Two Regulators, One Exposure: AI Act Enforcement Lands on Top of GDPR

Week of 10 August 2026 | Compiled by Team Paringa

From 2 August, AI Act enforcement and GDPR enforcement run concurrently - and both start from the same root question: why does this system hold identifiable data it doesn't need.

SECTION 1 - What Happened This Week

🔴 EU AI Act high-risk enforcement goes live - second penalty layer now active

The European Commission began enforcing the AI Act's rules for general-purpose AI models and new transparency requirements on 2 August 2026. The AI Office can now issue fines against GPAI providers of up to €15 million or 3% of global annual turnover, whichever is higher. For prohibited practices and broader high-risk system violations, penalties run from €7.5 million to €35 million, or 1% to 7% of global turnover - whichever is higher.

This isn't a replacement for GDPR exposure, it's an addition to it. Any organisation running AI systems on personal data now has two regulators who can independently fine the same underlying failure: one for how the data was processed (GDPR), one for how the AI system that touched it was governed (AI Act). National market surveillance authorities can investigate AI-based systems directly, and the AI Office can demand technical documentation and risk-mitigation measures from GPAI providers with immediate effect.

For any business feeding customer or employee PII into AI pipelines - support copilots, underwriting models, HR screening tools - 2 August is the date the compliance maths changed. A single incident involving personal data processed by an AI system can now trigger two separate penalty calculations against the same event.

Sources: Commission starts enforcing AI Act rules - Shaping Europe's Digital Future, EU AI Act Enforcement: What Changes on 2 August 2026 - Belitsoft

Anyone who spent 2026 building AI features and treating data governance as a GDPR-only problem has a gap. The fix isn't a second compliance programme - it's removing identifiable data from the pipeline before it reaches the model, so neither regulator has a live PII exposure to fine. That's the Skyflow pitch in one sentence: tokenise at ingestion, and both penalty layers stop applying to the same event.

🟡 CNIL's €42m Free Mobile fine - retention, not just breach, was the violation

On 13 January 2026, France's CNIL fined Free Mobile €27 million and Free €15 million following an October 2024 breach that exposed data on 24 million subscriber contracts, including IBANs. The fines cite three separate GDPR failures: inadequate security measures, poor breach communication to affected subscribers, and - notably - unlawful retention. Free Mobile was found to have kept millions of former subscribers' records indefinitely with no justification, a direct Article 5(1)(e) violation.

The retention finding is the part worth flagging. This wasn't just "you got breached" - it was "you were holding data you had no business still holding, in a form that was directly exploitable once the attacker got in." Tokenised or pseudonymised records reduce that exposure even when retention is longer than ideal, because the stolen token has no standalone value.

Sources: CNIL: Data breach, FREE MOBILE and FREE fined €42 million, The Register - France fines telcos €42M

This is a live case study for any prospect still storing raw IBANs, national IDs, or account numbers in production databases "just in case." The commercial argument writes itself: a €42m fine happened because stale, identifiable data sat in a system longer than it needed to. Tokenisation doesn't fix bad retention policy, but it defangs the consequence when retention policy inevitably fails.

SECTION 2 - What Compliance and Data Leaders Are Dealing With

Two regulatory clocks are now running on the same underlying data estate. GDPR enforcement hasn't slowed - over €600 million in fines already landed in H1 2026, on top of a cumulative €7.1 billion since 2018 - and daily breach notifications are running above 443 for the first time since 2018. Layer AI Act enforcement on top and the practical effect is that "where does identifiable data live, and does an AI system touch it" has become the single most consequential architecture question a compliance or data team can answer. Organisations that already de-identify at the point of capture are, functionally, insulated from a large share of both regimes' worst-case penalties.

Three Things Worth Watching Next Week

1. First AI Act enforcement actions - Watch for the AI Office's first formal requests for GPAI technical documentation now that enforcement power is live; early targets will set the tone for how aggressively this gets applied.

2. National surveillance authority activity - EU member state regulators now have standing to investigate AI systems directly; expect the first wave of national-level AI Act investigations to surface within weeks.

3. Further CNIL/ICO retention-focused fines - The Free Mobile precedent (retention as a standalone violation, not just breach response) is likely to be cited in upcoming enforcement actions across other regulators.

Questions? hello@paringa.ai

Paringa pairs Skyflow's data tokenisation with governance frameworks that keep clients ahead of both GDPR and AI Act enforcement - not scrambling to catch up after the next fine lands. | 10 August 2026 | © Paringa Ltd