EU AI Act Penalties Take Effect as Member States Launch First Compliance Audits

Three weeks after the February 2, 2026 deadline for prohibited AI practices under the EU AI Act, member states have begun their first formal compliance audits — marking the transition from regulatory preparation to active enforcement of the world's most comprehensive AI legislation.

First Audit Targets

The initial audits focus on the AI Act's outright prohibitions: emotion recognition systems in workplaces and educational institutions, social scoring by public authorities, real-time remote biometric identification in public spaces (with limited law enforcement exceptions), and AI systems that exploit vulnerabilities of specific groups. National AI authorities in France, Germany, and the Netherlands have issued their first formal information requests to companies suspected of operating prohibited systems.

Industry Response

Large technology companies have largely complied with the prohibited practices provisions, having had two years to prepare since the Act's adoption in March 2024. The greater challenge is for mid-market and enterprise software companies that may have embedded AI capabilities — sentiment analysis, behavioral scoring, or biometric processing — into existing products without recognizing that these features now fall under the Act's prohibitions. Industry groups report a surge in demand for AI compliance auditing services, with consulting firms specializing in EU AI Act readiness seeing three to four times their normal client volumes.

Penalty Framework

Violations of the prohibited practices provisions carry the Act's steepest penalties: up to 35 million euros or 7% of global annual turnover, whichever is higher. For context, a 7% revenue penalty applied to a major technology company could exceed $10 billion — a figure designed to make non-compliance economically irrational even for the largest firms. The first penalties are not expected until later in 2026, as regulators work through the audit-to-enforcement pipeline, but the audits themselves signal that the era of voluntary AI governance in Europe has ended.