No, the AI Act is being enforced. We saw it with our own eyes this month

It is a logical thought. The AI Act is an enormous, complex law spread across hundreds of pages, and the first years after publication were mostly about preparation: who has to do what, and when does which part take effect. There were no big fines in the news, no companies publicly called to order. So many business owners drew a logical but premature conclusion: this is a law on paper, enforcement will come later, or maybe never.

We heard that reasoning from almost every SMB we spoke to this year. Not out of indifference, but out of practical consideration. An owner with twenty staff has no legal department tracking the official journal. If no signal arrives that something is urgent, it simply never reaches the top of the pile.

In October that signal did arrive. We saw the first concrete enforcement cases under the AI Act come out, not as a policy announcement but as actual action against specific parties. Almost simultaneously, EN 18286 appeared, the first official standard with which a company can demonstrate that its quality management for AI systems is in order. That is no coincidence. A supervisor that starts enforcing needs a yardstick. That yardstick is now in place.

Separate from the AI Act itself, that same month showed how a vulnerability in widely used PHP software let companies with an up-to-date software inventory respond within hours, while companies without one lost days. Different laws, different subjects, but the same pattern: the time when “we will figure it out later” was a tenable strategy is running out on several fronts at once.

One of our clients, a marketing agency with about fifteen employees, received a questionnaire in October from a larger client that wanted to know which AI tools the agency used internally and on the basis of which documentation. The agency did not have that documentation complete. Not because they were doing anything wrong, but because nobody had expected a customer to ask about it so concretely. They got two weeks to deliver the answer. That is exactly the kind of moment when the myth collapses: not when a supervisor shows up at the door, but when a customer, partner or tender asks a question you do not have the answer to ready.

The agency made it in time, but the owner told us afterwards that those two weeks felt like a sprint that should never have been necessary. All the information existed, spread across emails, a few Slack messages and the memory of three different colleagues. Nobody had ever put it in one place, because nobody had ever asked before. That is exactly the pattern we keep encountering: it rarely goes wrong because a company hides something, it goes wrong because nobody bundled the information before the question came.

You do not need a compliance team to be ready for this. What does help is an up-to-date overview of which AI systems are used in your company, for what, and under whose responsibility. Our AI Inventory module builds that overview automatically and keeps it up to date, so you do not start searching only when someone asks. That overview does not replace legal advice, but it is the foundation on which such advice becomes truly valuable.

What we often see is that companies think such an overview is a big project, something you need to hire an external agency for before you can start. In practice it usually starts with a simple list: which tools does the team use daily, who installed or approved them, and is anything recorded about which data is processed in them. That takes an afternoon, not a month. The step that is often skipped is not creating that overview, but keeping it current. A list that sits unchanged in a folder for six months is, by the next question from a customer or supervisor, just as useful as no list at all.