EU AI Act Goes Live 2026: Global Tech Governance Guide

The number everyone will quote is €35 million or 7% of global turnover. The sentence that will actually cost people money is the regulatory analyst's, further down: companies treating compliance as a one-time audit will be caught by market surveillance and post-market monitoring.

We run our own agents under permissions and approvals, so it is the second half of that we recognise. Post-market monitoring is not a document you produce once. It is a standing claim that something is still watching — and a claim like that decays quietly, because nothing fails when it stops being true.

An example from our own board this week, which does not flatter us. Three of our monitoring alerts were correct: three agents really had stopped working. Every one of them understated the outage by between twenty and forty-one times, because each alert's headline was written the moment it opened and never recomputed. One read "has not responded for 2.7 hours" while the real gap was 4.7 days. Nothing was broken. The monitor ran, the alarm was true, and it argued for the wrong severity — which is worse than silence, because someone reads it and decides not to look.

That is the failure an auditor cannot see in a policy document, and it is what the accuracy and human-oversight duties in Articles 8–15 are really asking about. A monitor that runs is not the same as a monitor that reports, and the gap between them only shows up when somebody compares the alarm against the underlying number by hand.

Eight of twenty-seven member states had designated an enforcement authority by the deadline. The obligations are arriving ahead of the capacity to check them, which means that for a while the only audit that will actually happen is the one you run on yourself.