EU AI Board holds 9th meeting as enforcement takes the lead

The European Artificial Intelligence Board met for its ninth session on 17 September 2026 to review implementation of the EU AI Act and to sharpen practical steps for enforcement and operator engagement.

The meeting, chaired under the Irish Presidency, brought Member State representatives together with the Commission to assess near‑term priorities for applying transparency rules and incident reporting requirements.

Regulators are no longer only finishing the text of the law — they have begun active enforcement. The European Commission sent formal requests for information to more than 30 AI providers on 1 September 2026, signalling the start of documentary and compliance checks.

That paperwork push follows the activation of several transparency obligations that came into force on 2 August 2026, and the Commission has since published guidance to help providers and deployers meet the new marking and disclosure duties.

The AI Act’s incident‑reporting framework is already operative for certain systems: providers of specified general‑purpose models with systemic risk must notify the EU AI Office of serious incidents “without undue delay,” and the text of the regulation spells out post‑market monitoring and reporting duties.

Enforcement is thus moving from drafting rules to testing them against real events. The Commission said it had received an incident report from a major model developer in early September and is examining the case under the new Article 55 procedures.

For vendors building regulated model‑hosting services, the Board’s focus matters. Transparency obligations affect product labeling, user notices and supply‑chain documentation; incident reporting creates new timelines and information flows between providers, the EU AI Office and national market surveillance authorities.

The Board also discussed voluntary tools and codes that can ease compliance. On 9 July the Commission and the AI Board assessed a Code of Practice on transparency of AI‑generated content as an adequate voluntary instrument to help meet marking obligations. That reflects a mixed approach of mandatory rules and practical instruments.

Regulators signalled they expect more hands‑on engagement with operators. The Commission and the AI Office are building templates, a Service Desk and interactive tools to help firms determine whether systems fall inside the Act and to speed responses to RFIs and incident notices.

The practical consequence for supply chains is immediate: cloud hosts, model‑ops vendors and downstream deployers must collect and share documentation the Act requires, from model provenance and training‑data inventories to post‑market monitoring plans. The law also sets a timetable for additional guidance, such as a Commission template for post‑market monitoring due by 2 September 2027.

Industry reaction has varied. Some providers view the early RFIs and incident reviews as test cases that will clarify thresholds, while others warn the rules remain ambiguous — particularly on what counts as a “serious incident” and what must be reported publicly. That ambiguity is already surfacing in press exchanges between firms and Brussels.

Technical teams building and hosting regulated models should treat the Board’s session as a cue to harden observability and response playbooks: define detection logs, preserve forensic records, and run tabletop drills that map the “without undue delay” reporting clock to actual operational processes. The Commission’s guidance and the Service Desk are practical starting points.

The AI Board stopped short of publishing fresh deadlines or new benchmarks at the September meeting, instead prioritising enforcement readiness and inter‑authority cooperation across Member States. That posture means vendors should expect a period of investigations, RFIs and clarifying guidance rather than immediate rule changes.

What to watch next: how the EU AI Office processes its RFIs, whether the Commission issues narrower definitions or templates for incident classification, and how national market surveillance authorities translate Board guidance into inspections. For vendors in Europe, the transition from rule writing to active enforcement makes fast compliance and transparent documentation a commercial requirement rather than a regulatory exercise alone.