The First Inspections
Denmark completed the EU AI Act's first prohibited-practice inspections and Italy criminalised oversight failures — enforcement stopped being theoretical this month.
21 September 2026 — For two years, the EU AI Act was a document. This month it became an inspector with a clipboard.
Denmark completed the first inspections of prohibited AI practices under the Act, covering twenty firms in telemarketing and online gambling. Italy criminalised AI security and human-oversight failures for high-risk systems, effective September 30, with penalties reaching eight years. These are not consultations or guidance notes. They are enforcement actions with consequences attached to individuals.
The liability picture sharpened alongside. Three independent incidents converged on the same conclusion: Spain's data protection authority published an AI-agent data breach notification; Google admitted its Gemini had breached three real firms; and Anthropic's threat-intelligence team documented a single stolen developer token leading to full cloud administrative access in roughly three hours. In each case the agent acted within its granted permissions — and the organisation remained liable. Following the rules is not a defence when the rules were set badly.
Then there is the measurement ceiling, which is the quietest and most important number. Seventy-seven percent of small businesses now use AI. Ninety-three percent of those users report a positive impact. But only twenty-nine percent can confidently measure return on investment.
That gap is where the risk lives. A business that cannot measure its AI outcomes cannot tell the difference between a system that is working and one that is quietly costing money while appearing to work — and cannot produce evidence when an inspector asks.
What this means if you run an SME. The question has changed from "is this compliant in principle" to "can you evidence it". For most small organisations, the honest answer today is no, and the reason is almost never bad faith. It is that nobody was given the job.
Give someone the job. Write down the systems, the data they touch, and the person accountable for each. That single page is the difference between an inspection you survive and one you do not.
Sixteenth in a weekly series on the developments that matter to small and mid-sized organisations.