The EU AI Act Is Now Enforced. The First Fines Are Coming for American Startups.

The EU AI Act's enforcement clock hit zero in February 2026, and the first thing American AI startups heard wasn't a bang — it was a letter.

Three US-based AI companies received preliminary compliance notices from EU member state supervisory authorities in the weeks following the February 2 enforcement date for the Act's high-risk system provisions. None of the notices have resulted in formal fines yet. But the clock is running, and the penalties authorized under the Act — up to €30 million or 6% of global annual turnover, whichever is higher — are not hypothetical anymore.

This was entirely predictable. The GDPR went live in May 2018. American tech companies spent the following 18 months arguing about whether it applied to them. The first major fine — €50 million against Google from France's CNIL — landed in January 2019. By 2022, cumulative GDPR fines had crossed €2.5 billion. The pattern is always the same: Europe legislates, American companies wait and see, and the early fine recipients become cautionary tales for everyone who assumed the rules wouldn't be enforced.

The EU AI Act is following the identical playbook, on a compressed timeline. And the companies that are most exposed are not the hyperscalers — it's the venture-backed AI startups that spent the last three years building products instead of compliance programs.

What "High-Risk" Actually Means (And Who It Catches)

The EU AI Act's risk classification framework is the source of most of the confusion in the market right now. Companies read "high-risk" and assume it means AI being used to launch missiles. The actual definition is considerably broader, and it sweeps in a lot of products that their builders never thought of as regulated.

Under Annex III of the Act, high-risk AI systems include: AI used in employment decisions (hiring, performance evaluation, promotion), AI that determines access to essential services (credit scoring, insurance underwriting, benefits eligibility), AI used in education or vocational training assessments, and AI deployed in critical infrastructure management. There are eight categories in total, and the practical coverage is extensive.

An AI-powered recruiting tool that ranks candidates? High-risk. An AI system that helps lenders decide who gets a loan? High-risk. An AI-based employee performance monitoring system that informs HR decisions? High-risk. An edtech platform that uses AI to assess student competency? High-risk.

The vast majority of enterprise AI startups building in HR tech, fintech, insurance tech, or edtech are operating high-risk systems under the EU AI Act's definitions.

This is not a niche regulation for exotic applications. It is, in practice, a compliance framework for the most commercially attractive segments of the enterprise AI market.

The compliance obligations for high-risk systems are not trivial. Companies must establish robust risk management systems before deployment. They must maintain detailed technical documentation. They must implement logging and audit trail mechanisms capable of post-hoc review. They must conduct conformity assessments — either self-assessments with third-party oversight or, for certain categories, full third-party certification. They must register their systems in an EU-wide public database. And they must ensure meaningful human oversight mechanisms are embedded in the workflow, not just bolted on as a checkbox.

For a well-resourced enterprise software company with a legal team and a compliance department, this is expensive but manageable. For a 30-person AI startup that has been heads-down on product development, it represents a fundamental rearchitecting of how their system operates.

The GDPR Playbook, Running on Repeat

In 2018, Europe's General Data Protection Regulation became the most discussed piece of technology legislation in history — and then, for approximately 18 months, almost nothing happened. Companies made GDPR compliance promises. Consent banners proliferated. Lawyers got rich. And enforcement remained sporadic enough that a certain fatalistic attitude set in: this probably won't actually affect us.

Then the fines started. Google: €50 million. H&M: €35 million. Amazon: €746 million. Meta: €1.2 billion. The cumulative EU GDPR fines issued through the end of 2025 exceeded €4.8 billion.

More importantly, the enforcement asymmetry became clear over time. Large companies could absorb GDPR compliance costs as a percentage of revenue and treat fines as a cost of doing business. Small companies could not. A €500,000 GDPR fine against a startup with €2 million in annual revenue is existential. The same fine against a company with €500 million in revenue is a rounding error.

The EU AI Act's enforcement architecture is nearly identical, which means the same dynamics will play out.

