BRUSSELS — The European Commission has delivered its first official report card on how tech companies are handling the EU Artificial Intelligence Act, and the results show an industry scrambling to keep pace with the rulebook. In its newly published compliance audit findings, regulators outlined notable deficiencies across several sectors, ranging from shoddy data governance to missing technical documentation.
The review, spearheaded by the European AI Office alongside national market surveillance watchdogs, examined enterprise deployments of high-risk algorithms as well as general-purpose foundational systems. While officials stopped short of levying record fines right out of the gate, they cautioned that the period of regulatory leniency is rapidly closing.
Documentation Deficits in High-Risk Tools
Much of the audit focused on tools classified as high-risk under European law. These include automated systems used in hiring pipelines, credit assessments, worker monitoring, and public access services. Regulators checked whether operators maintained clear risk management files and whether human oversight was genuinely built into daily operations.
What auditors discovered was widespread disarray. Many businesses relied on off-the-shelf software without assessing how those models performed on local demographic groups. In recruitment tools, developers routinely failed to maintain adequate records detailing how they vetted training datasets for historical bias.
“Adoption cannot outpace accountability,” European regulators noted in their review summary. “Deploying an automated hiring filter or loan assessment engine requires verifiable proof that it treats individuals fairly, not just vendor assurances.”
In dozens of audited cases, companies could not produce basic technical documentation requested by investigators. Others maintained internal logs, but the records were fragmented or lacked clear metrics on how edge cases and false positives were handled.
Frontier Models and Data Transparency
General-purpose AI providers faced their own set of hurdles during the inspection cycle. Under the legislation, developers of large-scale foundation models must disclose summaries of copyrighted materials used in training and release estimates of their models' energy consumption.
Auditors found compliance here to be patchy at best. While several large developers provided standardized summaries, smaller developers frequently claimed trade-secret exemptions to avoid publishing dataset compositions. Regulators pushed back on those claims, asserting that general transparency mandates apply uniformly regardless of an organization's size or commercial model.
Energy disclosures were equally problematic. Several organizations provided raw compute hours during the pre-training phase, yet they omitted the downstream inference power footprints that make up the bulk of operational electricity consumption.
Enforcement Looms as Warnings Issued
Instead of issuing immediate monetary sanctions, the Commission opted to issue formal corrective notices. Companies targeted in this first wave have between 60 and 90 days to bring their internal records, testing frameworks, and transparency registries into alignment with EU standards.
The clock, however, is ticking. Under the statutory terms of the AI Act, penalties for non-compliance are severe. Violations involving prohibited systems can trigger fines reaching up to €35 million or 7% of a firm's global annual turnover, whichever is higher. Failing to fulfill general operational and transparency rules can lead to penalties of €15 million or 3% of global revenue.
National authorities are now setting up dedicated technical labs to re-test updated software submissions. Industry analysts say this first wave of audit reports sends an unmistakable message across corporate boardrooms: compliance can no longer be treated as a checkbox exercise run by public relations teams.
Next Steps for Affected Companies
Organizations operating in the European single market face immediate work. Regulators recommend three concrete steps for those currently re-evaluating their systems:
- Conduct comprehensive data audits on all training and validation sets to identify gaps in demographic representation.
- Build real-time monitoring mechanisms that log when human operators override algorithm recommendations.
- Prepare accessible documentation explaining model capabilities, error rates, and training methodologies to show regulators on demand.
As the European AI Office hires more technical investigators and formalizes testing protocols, inspections are set to expand into public-sector tools, law enforcement pilots, and medical diagnostic aids over the coming year.