EU AI Act enforcement is already underway, and hiring AI is one of the areas drawing early regulatory attention. In this In/Sight episode, Rui Serrano, Data Protection Officer at Insight Assurance, explains to Ben Wright how enforcement usually unfolds, why overlapping laws matter, and why “it doesn’t apply to us” is a risky assumption.
Enforcement Has Already Started
EU AI Act enforcement is already underway, and hiring AI is among the early areas of attention. Ben opens with what he’s seen: cases involving HR technology that used AI in hiring, which drew regulatory attention. Some companies still seem to think the Act won’t touch them. Ben’s question for Rui is whether more EU AI Act enforcement is coming.
Ben also notes how quickly some of those cases moved, which suggests they were well prepared and that others may already be in regulators’ sights.
No Supervisory Authority Is Not a Pass
A gap in who supervises the AI Act doesn’t mean EU AI Act enforcement is on hold. Rui explains that not every EU member state has yet named a supervisory authority for the AI Act. In many cases it will be the same authority that handles GDPR or e-Privacy, but some states haven’t defined it yet.
That’s no reason to relax, because these laws are intertwined. In Rui’s view, hiring cases like the ones Ben mentions don’t only touch the AI Act. They can fall under GDPR too. “It’s just a matter of where are you picking it from, from one end or the other end.” A regulator without an AI Act mandate can still reach the same conduct through data protection law.
How EU AI Act Enforcement Usually Works
EU AI Act enforcement usually starts with a warning, unless people face real, immediate risk. Rui acknowledges the headlines about huge penalties against the largest tech companies, and says those are often companies that would rather pay than change a system that can’t stop running. They aren’t the typical case.
The usual pattern is to inform the organization first that something is wrong, then give a set period to mitigate the non-compliance points and present proof. If nothing changes, a penalty follows. The exception is when people can really get hurt today. The penalties issued so far, in Rui’s account, came where the risk to people was so high, in terms of discrimination or even personal hazard, that there was no other way to enforce the law.
The speed of EU AI Act enforcement also depends on where you are. Rui notes that the pace of enforcement varies by member state. In countries like Germany or the Netherlands, it’s swift. Other states take their time. If you operate across borders, plan for the fastest regulator, not the slowest.
The New Whistleblower Channel
EU AI Act enforcement no longer has to start with a regulator’s own review. Ben points to the whistleblower channel now connected to the AI Act framework, which lets people report AI use they believe breaks the law. That raises the stakes for any company quietly assuming the Act doesn’t apply.
Rui frames it as a parallel road. Whistleblowing initiatives already existed in other EU contexts, letting people inside organizations report conduct that’s against the law or harms someone. That approach has now spread into legislation covering the irregular use of AI. Whatever his personal view, he’s clear about the obligation: “I don’t get to observe the laws that I like and to not care about the ones that I don’t.”
Key takeaways
- EU AI Act enforcement has begun, with hiring AI among the early areas of attention.
- A missing AI Act supervisory authority doesn’t give anyone a pass, because GDPR and e-Privacy overlap.
- Authorities usually warn first and give time to mitigate, unless people face real, immediate risk.
- EU AI Act enforcement speed varies by member state, so cross-border operations should plan for the fastest.
- With the whistleblower channel, EU AI Act enforcement can start from a report, not only a regulator’s review.
Frequently asked questions
Is the EU AI Act already being enforced?
Yes, according to the In/Sight episode. Ben Wright and Rui Serrano discuss early enforcement activity, including cases involving hiring AI, and Rui stresses that companies assuming the Act does not apply to them are taking a real risk. Because the AI Act overlaps with GDPR, the same conduct can draw scrutiny from more than one direction.
How does EU AI Act enforcement usually work?
Rui Serrano explains that EU authorities typically inform the organization first that something is wrong and give a period to mitigate and present proof. If nothing is done, a penalty follows. The exception is a real, immediate risk to people, such as discrimination or personal hazard, where penalties can come without a warning period.
Has every EU member state named an AI Act supervisory authority?
Not yet, according to Rui Serrano. Some member states have not defined which authority supervises the AI Act, and in many cases it will be the same authority that handles GDPR or e-Privacy. He stresses that this gap does not give anyone a pass, because the laws overlap.
Why can one AI violation break several laws at once?
The EU AI Act, GDPR, and e-Privacy rules are intertwined. In Rui Serrano’s view, hiring AI cases like those discussed on In/Sight can fall under both the AI Act and GDPR, so regulators can approach the same conduct from either side. Enforcement speed also varies by member state, and Rui notes that Germany and the Netherlands tend to act quickly.
What is the EU AI Act whistleblower channel?
It is a reporting route that lets people flag AI use they believe breaks the law. As discussed on In/Sight, it extends earlier EU whistleblowing initiatives into AI legislation, which means an investigation can start from a report rather than only from a regulator’s own review. That raises the stakes for assuming the Act does not apply to you.
Related reading
- EU AI Act Explained: the four risk levels
- What the EU AI Act requires
- ISO 42001 in 2026 and the EU AI Act delay
- Independent GDPR assessments
- A quick guide to GDPR assessments
Watch the full conversation, or catch it on Spotify!
Not sure where your organization stands?
Not sure where your organization stands? Insight Assurance performs independent assessments to help you find out. Contact us to talk with the professionals at Insight Assurance.
