Commentary. Europe’s artificial-intelligence rulebook has reached the moment that matters most: enforcement. The European Commission says the AI Act’s authorities began applying its framework on 2 August 2026, after the law introduced four risk categories and corresponding obligations for developers, deployers and users. That milestone deserves neither triumphalism nor panic. It deserves scrutiny.
Our view is straightforward: Europe should enforce the rules it has written while fixing genuine implementation problems in public, rather than repeatedly postponing the standards meant to protect people from consequential automated decisions.
The case for holding the line
The AI Act is an attempt to regulate uses, not merely technologies. The distinction matters. A chatbot used to draft a shopping list does not pose the same social risk as a system used in recruitment, worker management, education or access to essential services. The EU’s risk-based structure reflects that reality, assigning stricter requirements to higher-risk applications.
That approach is not perfect, but abandoning it would leave the public with a familiar choice: trust vendors to police themselves, or wait for harm before governments respond. Neither is adequate. Automated systems can obscure responsibility even when no one intended to discriminate. A person denied a job, benefit or loan may not know that software shaped the decision, much less how to challenge it.
The need for oversight is reinforced by Europe’s separate rules on platform work. The European Foundation for the Improvement of Living and Working Conditions says the Platform Work Directive, which member states must transpose by December 2026, includes transparency, human oversight and worker-representation rights around algorithmic management. That direction is sensible: people affected by automated decisions need explanations and meaningful routes of appeal, not assurances that a model is technically sophisticated.
The objections are real
Critics are right to warn that compliance can be expensive, especially for small companies and researchers. Overlapping obligations can deter experimentation, push investment elsewhere and make it harder for European firms to compete with companies operating under lighter rules. Vague definitions and uneven national enforcement could produce a fragmented market in which the same product faces different practical expectations from one country to another.
Those concerns should not be dismissed as industry lobbying. The Commission itself proposed targeted amendments through an “AI omnibus,” adopted in June 2026. The existence of that simplification effort suggests that lawmakers recognise the risk of administrative overload. The Center for Democracy & Technology also reports that US states have continued to debate automated decision systems, frontier-model risks and third-party auditing, while federal legislation has not advanced in the current session. That contrast shows both the appeal and the cost of regulatory ambition.
“The question is not whether regulation has costs. It is whether those costs are smaller than the social costs of unaccountable deployment.”
Enforcement must be practical and visible
Europe’s answer should be neither maximalism nor retreat. Authorities need clear guidance, realistic transition support and proportionate penalties. They should publish enforcement priorities, explain how complaints are handled and identify which obligations apply to small providers. Independent auditors and civil-society groups should have access to enough information to test whether high-risk systems work as claimed.
Most importantly, regulators should measure outcomes. A company that produces immaculate paperwork but cannot show that its system avoids unlawful discrimination has complied with the form, not the purpose, of the law. Conversely, a small developer that can demonstrate safety should not be buried under unnecessary process.
Europe’s model will be judged by whether ordinary people can understand and contest consequential automated decisions. That is a demanding standard, but it is the right one. Delay may protect convenience in the short term; credible enforcement protects legitimacy in the long term.