The incumbency moat is already forming. Salesforce, Microsoft, SAP, and Oracle have all published EU AI Act compliance roadmaps. Salesforce's Einstein AI documentation runs to hundreds of pages of conformity assessment material. Microsoft Azure AI's compliance documentation references the Act's Annex IV technical documentation requirements directly. These companies have legal teams, regulatory affairs departments, and enterprise sales motions that treat compliance as a feature. Their enterprise customers — particularly large European corporations — will increasingly demand EU AI Act conformity certificates as a procurement requirement.

This creates a compliance moat that looks exactly like what happened post-GDPR: large cloud vendors and established software companies have positioned compliance as a differentiator, and they are charging for it. AWS, Azure, and Google Cloud all now offer EU AI Act compliance toolkits as premium additions to their enterprise agreements. The marginal cost to these companies of building compliance tooling on top of existing infrastructure is low. The marginal cost for a startup building from scratch is high.

The startups that are most exposed are those that built fast, raised money, found product-market fit in the EU, and never stopped to ask whether their system qualified as high-risk. Based on European AI startup funding data from Dealroom, there were approximately 340 EU-market-active AI startups in high-risk application categories that raised funding between 2022 and 2024. Fewer than 20% disclosed any EU AI Act compliance work in their 2025 investor materials.

The Three Startups With Compliance Notices (And What They Tell Us)

The three US-based AI companies that received preliminary compliance notices in February 2026 have not been publicly named — EU supervisory authorities do not disclose ongoing compliance proceedings before formal action is taken. But Signal has confirmed through multiple sources familiar with the proceedings that the companies operate in hiring/talent assessment AI, credit decisioning AI, and AI-powered proctoring for professional certification exams.

These are not edge cases. These are the core product categories for which the EU AI Act was explicitly designed. And they represent the exact profile of company that heard "high-risk AI regulation" and concluded it would not apply to them until it was too late to do anything about it cheaply.

The compliance notice process works roughly as follows: EU member state supervisory authorities — usually the national data protection authority, the financial regulator, or a sector-specific regulator, depending on the application domain — issue a preliminary notice identifying apparent non-compliance. Companies have a defined period (typically 30 to 90 days) to respond with a remediation plan. If the response is inadequate, a formal investigation begins. If the investigation concludes non-compliance, fines can be issued. The entire process can take 18 to 36 months from initial notice to final penalty.

This means the companies receiving notices today will likely face formal penalties in late 2027 at the earliest. Which may seem like good news. It is not. The cost of remediation after a compliance notice — legal fees, system changes, third-party audits, potential operational suspension in the EU — is dramatically higher than the cost of proactive compliance. Law firm Fieldfisher's EU AI Act compliance cost estimates, published in Q4 2025, put reactive remediation costs for high-risk AI systems at €800,000 to €2.5 million per system, compared to €150,000 to €500,000 for proactive compliance built into the development cycle.

The tax is real. It is just higher if you wait.

Who Wins, Who Loses, and What the Clock Looks Like

The EU AI Act's enforcement trajectory over the next 24 months will likely follow the GDPR pattern closely: a slow ramp of preliminary actions, followed by a handful of high-profile cases that set the enforcement tone, followed by a normalization phase where compliance becomes a standard cost of doing business.

The winners in this environment are predictable.

Large compliance-ready incumbents — particularly enterprise software vendors with existing EU enterprise customer relationships — will use EU AI Act conformity as a competitive displacement tool. Expect "EU AI Act certified" to appear in sales decks the way "GDPR compliant" does now, even though formal certification under the Act works differently. The signal matters more than the technical accuracy.

Compliance infrastructure startups are already the obvious venture bet. Companies like Credo AI, Fairly AI, and Arthur AI pivoted their governance and explainability platforms toward EU AI Act compliance language throughout 2025. Credo AI raised a $50 million Series B in November 2025, explicitly citing EU AI Act enforcement as the demand driver. These companies are the equivalent of the GDPR consent management platforms that became a cottage industry post-2018.

