Europe just switched on the world's first AI enforcement regime.
Most companies still treat AI security like a settings panel, not a legal duty, and that misunderstanding is about to get expensive.
On 2 August 2026 the European Commission's AI Office and national authorities began enforcing the EU AI Act. Regulators can request technical documentation, evaluate models and issue fines that reach 35 million euros or 7 percent of global annual turnover.
Chatbots must now announce themselves as machines. Deepfakes need clear labels and machine readable marks, and more than 180 organisations have already signed the transparency code of practice.
The insight most product teams miss is that cyber security has stopped being an engineering preference and become a documented legal obligation, one the EU's Cybersecurity and AI Action Plan, published in July 2026, is now turning into testing and evaluation duties that run before a model ever ships.
1. Classify every system against the risk ladder. Software for recruitment, credit scoring, biometrics, education and public services sits in the high risk tier. Everything else still has to respect the transparency rules that are already live.
2. Keep a living risk file and an activity log. High risk systems demand technical documentation, event logging and human oversight checkpoints. Record the model version, the data behind it and the decisions it makes, because traceability is the first thing an inspector will request.
That documentation layer is what the Commission's own lifecycle diagram formalises, from design to post market monitoring. As we explained in our piece on how AI is quietly becoming cyber security's greatest ally, the model that defends your network is also the model a regulator will now ask you to explain, so the paperwork and the protection belong together.
3. Gate every release with a security assessment. Brussels is building EU level model evaluation capacity by 2027 and secure testing platforms for critical sectors. Treat that as your cue to run adversarial testing before launch and to connect the results to the controls you already maintain, like your ISO 27000 series programme, so your audit trail is one continuous story.
The old playbook shipped the AI first and secured it later. The new one demands security evidence before the release, not after the incident.
Not sure where your own baseline stands? Our cyber security fundamentals assessment shows you in five minutes where the gaps are.
Here is the question I would love you to answer in the comments: if a regulator asked for your AI risk register tomorrow, which system would you struggle to document first?