For the past two years, compliance teams in financial services, insurance, and healthcare have been preparing for EU AI Act enforcement by doing what compliance teams do: writing policies, classifying systems, appointing AI officers, and assembling documentation. That work was necessary. It was also, as of August 2, 2026, no longer sufficient.
High-risk AI provisions are now enforceable. That means a regulator can walk into an audit and ask not what your policy says, but what your system actually did — on a specific inference, at a specific moment, with specific data. The question has changed from "do you have governance?" to "can you prove it ran?"
What enforcement changes about the question
The pre-enforcement posture was essentially documentation-based. You showed that you had a risk management system in place, a human oversight process on paper, and a data governance framework that addressed the right concerns. Auditors reviewed artifacts.
Runtime enforcement is different. The audit target is a decision — a credit denial, a claims adjudication, a patient risk score — and the question is whether governance was active when that decision was produced. Not whether governance was designed into the system. Whether it ran.
That distinction matters enormously for agentic AI. An agent doesn't produce a single output from a single input. It retrieves context, reasons across multiple sources, calls tools, and generates outputs — sometimes in a single session that touches a dozen data sources and executes several actions. The governance question isn't just "was this model approved?" It's "what data entered this agent's context, under what policy, and was that policy enforced at the moment of retrieval?"
A policy document that describes your data access rules is not evidence that those rules ran. A tamper-evident log of every retrieval decision — what was permitted, what was denied, which policy resolved it, at what time — is. Those are different artifacts, and only one of them answers a runtime enforcement question.
Where Gartner's AI TRiSM framing is useful here
Gartner's AI Trust, Risk, and Security Management framework identifies enforcement as the category gap — the thing that separates organizations that have AI governance from organizations that can demonstrate it. The framing is accurate. Most enterprise AI governance today lives in the first two layers: model selection and validation, and policy design. Enforcement — the runtime layer that actually applies policy to a live inference — is where the market is thin.
The reason is architectural. Governance was grafted onto AI stacks after the fact, not built into the retrieval path. You can have a detailed policy for which data a credit-underwriting agent is allowed to see, but if that policy isn't evaluated at the moment the agent queries a data source, it isn't enforcement. It's intention.
The EU AI Act's enforcement mechanism — national market surveillance authorities with investigative powers, access to technical documentation, and the ability to require corrective action — is designed to expose exactly that gap. An authority that can audit a live system will find, quickly, whether governance is enforced or merely described.
What "runtime enforcement" actually requires
Three things have to be true for a governance claim to survive a runtime audit.
Policy evaluation happens before the data reaches the model. This is the hard part for most stacks. If your agent retrieves data and then a separate process checks whether it should have, you don't have enforcement — you have detection after the fact. The policy gate has to sit between the data source and the context window, not downstream of it.
Every decision is logged with enough detail to reconstruct it. Not just "retrieval occurred." The log needs to show which resource was requested, which principal made the request, which policy resolved the decision, whether the result was permit or deny, and the timestamp. That's what a reconstructable audit trail looks like. Anything less is a log of events, not a record of governance.
The log is tamper-evident. A log you can modify after the fact isn't evidence. High-risk AI systems under the EU AI Act need to be able to demonstrate that their audit records reflect what actually happened, not what was written into the record later. That's a specific technical requirement, not a documentation one.
AutoPIL evaluates every retrieval request against access policy before data enters the agent's context window. Each decision — permit or deny — is logged with the resource, principal, policy, action type, and timestamp. The log is append-only and tamper-evident. That's the artifact that answers a runtime enforcement question.
The high-risk categories where this is immediate
The Act's high-risk classification covers a set of use cases that maps almost exactly to where financial services, insurance, and healthcare are currently deploying agentic AI: creditworthiness assessment, insurance risk scoring, employment decisions, access to essential services. These aren't edge cases or future use cases. They're live deployments running now.
For a credit-underwriting agent, runtime enforcement means the policy that governs which applicant data the agent can retrieve is evaluated on every retrieval — not assumed to be correct because the system was configured correctly at deployment. Configuration drifts. Agents are re-prompted. Tools get added to harnesses without full policy review. Runtime enforcement is what catches the gap between intended policy and actual behavior.
For a claims-adjudication agent in insurance, it means the retrieval of medical records, prior claims history, and policy terms is each evaluated against the access policy in effect for that claimant, at that moment, for that agent role. Not governed in aggregate. Governed per retrieval.
The documentation question hasn't gone away
Nothing about runtime enforcement makes pre-enforcement documentation work irrelevant. You still need your risk classification, your human oversight design, your data governance framework. The Act requires all of it.
What changes is that documentation now needs to be backed by evidence that the system described in those documents is the system that actually ran. That evidence is a runtime audit trail. The two things together — policy documentation and enforcement logs — are what a defensible response to a high-risk AI audit looks like in September 2026.
Teams that treated documentation as the finish line now have more work to do. The good news is that the architecture for runtime enforcement isn't complicated. It requires putting the policy gate in the right place — before retrieval, not after — and building a log that captures the right dimensions. The work is real, but it's well-defined.
Anil Solleti is the founder of AutoPIL, a governance-first agentic AI platform for regulated enterprises, and a partner at VibrantCapital.ai.