Abstract:
One year after the EU AI Act entered into force, the first signs of its practical impact are becoming visible. This report draws on enforcement data, regulatory guidance, and interviews with national supervisory authorities across twelve Member States to assess how the Act is being applied, where it is diverging in practice, and what patterns are emerging for organisations seeking to comply.
We find that enforcement remains uneven, that interpretive divergence between Member States is more pronounced than anticipated, and that compliance practice is consolidating faster in some sectors — notably financial services and healthcare — than in others.
Key findings
- Enforcement is uneven. Only four Member States had issued formal sanctions under the Act by the end of its first year, with the majority of supervisory activit y concentrated in guidance and informal engagement.
- Interpretive divergence is significant. National authorities differ meaningfully in how they classify high-risk systems, particularly in employment and public services.
- Compliance is consolidating sectorally, not horizontally. Financial services and healthcare show mature compliance practices; public administration lags behind.
- The GDPR remains the reference point. Organisations continue to treat the AI Act as an extension of data protection compliance, with implications for governance structures.
“The first year of the AI Act has been defined less by enforcement than by interpretation. What regulators choose to clarify in year two will shape the next decade of AI governance in Europe.”
Methodology
One year ago, the EU AI Act entered into force as the world’s first comprehensive horizontal regulation of artificial intelligence. Its stated ambition was to ensure that AI systems deployed in the European Union are safe, respect fundamental rights, and support innovation within a clear legal framework.
Twelve months on, the picture is more complex than either the Act’s proponents or its critics anticipated. Enforcement has been slower than expected, but interpretive activity has been unusually rich. Compliance practice is emerging, but unevenly. And the relationship between the Act and adjacent bodies of law — the GDPR above all, but also sectoral regulation — is still being worked out in practice.
This report examines how the Act has fared in its first year of application.
This assessment draws on three sources: a review of published guidance and enforcement actions from national supervisory authorities across twelve Member States; semi-structured interviews with regulators, compliance officers, and legal practitioners conducted between October 2025 and February 2026; and an analysis of regulatory filings in four sectors.