The EU AI Act establishes a three-tier penalty framework under Article 99, with fines reaching EUR 35 million or seven percent of global turnover for prohibited practices. Enforcement is triggered through market surveillance, complaints, incident reports, and cross-border referrals. The quality of the compliance programme is itself a mitigating factor. When member states issue conflicting guidance, organisations should adopt the more conservative interpretation and document their rationale.
Organisations deploying high-risk AI systems across multiple member states face a coordination challenge that compounds with each additional jurisdiction.
Organisations deploying high-risk AI systems across multiple member states face a coordination challenge that compounds with each additional jurisdiction. The AI Act is a regulation and directly applicable without national transposition, but the implementation ecosystem including competent authorities, guidance documents, inspection practices, and enforcement priorities varies by member state. A robust multi-jurisdiction strategy addresses this variability systematically.
The organisation should designate a single internal coordination point, typically the Conformity Assessment Coordinator or a dedicated regulatory affairs function. This role maintains a register of all relevant authorities across deployment jurisdictions, monitors jurisdiction-specific guidance and procedural requirements, coordinates registration and reporting across multiple databases and authorities, ensures consistency of information submitted to different authorities, and manages language requirements.
Several practical challenges arise that do not affect single-jurisdiction providers.
Several practical challenges arise that do not affect single-jurisdiction providers. Divergent interpretive guidance occurs because national competent authorities may interpret ambiguous provisions differently. One authority may consider a specific use case to fall within Annex III while another classifies it differently. One authority may interpret sufficient AI literacy under Article 4 to require formal certification while another accepts documented on-the-job training. The multi-jurisdiction coordination function must detect these conflicts early through systematic monitoring.
Staggered authority maturity means the organisation must calibrate its engagement strategy to each authority's readiness: proactive engagement and early dialogue with mature authorities, monitoring and preparation with developing authorities, and a conservative compliance posture following the most demanding interpretation with silent authorities that have published no substantive guidance.
The AI Act applies uniformly across all member states as a regulation rather than a directive.
The AI Act applies uniformly across all member states as a regulation rather than a directive. A system that has undergone conformity assessment and bears the CE marking is accepted across the single market without additional national assessment. Article 23 confirms this by prohibiting member states from creating barriers to the making available of AI systems that comply with the regulation.
A deployment checklist summarises the actions required before each new jurisdiction launch.
A deployment checklist summarises the actions required before each new jurisdiction launch. Before deployment, the Legal and Regulatory Advisor identifies the national competent authority and market surveillance authority, reviews jurisdiction-specific guidance for conflicts with the existing compliance posture, and pre-identifies the serious incident reporting channel. The Conformity Assessment Coordinator translates the Instructions for Use into the member state's official language, translates the Declaration of Conformity if required, verifies EU database registration covers the new jurisdiction, and pre-translates the incident report template if the authority requires the national language. The Technical SME confirms data residency and sovereignty compliance.
At deployment, the AI Governance Lead briefs deployers on their Article 26 obligations, and the Legal and Regulatory Advisor adds the jurisdiction to the quarterly guidance monitoring cycle. Multi-jurisdiction deployment adds incremental cost across translation, regulatory monitoring, local legal counsel, incident response covering all deployment time zones and languages, and deployer support. A common approach is to prioritise deployment to a small number of member states initially, building operational maturity before expanding rather than launching simultaneously across all target jurisdictions.
Yes. The highest tier (EUR 35 million or 7% of turnover for prohibited practices) exceeds GDPR's maximum of EUR 20 million or 4%.
Adopt the more conservative interpretation, document the rationale, and consider raising material conflicts with the AI Office for coordination.
Yes. Mandated withdrawal under Article 79 imposes stricter timelines, requires notifying the Commission and other member states, and non-compliance is an aggravating factor for penalties.
Three tiers: up to EUR 35 million or 7% turnover for prohibited practices, EUR 15 million or 3% for high-risk breaches, and EUR 7.5 million or 1% for misleading information.
Tier 1 penalties for prohibited AI practices reach EUR 35 million or seven percent of global turnover, exceeding GDPR's maximum.
The jurisdiction register captures for each deployment member state the designated national competent authority with contact details and published procedures, the market surveillance authority if different, the relevant data protection authority for GDPR coordination, any sector-specific regulators with overlapping jurisdiction such as financial regulators for credit scoring or health authorities for medical AI, the authority's published guidance and interpretive notes, preferred communication channels and language requirements, and any jurisdiction-specific registration requirements beyond the EU database. The register is reviewed quarterly by the Legal and Regulatory Advisor as new guidance is published and authority structures evolve.
Registration coordination requires managing a single EU database registration for providers but jurisdiction-specific deployer registrations under Article 49(3). Incident reporting across borders means a serious incident under Article 73 must be reported to the market surveillance authority of the member state where it occurred, requiring pre-identified reporting channels, pre-translated templates, and coordination procedures for every deployment jurisdiction. Data sovereignty constraints intersect with data residency requirements, as personal data processed in one member state may be subject to additional national provisions beyond the GDPR.
In practice, mutual recognition may be tested as national competent authorities develop their own interpretive approaches. Organisations should retain complete records of their conformity assessment and be prepared to demonstrate compliance to any member state's authority, even where the initial assessment was conducted with reference to a different member state's guidance. The aisdp serves as the universal compliance evidence package, and its completeness and rigour determine whether mutual recognition operates smoothly.
The AI Act's jurisdictional scope extends beyond the EU to include providers established outside the EU who place systems on the EU market and providers whose system outputs are used in the EU. Third-country providers must appoint an authorised representative under Article 22 who maintains the technical documentation and cooperates with competent authorities. The representative should have technical understanding sufficient to respond meaningfully to authority inquiries rather than being a purely legal appointment.
CTO of Standard Intelligence. Leads platform engineering and contributes to the PIG series technical content.
Proactive market surveillance, complaints, serious incident reports, cross-border referrals, and media or civil society reporting.
Prompt corrective action, cooperation with authorities, robust compliance measures, and proactive disclosure of infringements.
The EU database is updated, deployers are notified, transition guidance is provided, and the full AISDP is retained for ten years. Withdrawal does not extinguish ongoing obligations.