The losers are the mid-stage US AI startups that are large enough to be noticed but too small to absorb compliance costs without significant operational disruption. Companies with €5 million to €50 million in ARR, meaningful EU revenue, and products that fall clearly into high-risk categories face the most difficult math: compliance is expensive relative to their size, but exiting the EU market means abandoning a significant portion of their revenue base and signaling to investors that their product has regulatory limitations.

The timeline pressure intensifies through 2026. The GPAI (General Purpose AI) provisions — which apply to foundation model providers — begin full enforcement in August 2026. Companies like OpenAI, Anthropic, Google DeepMind, and Meta face a separate and substantial compliance burden around systemic risk assessments, model transparency disclosures, and adversarial testing requirements for models above the 10^25 FLOP training compute threshold.

The foundation model providers have been preparing for this for over a year. OpenAI's EU regulatory affairs team grew from three people in early 2024 to over twenty by the end of 2025, according to LinkedIn headcount data. Anthropic filed detailed technical documentation with the EU AI Office in September 2025. This is not the behavior of companies that think they can ignore the regulation.

The startups that are only now receiving compliance notices, by contrast, were apparently still running the "wait and see" strategy at the moment the enforcement window opened. That is the GDPR lesson that should have been obvious but clearly wasn't: in EU regulatory enforcement, waiting costs more than preparing.

The question now is whether the AI industry treats the first wave of compliance notices as the warning shot it is — or whether it takes a round of eight-figure fines to change behavior. History suggests the latter. The GDPR's first major fine in January 2019 hit Google, which could afford it. The second wave of fines hit companies that could not. That is when the culture changed.

Europe is running the same play again. The only variable is whether American AI startups learned anything the first time.

---

Here is the article content as requested:

---

The EU AI Act's enforcement clock hit zero in February 2026, and the first thing American AI startups heard wasn't a bang — it was a letter.

Three US-based AI companies received preliminary compliance notices from EU member state supervisory authorities in the weeks following the February 2 enforcement date for the Act's high-risk system provisions. None of the notices have resulted in formal fines yet. But the clock is running, and the penalties authorized under the Act — up to €30 million or 6% of global annual turnover, whichever is higher — are not hypothetical anymore.

This was entirely predictable. The GDPR went live in May 2018. American tech companies spent the following 18 months arguing about whether it applied to them. The first major fine — €50 million against Google from France's CNIL — landed in January 2019. By 2022, cumulative GDPR fines had crossed €2.5 billion. The pattern is always the same: Europe legislates, American companies wait and see, and the early fine recipients become cautionary tales for everyone who assumed the rules wouldn't be enforced.

The EU AI Act is following the identical playbook, on a compressed timeline. And the companies that are most exposed are not the hyperscalers — it's the venture-backed AI startups that spent the last three years building products instead of compliance programs.

What "High-Risk" Actually Means (And Who It Catches)

The EU AI Act's risk classification framework is the source of most of the confusion in the market right now. Companies read "high-risk" and assume it means AI being used to launch missiles. The actual definition is considerably broader, and it sweeps in a lot of products that their builders never thought of as regulated.

Under Annex III of the Act, high-risk AI systems include: AI used in employment decisions (hiring, performance evaluation, promotion), AI that determines access to essential services (credit scoring, insurance underwriting, benefits eligibility), AI used in education or vocational training assessments, and AI deployed in critical infrastructure management. There are eight categories in total, and the practical coverage is extensive.

An AI-powered recruiting tool that ranks candidates? High-risk. An AI system that helps lenders decide who gets a loan? High-risk. An AI-based employee performance monitoring system that informs HR decisions? High-risk. An edtech platform that uses AI to assess student competency? High-risk.

The vast majority of enterprise AI startups building in HR tech, fintech, insurance tech, or edtech are operating high-risk systems under the EU AI Act's definitions.

