EU AI Act’s First Year: What Transparency Enforcement Brings

Twelve months after the EU AI Act began its enforcement clock, the practical realities of Article 50 are coming into focus. While the regulation carries headline penalties of up to €15 million or three percent of global turnover, the first year of enforcement is likely to look less like a fine bonanza and more like a series of operational shocks. For organizations deploying AI, the immediate threat may not be financial at all. It may be a sudden order to pull a system offline.

Edwin Weijdema, Field CTO at Veeam, has spent the past year fielding questions from clients navigating this new terrain. In a recent interview, he outlined what he expects from the opening phase of enforcement, where the first cases will emerge, and why the accountability gap around autonomous agents remains unresolved.

First-Year Exposure: Corrective Orders Over Cash Penalties

Article 50 violations carry serious financial exposure, but Weijdema cautions against expecting a wave of massive fines in year one. Drawing parallels to GDPR and NIS2, he notes that enforcement will be handled by individual member states, each with its own procedures and priorities. That fragmentation makes precise predictions difficult.

However, he points to a common pattern in new EU regulations: the first year often functions as a “bedding in” period. Regulators tend to weigh proportionality, the scale of impact, whether a breach was intentional or negligent, and how quickly an organization cooperated. For companies making genuine efforts to comply, corrective orders are far more likely than heavy financial penalties.

That said, there is always the possibility of a symbolic fine to signal seriousness. But Weijdema believes the bigger practical exposure in year one will be operational. Being forced to suspend, relabel, or withdraw an AI-enabled process at short notice can be far more disruptive than writing a check. The real risk is being told to stop using a system until you can prove compliance.

When Does Indirect Interaction Count as Direct?

A recurring point of confusion for clients involves agentic systems that interact with people through indirect channels like ticketing queues, shared inboxes, or procurement portals. Weijdema clarifies that the channel itself is not decisive. The key question is whether the AI is communicating directly with a natural person or whether a human intermediary is exercising meaningful review and control.

If an AI drafts a response and a human reviews and sends it, the risk profile is very different from an AI agent autonomously replying to a customer or supplier. The latter can qualify as direct interaction, even if it happens through a ticketing system rather than a chatbot window. The AI Act does not care about the interface. It cares whether the human is effectively dealing with the machine.

Weijdema advises clients to deliberately separate internal agents from customer-facing ones, establishing barriers and access controls across the organization. Telling an agent “don’t go into this room” is not enough. You need to put a lock on the door.

Simulated Phishing and the Deepfake Dilemma

Security teams running simulated phishing and vishing exercises face a tricky compliance question, especially when they clone an executive’s voice. The exercise loses its value if the material carries a label announcing it is a test. But cloning a real person’s voice with AI can quickly cross into deepfake territory, and a security purpose does not automatically create an exemption from transparency obligations.

Weijdema’s advice is straightforward: if you decide not to label AI-generated elements, you must be able to demonstrate that the legal basis and risks were carefully assessed. That means involving legal and compliance early, documenting the reasoning, and considering input from privacy, HR, and employee representatives, particularly when using a real person’s voice or likeness.

He recommends exploring alternatives like fictional personas, synthetic voices that do not imitate real employees, and prior general notice that simulations may use synthetic media. The goal is to preserve realism without normalizing undisclosed executive impersonation. The documentation should cover the exercise’s purpose, scope, tools used, whether anyone was imitated, what disclosure was provided, what personal data was processed, and how employees were debriefed.

His blunt guidance to security teams: “A security objective does not magically turn an undisclosed deepfake into a compliant one. If you have to clone the CEO’s voice to make the test work, legal should be in the room before anyone presses send.”

Where Will the First Article 50 Action Originate?

As of mid-June, only nine of the twenty-seven member states had designated both a market surveillance authority and a notifying authority. Twelve had partial designations, and six had neither. That uneven readiness complicates predictions about where the first enforcement case will come from.

Formally, the first action is most likely to originate from a market surveillance authority, since that is where national enforcement responsibility sits. But the trigger may come from elsewhere. Defamation claims are possible, especially where synthetic audio or video damages someone’s reputation, but that is more likely to be a parallel legal route than a clean Article 50 case. Consumer groups could also mount early challenges, particularly for AI systems affecting large numbers of people.

Weijdema expects the first case to be regulator-led on paper but very possibly complaint-led in reality, triggered by a consumer group, competitor, employee, journalist, or affected individual.

The Accountability Question No One Can Answer Yet

The most persistent question from clients has no good answer yet: How do you prove what an AI agent did, why it did it, and who was accountable?

Evidence matters in cybersecurity and governance. You need logs, approvals, identities, access controls, retention, and audit trails. But agentic AI can reason, retrieve data, generate content, and take actions across multiple systems. Governance must move from policy documents into technical controls.

Weijdema’s advice is to treat AI agents like privileged digital identities. Give them an owner, a defined role, least-privilege access, monitoring, approval gates, and a kill switch. Organizations that get this right will not just be more compliant. They will be more resilient.

Another recurring question ties directly to security testing: Where does transparency end and security testing begin? Security teams want realism. Regulators want disclosure. The challenge is designing exercises that satisfy both without crossing legal, ethical, or employee trust boundaries.

And the unresolved questions keep stacking up. Who is ultimately accountable when an AI system causes harm: the vendor, the deployer, the business owner, or the executive team? How do you prove to regulators, customers, and the board that AI governance works in practice, not just on paper? How much business value are you willing to lose to stay compliant, transparent, and auditable at scale? None of these have clear answers yet, but organizations that start wrestling with them now will be better positioned when the regulators come calling.