AI Policy

EU Regulators Can Now Fine AI Firms 7% of Revenue

EU AI Act enforcement powers took effect on 2 August 2026. Two days later, France's CNIL sent Article 11 documentation requests to 14 banks and denied every extension request.

AI PolicyBy Servola Tech Desk2026-08-074 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

EU Regulators Can Now Fine AI Firms 7% of Revenue

Key takeaways

On 2 August 2026, EU AI Act enforcement powers over general-purpose AI models and Article 50 transparency rules took legal effect, letting the AI Office and 24 national competent authorities request technical documentation, run evaluations, and issue fines of up to EUR 15 million or 3% of global turnover directly, so any business relying on 'we are working on compliance' as an answer no longer has that option.
Two days later, on 4 August, France's CNIL sent formal Article 11 technical-documentation requests to 14 financial institutions running AI credit-scoring systems, and denied all three extension requests it received, citing the two years companies have had to prepare since the Act passed in 2024.
Fines scale by violation type: up to EUR 15 million or 3% of global annual turnover for Article 50 transparency breaches, and up to EUR 35 million or 7% for prohibited AI practices, whichever amount is higher in each case.
Corrective-action orders now carry a hard clock: a national authority that finds a system non-compliant can give a company as little as 15 working days to fix it, withdraw it, or recall it.
European Commission Executive Vice-President Henna Virkkunen framed the shift as protective rather than punitive, saying the rules give 'innovators legal certainty while protecting the public interest,' but warned that the most advanced models 'create risks on an entirely new scale,' a signal that scrutiny will concentrate on frontier systems first.

What Changed in Brussels on 2 August

On 2 August 2026, a year of voluntary codes of practice and compliance dialogues in Brussels turned into a fine-issuing regime. Article 50 transparency obligations, requiring chatbots to disclose their automated status, deepfakes to carry labels, and machine-generated content to carry machine-readable marks, entered into legal force alongside enforcement powers over general-purpose AI models. The European Commission's AI Office and 24 national competent authorities across the member states can now request technical documentation, run their own evaluations, demand corrective action, and issue fines directly, rather than negotiating compliance informally.

European Commission Executive Vice-President Henna Virkkunen framed the shift as protective, not adversarial, saying the rules give "innovators legal certainty while protecting the public interest" and calling the moment "an important step towards AI that people and businesses can understand and trust." She also called artificial intelligence "a transformative technology," while warning that the most advanced models "create risks on an entirely new scale," a distinction that signals where enforcement attention is likely to concentrate first.

CNIL's First Move: 14 Banks, Zero Extensions Granted

The first live test of the new regime came within 48 hours. On 4 August 2026, France's data protection authority, the CNIL, issued formal Article 11 technical-documentation requests to 14 financial institutions running AI-based credit-scoring algorithms, demanding the Annex IV documentation that high-risk AI systems are required to maintain. Three of the fourteen institutions asked for more time to respond.

CNIL denied all three extension requests, pointing to the two years companies have had to prepare since the AI Act passed in 2024. That is the detail worth sitting with: a regulator's first move under live enforcement powers was not a warning letter or an informal inquiry, it was a formal documentation demand with a hard no on extra time. Any EU business in a high-risk category, lending, hiring, or another Annex III use case, now has a concrete precedent for what a first-contact audit actually looks like, not a hypothetical one.

How the Fines Actually Work

The penalty structure is tiered by the type of violation, not a single flat number. Breaches of the Article 50 transparency obligations, the deepfake-labeling and AI-disclosure rules, carry fines of up to EUR 15 million or 3% of a company's global annual turnover, whichever figure is higher. Prohibited AI practices, the small set of uses the Act bans outright, carry a steeper ceiling: up to EUR 35 million or 7% of global turnover.

The percentage-of-turnover structure matters more than the euro figures for any sizeable company, since it scales with revenue rather than capping exposure at a fixed number. Corrective-action orders add a second layer of pressure: once a national authority finds a system non-compliant, it can set a compliance window as short as 15 working days to fix, withdraw, or recall it, which is little time for a company that has not already prepared its technical documentation in advance.

The Question Every EU Business Now Has to Answer

For a year, the operative question for any EU company using or deploying AI has been whether it is broadly AI Act compliant, answered in good faith through internal reviews and voluntary codes. As of this week, that question has changed. The operative question now is whether a company can produce Annex IV technical documentation on demand, inside the regulator's own clock, because CNIL has just shown it will not extend that clock on request.

The CNIL credit-scoring sweep is a useful preview specifically for companies in lending, hiring, and other high-risk Annex III categories, since it is the first concrete example of what a high-risk documentation audit looks like in practice rather than in the text of the regulation. Any business in those categories that has not already assembled its technical file should treat this month, not some future compliance deadline, as the point at which the paperwork needs to already exist.

Frequently asked questions

What actually changed on 2 August 2026, in practical terms?

Two things became legally enforceable rather than voluntary: Article 50 transparency obligations, covering AI-disclosure and deepfake-labeling rules, and the AI Office's direct enforcement powers over general-purpose AI models. The AI Office and 24 national competent authorities can now request technical documentation, run evaluations, order corrective action, and issue fines, instead of relying on the compliance dialogues and voluntary codes of practice that characterized the year before.

Why does the CNIL action against 14 banks matter beyond the financial sector?

Because it is the first real-world example of a high-risk-system documentation audit under live enforcement powers, not because credit scoring is uniquely exposed. CNIL requested Annex IV technical documentation and denied every extension request it received, which sets a precedent any company in another high-risk Annex III category, hiring tools or critical infrastructure among them, should expect to face on the same terms.

How large are the fines EU regulators can now issue?

Up to EUR 15 million or 3% of a company's global annual turnover, whichever is higher, for Article 50 transparency violations, and up to EUR 35 million or 7% of global turnover for prohibited AI practices. Both figures scale with company size rather than being fixed penalties, and sit alongside a corrective-action power that can give a company as little as 15 working days to fix a flagged system.

A year of compliance dialogues just became a fine-issuing regime with a turnover-percentage ceiling, and CNIL demonstrated within 48 hours that it will use the clock, not just the fine, as the enforcement tool that matters. The operator question for any EU business using AI is no longer whether it is compliant in general terms. It is whether the technical documentation already exists, on file, ready to produce inside 15 working days, because the first regulator to test the new powers just proved it will not wait for a company to write that documentation after being asked.

EU AI ActCNILAI Officeenforcementcredit scoringGPAI

The Only Binding AI Check Left Is European

OpenAI has staffed recursive self-improvement research and publishes dedicated roles for it. The US office its own blueprint nominated to monitor that risk has had no permanent director since 20 July. From 2 August the EU AI Office is the oversight that can actually reach your vendor.

5 min read

AI Policy

Brussels Was Briefed Before the Blog Post

OpenAI and Anthropic told the European Commission about their AI incidents before the public heard. No rule required it, and none puts you on the list.

7 min read

Decisions

The Codename Worked. The Trading Controls Did Not

An indictment unsealed on 24 July says two Volkswagen engineers traded on a joint venture known internally as Project Climb. The control that failed is a common one.