Dual Enforcement Is Here: GDPR and the EU AI Act Now Bite Together

Week of 24 August 2026 | Compiled by Team Paringa

The EU AI Act's enforcement machinery is no longer theoretical — the AI Office and Member State regulators now hold live powers over GPAI providers, and they sit on top of an unchanged GDPR regime that never went away.

What Happened This Week

🔴 EU AI Act enforcement powers go live — and stack on GDPR, not replace it

For any organisation running LLMs against customer or employee data, this is the moment the compliance maths changed. The EDPB's prior guidance already established that most large language models don't meet the anonymisation bar, meaning controllers deploying third-party LLMs need documented legitimate-interest assessments just to stay on the GDPR side of the line. Layer AI Act transparency and data-governance obligations (Article 10: representative, bias-mitigated training data; technical documentation; human oversight; logging) on top, and the two regimes now demand the same underlying discipline — know what personal data enters the model, and be able to prove it.

The practical failure mode is the same one Skyflow's tokenisation architecture is built to close: raw PII sitting inside prompts, training pipelines, or vector stores that a regulator can now audit under two separate legal bases at once.

Sources: European Commission — Safer and more transparent AI, heyData — Double Fines in 2026: When GDPR and the EU AI Act Strike Together

This is the exact scenario Track A layer 3 (PROTECT) exists for. Clients running AI on customer data now face two regulators, two fine schedules, one root cause: PII in the wrong place. Tokenising before data reaches the model isn't a nice-to-have anymore — it's the difference between one exposure and a double fine. Worth a direct line into any prospect's AI roadmap conversation this week.

🟡 ICO's first data-minimisation-and-privacy-by-design fine lands — architecture is now the audit target

The signal for enterprise buyers: regulators are shifting from "did you report the breach in 72 hours" to "did your system architecture make over-collection possible in the first place." That's a design question, not a process one — and it's one most organisations can't currently answer for their AI pipelines.

Sources: ICO — Police Scotland fined £66k and reprimanded following serious data mishandling, The Register — Police Scotland fined for mishandling victim data

Data minimisation-by-design is precisely what pseudonymisation architecture demonstrates to a regulator — you physically cannot over-collect what you've already tokenised at ingestion. This is a good case study to reference when a prospect says "we already have a privacy policy" — policies don't pass this test, architecture does.

What Security and Compliance Leaders Are Dealing With

CISOs and DPOs are now managing two enforcement regimes that share a root cause but different penalty structures, different regulators, and different documentation requirements. Most organisations built their GDPR compliance programme around consent and breach notification — not around proving, on demand, what personal data entered a specific AI model and why. The EDPB's position that LLMs rarely anonymise data means "we used a third-party model" is no longer a defensible answer on its own; it needs a paper trail showing what was tokenised, pseudonymised, or excluded before the prompt left the building.

Three Things Worth Watching Next Week

1. First joint GDPR/AI Act enforcement action - Watch for the first case where a DPA and the AI Office coordinate on a single organisation; legal commentary expects this within the quarter given the overlapping powers now live.

2. ICO guidance on automated decision-making in recruitment - Consultation closed in May; finalised guidance expected to set the template for how "privacy by design" gets audited in AI-driven HR tools.

3. GPAI providers' technical documentation requests - The AI Office can now compel documentation and model evaluation; the first requests will show how aggressively enforcement actually moves in practice.

Questions? hello@paringa.ai

Paringa pairs Skyflow's PII tokenisation with governance advisory to put a defensible architecture between client data and the regulators now enforcing two overlapping regimes at once. | 24 August 2026 | © Paringa Ltd