EU AI Act Enforcement Timeline: What Professional Services Firms Need to Know

The EU AI Act is no longer a future consideration. It is live, it is enforceable, and its reach extends well beyond Europe's borders. For professional services firms — whether you are a law firm in London, an accounting practice in Toronto, an HR consultancy in Dubai, or a marketing agency in Singapore — the question is not whether this regulation affects you. The question is how much, and by when.

This briefing sets out the key enforcement milestones, what they mean in practice, and where your compliance gaps are most likely to be hiding.

Why This Matters Beyond the EU

The EU AI Act applies extraterritorially. If your firm provides or deploys AI systems that are used within the EU — by your clients, your employees, or your own operations — you fall within its scope, regardless of where your business is established. This mirrors the logic of GDPR, which caught organisations worldwide off guard in 2018. The AI Act is broader in ambition and arguably more complex in its obligations.

Firms that dismissed GDPR as a European problem until it was too late will recognise the pattern. Do not repeat it.

What Is Already in Force

February 2025: Prohibited Practices and AI Literacy

As of February 2025, the Act's prohibitions on so-called "unacceptable risk" AI practices became enforceable. These are not edge cases. They include:

• Social scoring systems that evaluate individuals based on behaviour, personal characteristics, or social circumstances
• Manipulative AI that exploits vulnerabilities to influence behaviour in harmful ways
• Untargeted scraping of facial images from the internet or CCTV to build facial recognition databases

For most professional services firms, the immediate exposure here is indirect — for instance, using third-party tools built on prohibited practices, or deploying AI-powered client-facing systems that could be characterised as manipulative. If you have not audited your AI tool stack against these prohibitions, that audit is overdue.

The February 2025 deadline also introduced AI literacy obligations. Organisations deploying AI systems must ensure that staff working with those systems have sufficient knowledge to use them responsibly. This is not a one-time training exercise. It is an ongoing operational requirement.

August 2025: General-Purpose AI Governance

Rules governing general-purpose AI (GPAI) models came into force in August 2025. This is where firms using large language models — ChatGPT, Copilot, Gemini, and their equivalents — need to pay close attention.

GPAI obligations include transparency requirements and copyright-related duties. Providers of these models must disclose training data summaries and comply with EU copyright law. For deployers — which includes any firm integrating a GPAI tool into a client-facing service or internal workflow — the obligations relate to how you document, govern, and communicate the use of these systems.

By August 2025, EU Member States were also required to designate national competent authorities. The European AI Office, housed within the European Commission, is the central supervisory body for GPAI provisions and coordinates implementation across Member States. Enforcement machinery is now operational.

What Is Coming Next

August 2026: High-Risk AI Systems and Transparency Obligations

The most substantial tranche of obligations arrives in August 2026. This covers high-risk AI systems listed under Annex III of the Act — systems used in areas including:

• Employment and HR: AI used in recruitment, performance evaluation, and workforce management
• Education: systems that assess, grade, or make decisions about learners
• Biometrics: tools that identify or categorise individuals based on physical characteristics
• Law enforcement and legal processes: relevant to legal and compliance-focused firms

If your firm uses AI for CV screening, employee monitoring, client risk assessment, or any form of automated decision-making that has a meaningful effect on individuals, you need to understand whether those systems qualify as high-risk under the Act.

August 2026 also brings enforceable transparency obligations for AI systems that interact directly with people or generate synthetic content — including deepfakes. Watermarking requirements apply. If your marketing agency produces AI-generated content, or your firm uses AI-powered chatbots with clients, these rules apply to you.

2027 and 2028: Deferred Deadlines for Some High-Risk Systems

Recent amendments under the EU's "Digital Omnibus" package have adjusted the timeline for certain high-risk systems. Stand-alone high-risk AI systems now face a compliance deadline of 2 December 2027, while high-risk AI systems embedded in regulated products — medical devices, machinery, and similar — have until 2 August 2028.

These deferrals are not a signal to slow down. They are an opportunity to get ahead of obligations that will eventually be enforced.

The GDPR Dimension: Already Biting

AI compliance does not begin and end with the AI Act. GDPR remains independently enforceable and is already being applied aggressively to AI practices.

In September 2024, the Dutch Data Protection Authority fined Clearview AI €30.5 million for building a biometric database from scraped facial images without consent — and warned that using Clearview's services is itself illegal within the EU. In November 2024, Italy's Garante fined OpenAI €15 million for GDPR violations related to ChatGPT, including processing personal data for training without adequate legal basis and failing age verification requirements. While a Rome court later annulled the fine on procedural grounds, OpenAI had already implemented substantive changes in response.

The Irish Data Protection Commission took legal action against X in August 2024 to stop EU users' public posts being used to train the Grok AI model. These are not abstract regulatory skirmishes. They set precedents that affect every organisation using AI to process personal data.

If your firm's AI tools are processing client data, employee records, or any personal information sourced from EU individuals, GDPR obligations apply — and they interact with AI Act requirements in ways that require careful, joined-up analysis.

The Penalties Are Serious

Non-compliance carries substantial financial exposure. Violations of prohibited AI practices carry penalties of up to €35 million or 7% of worldwide annual turnover, whichever is higher. Breaches relating to high-risk AI systems attract fines of up to €15 million or 3% of global turnover. These figures are designed to be meaningful even for large organisations.

Enforcement is structured across multiple layers: the European AI Office, national market surveillance authorities, and fundamental rights protection bodies all have roles. Regulators are coordinating. Enforcement is not hypothetical.

Where to Start

For professional services firms, the compliance priority list looks like this:

1. Map your AI systems: Know what you are using, who supplies it, and what it does with personal data
2. Assess risk classification: Determine whether any of your AI tools qualify as high-risk under the Act
3. Review your AI literacy programme: Staff training is an active obligation, not a one-off task
4. Audit third-party tools: Your exposure includes the tools your vendors use
5. Align AI Act and GDPR compliance: These frameworks overlap — manage them together

The EU AI Act is reshaping the operating environment for professional services globally. Compliance is not a one-time project. It is a continuous programme that requires legal, operational, and technical expertise working in concert.

Ops Intel helps professional services firms navigate AI compliance across jurisdictions — from initial gap assessments to ongoing regulatory monitoring. If your firm is unsure where it stands under the EU AI Act or how your current AI use intersects with GDPR, speak to our team. We will give you clarity, not complexity.

Get in touch with Ops Intel to discuss your AI compliance position.