TL;DR: The EU AI Act enforcement bodies are being stood up across member states right now. Not next year. Right now. I've been tracking which countries are moving fastest and what they're actually checking. The gap between what most companies think compliance requires and what it actually requires is wider than most people realize.
People keep saying "the EU AI Act is coming." It's already here. The first provisions took effect in February 2025. The bulk of the rules kick in through 2026 and 2027. Member states are setting up enforcement bodies right now.
Germany's regulator has already started hiring. The Irish DPC — which will enforce it here in Dublin — has been staffing up for months. Companies that think they have years are wrong.
Based on how similar regulations (GDPR, DSA) rolled out, here's the pattern:
1. They pick a sector — maybe high-risk AI applications in finance or healthcare — and ask companies to demonstrate compliance. "Show us your risk assessments. Show us your documentation."
2. Do you have an inventory of AI systems? Have you classified them by risk? Is there any documentation at all? Most companies fail at step one.
3. Not "your model caused harm" but "you couldn't produce a risk assessment when asked." The procedural fines are easier to prove and will come first.
A binder. Not a metaphorical binder — a real one. Or a shared drive with these specific documents:
- A list of every AI tool in your company. What it does. What data it uses. Who owns it.
- High, limited, minimal. With a brief justification for each. The Act has specific categories — map your systems to them.
- This is the meat. What could go wrong? How likely is it? What mitigations are in place? The assessment doesn't need to be a novel. It needs to be honest and specific.
- How are you checking that the system stays compliant over time? Monthly reviews? Automated alerts? Write it down.
Compliance is easier than you think if you start now. It's not about hiring a law firm. It's about having the discipline to write down what you're doing and check it periodically. The companies that are going to get fined are the ones who ignored it because they thought they had time.
*Not sure where you stand? Take the free [EU AI Act Readiness Scan](https://ataraxium.ai/eu-ai-act-scan.html) — 2 minutes.*