← Back to the blog
August 2026

AI Act in action: 15 days after 2 August 2026 — what EU supervisors actually check in MES

On 2 August 2026 the AI Act enforcement regime for high-risk systems went live. Fifteen days later we have the first market data: which documents supervisory authorities actually request, what the first wave of information requests looks like, where European factories are stumbling most often. This article gathers facts from the first two weeks of Annex III enforcement in EU manufacturing — no marketing, with concrete cases and a realistic list of items an MES must have in order first.

📅 August 17, 2026🏭 AI✒ Martin Szerment
AI Act in action: 15 days after 2 August 2026 — what EU supervisors actually check in MES

2 August 2026 — this date functioned in European manufacturing for three months as an abstraction that CEOs and IT directors postponed for "later". Fifteen days after it passed, the abstraction turned concrete: first information requests from national data-protection authorities to automotive plants, requests for AI technical documentation from consumer-protection regulators to three large food producers, a strong statement from the head of the Digital Market Department at Poland's UODO in Rzeczpospolita ("we are not planning grace periods for entities that had known since April how to prepare").

This article walks through what European authorities actually check in the first two weeks, what first information requests look like in practice, which MES functions turned out to be "hot" (in the sense of immediate regulator interest), and what has to be in order first if your plant is not yet ready. This is a sequel to our May article on high-risk classification — this time with real observations instead of projections.

Who got the first-wave request

Based on conversations with compliance teams at fifteen European plants in the second week of August, a fairly consistent picture emerges:

Data-protection authorities moved first — in the first week of August they sent requests to at least twelve entities processing operator data through AI systems. Three large automotive producers (Kraków, Poznań, Bielsko-Biała in Poland; parallel activity reported in Germany and France), two chemical companies in the Tarnów–Rzeszów region, one meat processor. In each case the opening question was identical: "please provide a copy of your AI risk assessment for the operator performance monitoring system, in accordance with Article 27 of the AI Act".

Consumer-protection regulators joined in week two — narrower scope, sharper consequences. Requests to three medical-device producers about AI classifying defects in quality control. Response deadline: 14 days. Sanctions for non-response: up to PLN 5 million under the Polish AI act of March 2026 (analogous levels in DE/FR national laws).

Critical-infrastructure regulators (CSIRT NASK, UKE) — silence so far. The critical sector will probably be reviewed in the second half of August, but no market signals yet.

Conclusion: data-protection authorities went for a broad first wave of requests, mostly to plants that mentioned "employee performance analytics" in their annual GDPR reports. This is no accident — that data was already with the regulator for years, now filtered through the AI Act lens.

What they check exactly — three documents in order of priority

Analysis of the first dozen requests shows the authorities focus on three specific documents. If your MES has any AI module influencing operators or classifying a medical/automotive product, prepare these three items before a potential request:

1. AI Risk Assessment under Article 27 of the AI Act. A document describing: system purpose, training and validation datasets, methods of testing for discrimination, monitoring plan in production, error-escalation procedure. Realistic length — 15 to 30 pages for a typical MES-AI module. The first three UODO requests rejected as insufficient any documents shorter than 8 pages ("methodology for validation on demographically balanced datasets missing").

2. Technical documentation compliant with Annex IV. System architecture description, design decisions, model versioning, training logs, end-of-training validation. An important detail — authorities expect a document that was created in parallel with the system's development, not written retroactively. File metadata, commit history in the repository, timestamps in logs — everything is verifiable.

3. Event log under Article 12. An automatic record of every AI system decision affecting a human: who was evaluated, what was the model's output, what action was taken (e.g. schedule change, bonus change, warning), who approved. Format — free, but must be reconstructable on demand for any period within a retention window of 6 months to two years (depending on class).

Practical observation from the first two weeks: documents 1 and 2 were reasonably prepared in about 40% of enquiries. Document 3 — almost nowhere. This will become the main reason for the first significant fines. If your MES does not have a dedicated AI decision log (separate from ordinary application logs), you have a real problem.

Where European plants stumble most often

Four patterns of mistakes repeat in the first requests:

Pattern 1: "we didn't know it was AI". A classical MES introduced five years ago with a "failure prediction" module (logistic regression on three variables). The team did not consider this AI and did not classify under the AI Act. The regulator disagrees — logistic regression meets the definition in Art. 3(1) AI Act if used in decisions affecting people (repair prioritization, resource allocation).

Consequence: the full high-risk obligations set, even though the system was treated as "just an algorithm". Realistic time to build documentation — 30 days, then sanctions.

