'Legal Maze' Plague EU AI Rules
Enterprises are reportedly facing a "legal maze" in the practical implementation of EU AI regulations, including the AI Act and Digital Services Act. A lack of clear technical standards and ambiguous risk thresholds is creating significant compliance challenges, especially in high-risk areas like credit scoring. Concurrently, the European Data Protection Board has issued a new opinion reinforcing the need for robust documentation and a lawful basis for all AI data processing.
- The European Commission has established a dedicated AI Office, which began operations in June 2024, to oversee the implementation and enforcement of the AI Act. This office is responsible for developing guidelines, codes of practice, and evaluation tools for general-purpose AI models and will support the various governance bodies across the Member States. The Commission has identified 130 specific responsibilities, including drafting 39 pieces of secondary legislation to create a comprehensive AI governance system by August 2026. - A critical element for compliance is the development of "harmonised standards," which translate the Act's legal requirements into detailed technical specifications. Organizations conforming to these standards will have a "presumption of conformity" with the AI Act's requirements. The European standardisation organizations, CEN and CENELEC, are behind schedule in drafting these standards, which ideally should have been available by October 2025 to give providers adequate time to prepare for the October 2026 enforcement date for the first category of high-risk systems. - For high-risk AI systems, such as those used in critical infrastructure, education, or recruitment, the Act mandates a strict set of obligations before they can be marketed. These include establishing robust risk and quality management systems, ensuring high-quality data governance to minimize discriminatory outcomes, maintaining detailed technical documentation, and enabling appropriate human oversight. - The AI Act introduces specific challenges for the development and deployment of agentic AI systems, which can act and adapt autonomously. Because these systems can evolve after deployment and interact with third-party tools, static, upfront risk assessments are insufficient. This necessitates a shift towards dynamic risk management and governance that monitors emergent behaviors and ensures human oversight can guide behavior, not just approve outputs. - Non-compliance with the AI Act carries significant financial penalties, with fines reaching up to €35 million or 7% of a company's total worldwide annual turnover for the most serious violations, such as using prohibited AI practices. Other infringements, like failing to meet obligations for high-risk systems, can result in fines of up to €15 million or 3% of annual turnover. - The legislation includes provisions specifically designed to support small and medium-sized enterprises (SMEs), including startups. These measures aim to reduce the compliance burden through priority access to regulatory sandboxes, proportionate conformity assessment fees, and simplified technical documentation requirements. - The full application of the AI Act is staggered over time. Rules for prohibited AI practices began to apply in February 2025, while obligations for general-purpose AI models came into effect in August 2025. The comprehensive rules for high-risk systems are set to be fully applicable on August 2, 2026. - The definition of a "high-risk" AI system is detailed in Annex III of the Act and includes categories like biometric identification, management of critical infrastructure, employment and worker management, and access to essential private and public services like credit scoring. Any AI system falling into these categories is presumptively considered high-risk unless it meets narrow exemption criteria.
