EU AI Act enforcement begins: what regulated enterprises must do now

EU AI Act enforcement begins in August 2026. For regulated enterprises in financial services, healthcare and government, the question is no longer whether to govern AI — it is whether your detection and documentation capability is in place before the first regulatory examination.

The tiered risk framework

The EU AI Act establishes a tiered risk framework. High-risk AI systems — those used in critical infrastructure, healthcare diagnostics, financial credit scoring, employment decisions and law enforcement — face the most stringent requirements. These systems must be registered in the EU AI database, subject to conformity assessment, documented with technical specifications and continuously monitored post-deployment.

For most regulated enterprises, the immediate challenge is not the documentation of approved AI systems. It is the discovery of unapproved ones.

The shadow AI problem

A data scientist pulls an Ollama image and runs a local LLM against internal data. An engineering team deploys a Hugging Face model serving container in a Kubernetes cluster. An AI-powered analytics tool is integrated into a production pipeline without a formal procurement or DPIA process. None of these are intentionally non-compliant. All of them create EU AI Act exposure from August 2026.

Detection at infrastructure level

ZAP addresses this at the infrastructure level. Every AKS, EKS and GKE cluster is scanned on every scan cycle — default every six hours. AI containers are identified by image signature (Ollama, LocalAI, Hugging Face TGI, vLLM, NVIDIA Triton and others) and by behavioural pattern (GPU-accelerated workloads, inference endpoints, high-memory ML containers). Detection triggers a HIGH severity ITSM incident immediately.

• Image signature detection — Ollama, LocalAI, Hugging Face TGI, vLLM, NVIDIA Triton and others identified instantly
• Behavioural detection — GPU-accelerated workloads, inference endpoints and high-memory ML containers flagged by pattern
• Immediate incident creation — HIGH severity ITSM raised with image ID, namespace, cluster and first detection timestamp
• Coverage across all clusters — AKS, EKS and GKE scanned every six hours as default

Three governed response paths

From there, three governed response paths are available:

The whitelist path creates the EU AI Act documentation trail automatically — detection timestamp, review decision, approver identity, DPIA reference, ongoing monitoring status.

FCA, DORA and compound obligations

For financial services firms under FCA and DORA oversight, the stakes are compounded. AI tools used in regulated activities — credit decisions, trading, customer onboarding — may constitute material outsourcing arrangements under FCA PS21/3 and ICT third-party dependencies under DORA. The documentation requirements overlap with EU AI Act requirements and must be maintained simultaneously.

NHS and triple-framework exposure

For NHS organisations, AI diagnostic tools and clinical decision support systems processing patient data create simultaneous GDPR, DSPT and EU AI Act obligations. A single undocumented AI container in a clinical Kubernetes cluster is a potential breach across three regulatory frameworks.

The conclusion is simple

The organisations that will navigate EU AI Act enforcement most successfully are those that already have continuous detection in place — not those that begin building it in July 2026. The infrastructure for AI governance is the same infrastructure required for cloud security governance: continuous scanning, automatic incident raising and documented remediation.

If your organisation does not currently have visibility into every AI workload running across your Kubernetes clusters, that is the first thing to fix. The rest of the EU AI Act compliance programme builds from there.