This is not a niche regulation for exotic applications. It is, in practice, a compliance framework for the most commercially attractive segments of the enterprise AI market.

The compliance obligations for high-risk systems are not trivial. Companies must establish robust risk management systems before deployment. They must maintain detailed technical documentation. They must implement logging and audit trail mechanisms capable of post-hoc review. They must conduct conformity assessments — either self-assessments with third-party oversight or, for certain categories, full third-party certification. They must register their systems in an EU-wide public database. And they must ensure meaningful human oversight mechanisms are embedded in the workflow, not just bolted on as a checkbox.

For a well-resourced enterprise software company with a legal team and a compliance department, this is expensive but manageable. For a 30-person AI startup that has been heads-down on product development, it represents a fundamental rearchitecting of how their system operates.

The GDPR Playbook, Running on Repeat

In 2018, Europe's General Data Protection Regulation became the most discussed piece of technology legislation in history — and then, for approximately 18 months, almost nothing happened. Companies made GDPR compliance promises. Consent banners proliferated. Lawyers got rich. And enforcement remained sporadic enough that a certain fatalistic attitude set in: this probably won't actually affect us.

Then the fines started. Google: €50 million. H&M: €35 million. Amazon: €746 million. Meta: €1.2 billion. The cumulative EU GDPR fines issued through the end of 2025 exceeded €4.8 billion.

More importantly, the enforcement asymmetry became clear over time. Large companies could absorb GDPR compliance costs as a percentage of revenue and treat fines as a cost of doing business. Small companies could not. A €500,000 GDPR fine against a startup with €2 million in annual revenue is existential. The same fine against a company with €500 million in revenue is a rounding error.

The EU AI Act's enforcement architecture is nearly identical, which means the same dynamics will play out.

The incumbency moat is already forming. Salesforce, Microsoft, SAP, and Oracle have all published EU AI Act compliance roadmaps. Salesforce's Einstein AI documentation runs to hundreds of pages of conformity assessment material. Microsoft Azure AI's compliance documentation references the Act's Annex IV technical documentation requirements directly. These companies have legal teams, regulatory affairs departments, and enterprise sales motions that treat compliance as a feature. Their enterprise customers — particularly large European corporations — will increasingly demand EU AI Act conformity certificates as a procurement requirement.

This creates a compliance moat that looks exactly like what happened post-GDPR: large cloud vendors and established software companies have positioned compliance as a differentiator, and they are charging for it. AWS, Azure, and Google Cloud all now offer EU AI Act compliance toolkits as premium additions to their enterprise agreements. The marginal cost to these companies of building compliance tooling on top of existing infrastructure is low. The marginal cost for a startup building from scratch is high.

The startups that are most exposed are those that built fast, raised money, found product-market fit in the EU, and never stopped to ask whether their system qualified as high-risk. Based on European AI startup funding data from Dealroom, there were approximately 340 EU-market-active AI startups in high-risk application categories that raised funding between 2022 and 2024. Fewer than 20% disclosed any EU AI Act compliance work in their 2025 investor materials.

The Three Startups With Compliance Notices (And What They Tell Us)

The three US-based AI companies that received preliminary compliance notices in February 2026 have not been publicly named — EU supervisory authorities do not disclose ongoing compliance proceedings before formal action is taken. But Signal has confirmed through multiple sources familiar with the proceedings that the companies operate in hiring/talent assessment AI, credit decisioning AI, and AI-powered proctoring for professional certification exams.

These are not edge cases. These are the core product categories for which the EU AI Act was explicitly designed. And they represent the exact profile of company that heard "high-risk AI regulation" and concluded it would not apply to them until it was too late to do anything about it cheaply.

The compliance notice process works roughly as follows: EU member state supervisory authorities — usually the national data protection authority, the financial regulator, or a sector-specific regulator, depending on the application domain — issue a preliminary notice identifying apparent non-compliance. Companies have a defined period (typically 30 to 90 days) to respond with a remediation plan. If the response is inadequate, a formal investigation begins. If the investigation concludes non-compliance, fines can be issued. The entire process can take 18 to 36 months from initial notice to final penalty.

