EU AI Act enforcement framework exposes enterprises to liability gaps

The European Union’s AI Act enforcement mechanisms are crystallising into a compliance framework that exposes enterprises to significant liability gaps, particularly around high-risk AI systems, according to multiple legal analyses published by international law firms tracking the regulation’s implementation.

Foley & Lardner LLP’s recent guidance highlights that the Act’s tiered penalty structure reaches up to €35 million or 7% of global annual turnover for the most serious violations, creating unprecedented financial exposure for organisations deploying AI systems classified as high-risk. The framework, which began phased implementation in August 2024, establishes distinct obligations for AI system providers, deployers, and distributors—a multi-party liability chain that complicates traditional enterprise risk management.

The compliance challenge centres on the Act’s classification system, which designates AI applications in critical infrastructure, employment, law enforcement, and essential services as high-risk. These systems face mandatory conformity assessments, technical documentation requirements, and ongoing monitoring obligations. Legal experts note that many enterprises lack clarity on whether their AI deployments qualify as high-risk, creating immediate compliance uncertainty.

“The Act’s extraterritorial reach means non-EU companies placing AI systems on the European market face the same obligations as EU-based providers,” according to guidance from multiple international law practices. This extends regulatory jurisdiction beyond traditional geographic boundaries, affecting global technology vendors and enterprise software providers with European customers.

The enforcement architecture relies on national market surveillance authorities coordinating through the European AI Office, established within the European Commission. This distributed enforcement model introduces variability in interpretation and implementation across member states, despite harmonisation efforts. Early indications suggest divergent approaches to risk classification and conformity assessment procedures among national regulators.

Financial services, healthcare technology, and human resources software providers face the most immediate impact, as their AI applications frequently fall within high-risk categories. Conversely, legal technology firms specialising in AI compliance tools and third-party auditing services stand to benefit from mandatory conformity assessment requirements. The European AI Office estimates that high-risk AI systems will require conformity assessments costing between €190,000 and €6.5 million per system, depending on complexity.

Insurance markets are responding with nascent AI liability products, though coverage gaps remain substantial. Traditional professional indemnity and product liability policies typically exclude algorithmic decision-making risks, forcing enterprises to negotiate bespoke coverage or accept uninsured exposure. The lack of actuarial data on AI system failures complicates underwriting, keeping premiums elevated and coverage terms restrictive.

The liability framework’s impact extends beyond direct regulatory penalties. The Act introduces obligations for post-market monitoring and incident reporting, creating discoverable documentation trails that could strengthen civil litigation claims. Legal practitioners anticipate increased private enforcement through data protection authorities and consumer protection agencies, supplementing formal regulatory action.

Compliance timelines vary by AI system category, with prohibitions on unacceptable AI practices already in effect and high-risk system requirements phasing in through August 2027. This staggered implementation creates a moving compliance target for enterprises managing diverse AI portfolios.

The immediate priority for affected organisations involves conducting AI system inventories to identify high-risk applications, establishing conformity assessment pathways, and implementing technical documentation systems. Legal advisers recommend mapping AI supply chains to clarify provider versus deployer obligations, as liability often depends on the specific role an organisation plays in the AI value chain.

Attention now turns to how national authorities interpret ambiguous risk classifications and whether enforcement priorities emerge around specific sectors or AI applications. The European Commission’s planned guidance documents on conformity assessment procedures will prove critical for enterprises navigating the compliance framework’s technical requirements.