Enforcement runs through national authorities in each member state, coordinated by a European-level AI Office and board. They can investigate, require corrective action and impose fines that scale with the severity of the breach and the size of the company. The rules apply on a phased timeline, so obligations take effect in stages.