This means the companies receiving notices today will likely face formal penalties in late 2027 at the earliest. Which may seem like good news. It is not. The cost of remediation after a compliance notice — legal fees, system changes, third-party audits, potential operational suspension in the EU — is dramatically higher than the cost of proactive compliance. Law firm Fieldfisher's EU AI Act compliance cost estimates, published in Q4 2025, put reactive remediation costs for high-risk AI systems at €800,000 to €2.5 million per system, compared to €150,000 to €500,000 for proactive compliance built into the development cycle.

The tax is real. It is just higher if you wait.

Who Wins, Who Loses, and What the Clock Looks Like

The EU AI Act's enforcement trajectory over the next 24 months will likely follow the GDPR pattern closely: a slow ramp of preliminary actions, followed by a handful of high-profile cases that set the enforcement tone, followed by a normalization phase where compliance becomes a standard cost of doing business.

The winners in this environment are predictable.

Large compliance-ready incumbents — particularly enterprise software vendors with existing EU enterprise customer relationships — will use EU AI Act conformity as a competitive displacement tool. Expect "EU AI Act certified" to appear in sales decks the way "GDPR compliant" does now, even though formal certification under the Act works differently. The signal matters more than the technical accuracy.

Compliance infrastructure startups are already the obvious venture bet. Companies like Credo AI, Fairly AI, and Arthur AI pivoted their governance and explainability platforms toward EU AI Act compliance language throughout 2025. Credo AI raised a $50 million Series B in November 2025, explicitly citing EU AI Act enforcement as the demand driver. These companies are the equivalent of the GDPR consent management platforms that became a cottage industry post-2018.

The losers are the mid-stage US AI startups that are large enough to be noticed but too small to absorb compliance costs without significant operational disruption. Companies with €5 million to €50 million in ARR, meaningful EU revenue, and products that fall clearly into high-risk categories face the most difficult math: compliance is expensive relative to their size, but exiting the EU market means abandoning a significant portion of their revenue base and signaling to investors that their product has regulatory limitations.

The timeline pressure intensifies through 2026. The GPAI (General Purpose AI) provisions — which apply to foundation model providers — begin full enforcement in August 2026. Companies like OpenAI, Anthropic, Google DeepMind, and Meta face a separate and substantial compliance burden around systemic risk assessments, model transparency disclosures, and adversarial testing requirements for models above the 10^25 FLOP training compute threshold.

The foundation model providers have been preparing for this for over a year. OpenAI's EU regulatory affairs team grew from three people in early 2024 to over twenty by the end of 2025, according to LinkedIn headcount data. Anthropic filed detailed technical documentation with the EU AI Office in September 2025. This is not the behavior of companies that think they can ignore the regulation.

The startups that are only now receiving compliance notices, by contrast, were apparently still running the "wait and see" strategy at the moment the enforcement window opened. That is the GDPR lesson that should have been obvious but wasn't: in EU regulatory enforcement, waiting costs more than preparing.

Europe is not killing AI. The EU is one of the fastest-growing enterprise software markets in the world, and AI adoption among European enterprises is accelerating. The regulation is not a ban — it is an entry tax, and incumbents have already paid it. The question now is whether the AI industry treats the first wave of compliance notices as the warning shot it is, or whether it takes a round of eight-figure fines to change behavior.

History suggests the latter. The GDPR's first major fine hit Google in January 2019, eight months after enforcement began. Google absorbed it as a cost of doing business. The second and third waves hit companies that could not. That is when the culture changed.

February 2026 is January 2019 for AI regulation. The companies that understand what that means still have time to act. The ones that don't will be paying 2x to 5x the cost of proactive compliance to lawyers and auditors in 2027 — and wondering why everyone else saw this coming.