The EU AI Act's Enforcement Gap: Why Banned Systems Still Appear

What Happened

The European Times recently published a detailed explanation of the EU AI Act, highlighting which AI systems are banned and what comes next in the implementation timeline. The article notes that while certain AI applications are prohibited under the Act, these systems are already in use across various industries. The mechanism involves companies developing and deploying AI systems before the full enforcement of the Act, creating a gap where prohibited technologies exist in the market without immediate consequences.

Why This Matters

This situation exemplifies a critical governance failure pattern where regulatory frameworks are introduced after technologies have already been deployed. Companies face the dual challenge of maintaining current operations while preparing for future compliance requirements. The EU AI Act's phased implementation means some prohibited AI systems may remain in use until regulators have the capacity to enforce the ban, creating a period of regulatory uncertainty.

The Governance Failure Pattern

This incident demonstrates the "regulatory lag" failure pattern, where technology development outpaces regulatory frameworks. The specific governance failure is the lack of proactive compliance mapping before enforcement begins. Organizations that haven't conducted thorough applicability assessments of their AI systems against the EU AI Act's requirements will be caught unprepared when enforcement begins.

Specific Controls and Obligations

Under the EU AI Act, providers must:

• Prohibit certain AI practices such as social scoring by governments and real-time biometric identification in certain contexts
• Conduct conformity assessments for high-risk AI systems
• Implement risk management systems and maintain technical documentation
• Ensure human oversight for high-risk applications
• Provide clear information to users when interacting with AI systems

The Act's enforcement timeline means companies need to prepare evidence packs now, even if formal enforcement hasn't begun yet.

Historical Precedents

The Clearview AI case in 2022 showed the consequences of deploying facial recognition systems without proper compliance. The company faced multiple GDPR fines and bans across the EU and UK for mass facial-image scraping. Prevention measures included establishing lawful bases, conducting Data Protection Impact Assessments (DPIAs), and implementing biometric-use restrictions as required by GDPR and EU AI Act Annex III §1.

Similarly, the Netherlands government's 2021 automated fraud-risk system wrongly accused thousands of families, leading to a cabinet resignation. This highlights the importance of fundamental-rights impact assessments and proper human oversight as required by EU AI Act Art. 27 and Art. 14.

What to do

1. Conduct an immediate applicability mapping of all AI systems against the EU AI Act's requirements, identifying which are prohibited, high-risk, or otherwise regulated
2. Establish a compliance timeline with buffer days before each statutory deadline to allow for implementation of necessary controls
3. Prepare evidence packs now, including technical documentation, risk assessments, and conformity evidence, to demonstrate compliance when requested by regulators
4. Implement monitoring systems to track regulatory developments and adjust compliance strategies as needed
5. Consider engaging with governance frameworks that can help establish the processes needed for ongoing regulatory compliance

More from our platforms

These sister platforms cover the parts of this problem that sit outside governance.

• Argus (argus.threatclaw.ai) records every trace an AI application produces and scans it for prompt injection, jailbreaks and data leaks, including the attacks hidden inside retrieved documents and tool results rather than in what the user typed. Governance decides what an AI agent is allowed to do. Argus shows what it actually did.
• ThreatClaw (www.threatclaw.ai) tracks the threat side of the same systems: 22 live intelligence feeds, exploitation predicted before it is officially confirmed, threat actor profiles, and detection rules you can deploy straight away. A control is only as good as the threat it is sized against.