Pattern 2: "it's a cloud API, not our problem". The plant sends operator data to an external provider (typically to analytical services in the US or Western EU) for "AI processing". The plant argues that it is only a deployer, so responsibility sits with the provider. The regulator reads the AI Act differently — a deployer of a high-risk system has its own set of obligations under Article 26, independent of what the provider does. In particular: a Fundamental Rights Impact Assessment (FRIA).

Three first UODO requests in this pattern — all about missing FRIA, all with a 14-day deadline.

Pattern 3: "the operator consented". The plant collected a consent form from operators "to processing of data by artificial intelligence systems". They think this settles the matter. It does not — Article 26(7) AI Act requires informing employees about the AI system before the start of use, but does not exempt anyone from documentation, risk assessment and logging obligations. Operator consent is not a legal basis, only an information requirement.

Pattern 4: "our MES-AI is only a suggestion for a human". The plant claims the system does not make automated decisions — it only suggests to an operator or a shift manager what to do. This is still high-risk AI if the suggestion realistically influences HR/production decisions. The Art. 6 criterion is "meaningful influence", not "final decision". Suggesting the order of compressor repairs — possibly out of scope. Suggesting bonuses for an operator — definitely in scope.

The actual stance of European regulators — first signals

From conversations with legal teams in the first half of August, several important signals emerge:

UODO is not applying a grace period. The head of the Digital Market Department in an interview on 12 August for Rzeczpospolita: "The AI Act was in the Official Journal in August 2024. Entities had two years. We are not planning grace periods for those who delayed". This is a signal of the caliber "serious talks are underway", not "representative policy".

UOKiK is preparing its first sanction decision for September. Unofficially — from conversations on the sidelines of the AI Governance conference in Warsaw on 10 August. The first public proceeding concerns a medical-device manufacturer, where an AI system classified defects without appropriate human-in-the-loop oversight. The size of the potential sanction has not been disclosed, but speculation points to the order of PLN 500k–2 million.

Critical-infrastructure regulators — other priorities. Cybersecurity (NIS2, KSC2) has priority. AI Act in the critical sector will probably see first proceedings only at the end of Q3. That is a window for energy, gas, water treatment, to finish documentation without heat.

Labour Inspection — an unofficial ally of the data-protection regulator. The Polish Labour Inspection helped UODO in several cases identify plants with AI performance monitoring, even though it does not itself have direct AI Act powers. This means plants with a history of disputes with the Labour Inspection are on a shorter monitoring list.

Three steps for the next 30 days

For plants that did not get a first-wave request — they will get one in the second or third wave (September–October). Three most important things to do within 30 days:

Step 1: internal audit of AI Act scope. Walk through every MES/EMS/SCADA/CMMS module and ask: does it influence decisions about people or about a regulated product (medical, automotive, machine safety)? If yes — it is in scope regardless of what you called the algorithm. Audit output — a one-page list of in-scope modules with Annex I vs Annex III classification.

Step 2: AI decision log. This is the most missing item in the first wave. Build a simple pipeline: every AI model decision affecting a human or a product written to a dedicated table (best in your TimescaleDB, with a 30-day chunk_time_interval). Minimum fields: timestamp, model_version, input_hash, output, action_taken, human_reviewer_id, review_timestamp. Retention: 2 years for high-risk.

Step 3: FRIA for systems influencing employees. A Fundamental Rights Impact Assessment — a document of 10 to 20 pages, describing how the AI system affects operators' fundamental rights. Templates are available from ENISA and EDPB, but they have to be adapted to MES specifics. Realistic preparation time — two weeks with a legal + product owner + AI engineer team. Without FRIA no UODO request will be closed positively.

What actually changed on 2 August

Nothing in the law. Everything in expectations.

Until 1 August the AI Act was treated like a distant threat. On 2 August it became a daily element of compliance-team work. The first three public sanction communications in September and October (because there will be some — regulators do not delay when they have two years of preparation behind them) will change the industry atmosphere definitively. By the end of Q4 every European production director who earlier heard "AI Act, maybe" will know that it is not optional.

For European plants that invested in compliance earlier, this is a window for competitive advantage. "AI Act-ready" plants win tenders today with large OEMs (VW, Mercedes, Stellantis), because these require compliance documentation from suppliers. Plants only starting now — have time until end of September to avoid the first sanction wave, but need to work weekly, not monthly.

If you have an MES with any AI module and these three documents (risk assessment, technical documentation, decision log) are not closed on your end — the next 30 days is the most important. Further requests are coming.

Sources