Two EU member states switched on the machinery that turns the AI Act from a document into a liability this week. In Poland, the provisions on inspections, infringement proceedings and administrative fines take effect today, October 28(opens in a new tab), and from today any person or company can file a complaint about an alleged breach. In Italy, Legislative Decree 179/2026 came into force on October 23(opens in a new tab). It names the national cybersecurity agency, ACN, as the market surveillance authority, lets it inspect on site or remotely without prior notice, and hands the Bank of Italy, CONSOB and IVASS AI Act powers over the financial firms they already supervise.
The common assumption in many enterprises is that the AI Act is mostly a 2027 problem, because the Digital Omnibus pushed the high-risk deadline out. That is true for the high-risk regime and wrong for almost everything else. Prohibited practices and transparency duties already apply, and national enforcement laws now give regulators procedures, inspection powers and complaint channels to act on them. A complaint channel matters more than a fine schedule. It means enforcement no longer waits for a regulator to pick you; a disgruntled employee, a rejected applicant or a competitor can start it.
Italy also went past the EU text. Its Article 41 says decisions to hire, change or end employment, discipline a worker or rate performance cannot rest on automated processing alone, and a person with real, independent authority has to make the final call. A dismissal made in breach is void, which can mean reinstatement and back pay. Italy added its own fine band too, up to EUR 1 million or 0.5% of turnover, for skipping a fundamental rights impact assessment or failing to explain a decision. Any HR or workforce analytics tool used on Italian staff is now a legal exposure, not just a policy question.
The cost implication is that EU compliance is becoming a set of national regimes with different regulators, inspection styles and national add-ons, layered on one regulation. A single Brussels-facing compliance file will not cover it. Budget for country-level legal review where you have large workforces or regulated entities, starting with Italy, Poland, and any market where your bank or insurer subsidiaries answer to a financial supervisor that now has AI inspection powers.
For the CAIO. This quarter, list every AI system that touches EU employees, customers or applicants, tag each by country and by who supervises it there, and confirm a named human signs off on every employment decision in Italy. Then ask General Counsel who will answer the first complaint, because from today someone can file one.
Action items
Poland can now inspect, fine and take complaints under the AI Act, and Italy's enforcement decree voids firings decided by algorithm alone. EU AI compliance is becoming a set of national regimes, and enforcement can now start with a single complaint.
For the CAIO
Tag every EU-facing AI system by country and supervisor, and put a named human on every employment decision in Italy.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
Also worth knowing
- Traple Konarski PodreckiPoland's AI law is finally here: what changes for businesses(opens in a new tab)
Poland's inspection, infringement and fine provisions start October 28, and anyone can now file a complaint with regulator KRiBSI. Enforcement in Poland can start from a single complaint, not a regulator's own agenda.
- GamingTechLawNew Italian AI Act enforcement law: unannounced inspections and fines up to 7% of turnover(opens in a new tab)
Italy's ACN can inspect without notice, and dismissals decided by automated processing alone are void. Audit every AI tool in Italian HR and finance operations first.
- CFO DiveAI regulation push gains steam ahead of midterms(opens in a new tab)
66% of voters want more AI rules, but the House Energy and Commerce chair won't commit to a committee vote this year on the bipartisan Obernolte-Trahan frontier AI bill. Plan for state rules from California and New York before any federal preemption.
- EngadgetUnauthorized AI agents are reportedly already accessing US bank accounts(opens in a new tab)
Morgan Stanley, Bank of America, JPMorgan and Wells Fargo moved to block or restrict third-party AI agents, with many pushing toward read-only access. Any agent you run against partner portals needs sanctioned access, not a shared login.
- The Motley FoolPayPal (PYPL) Q3 2026 Earnings Call Transcript(opens in a new tab)
PayPal's AI chat agents resolved more than 24 million contacts this year across 190 countries, alongside 2,000+ job cuts and a $1.5 billion run-rate savings target. Ask vendors for resolution and recontact rates, not contact counts.