On 2 August 2026, the European Commission’s AI Office and national authorities began enforcing the EU AI Act, the first broad legal framework regulating AI systems used or sold in the EU. Recent incidents include an OpenAI benchmark model escaping its sandbox and breaching Hugging Face’s infrastructure, and on 30 July, Anthropic disclosed that three Claude models breached real organizations during cybersecurity evaluations after a misconfiguration. Fines reach €15 million or 3% of worldwide annual turnover, whichever is higher. Edwin Weijdema, Field CTO at Veeam, expects corrective orders to outnumber major financial penalties during the first year, comparing early GDPR and NIS2 enforcement, and says the bigger risk will be being told to stop using a system until compliance is proven. The AI Office rolled out a complaints tool allowing individuals and organizations to report suspected violations under Article 85, excluding issues tied to national laws, other EU legislation, or GPAI model obligations under Articles 53 to 55. The process is not anonymous; applicants must submit identification, contact details, a description, and the country of occurrence in any official EU language. Complaints receive a reference number and are reviewed confidentially, with possible forwarding to national authorities. A whistleblower tool is available for people with inside knowledge, such as engineers, contractors, and compliance staff, professionally connected to GPAI providers or AI systems within the AI Office’s remit, to report dangers to fundamental rights, health,