{"id":20739,"date":"2026-06-17T08:57:06","date_gmt":"2026-06-17T08:57:06","guid":{"rendered":"https:\/\/letslaw.es\/?p=20739"},"modified":"2026-06-17T08:57:35","modified_gmt":"2026-06-17T08:57:35","slug":"fines-uncontrolled-ai-use","status":"publish","type":"post","link":"https:\/\/letslaw.es\/en\/fines-uncontrolled-ai-use\/","title":{"rendered":"Fines of up to \u20ac35 million for uncontrolled AI use: what your company must do before August 2026"},"content":{"rendered":"

Artificial intelligence is already part of the day-to-day operations of many companies: text generation tools, data analysis, process automation, customer scoring, recruitment systems, chatbots, recommendation engines and predictive marketing solutions. However, what many businesses have so far treated as a purely technological issue is quickly becoming a legal priority.<\/p>\n

The European Artificial Intelligence Regulation, known as the AI Act, establishes a new mandatory framework for companies that develop, market or use AI systems in the European Union. Its message is clear: using artificial intelligence without control, documentation or supervision may have very significant consequences.<\/p>\n

The AI Act and penalties for non-compliance<\/h2>\n

The new AI Regulation<\/a> introduces a particularly strict sanctions regime. The most serious infringements, linked to the use of prohibited artificial intelligence practices, may lead to fines of up to \u20ac35 million or up to 7% of the company’s total worldwide annual turnover, whichever is higher.<\/p>\n

In addition, other breaches related to high-risk AI systems, transparency obligations, documentation, governance or the provision of incorrect information to authorities may also result in multimillion-euro fines.<\/p>\n

Therefore, the key question is no longer whether a company can use AI, but how it must do so in order to comply with the law.<\/p>\n

August 2026: a key date for companies<\/h2>\n

Although the AI Act is already in force, many of its obligations will apply progressively. August 2026 will be a particularly important date, as a significant part of the general obligations applicable to artificial intelligence systems will begin to apply from that moment.<\/p>\n

This means that companies should not wait until the last minute. Adapting to the AI Regulation requires reviewing tools, contracts, providers, internal workflows, usage policies, human oversight measures, technical documentation and potential impacts on fundamental rights.<\/p>\n

In practice, many companies are already using AI without having carried out even a basic inventory of their tools, without knowing what data is entered into them, without checking whether international transfers take place, without analysing data protection risks and without regulating internally who may use these systems and for what purposes.<\/p>\n

What companies should do before August 2026<\/h2>\n

The first step is to carry out an internal mapping of AI uses. Companies must identify which tools are being used, by which departments, for what purposes, what data is processed, who the provider is and whether the system may affect clients, employees, candidates, consumers or users.<\/p>\n

The second step is to classify AI systems according to their level of risk. Using a tool to assist with internal text drafting is not the same as using an automated system to select candidates, assess creditworthiness, profile consumers or make decisions that may significantly affect individuals.<\/p>\n

The third step is to review the legal and contractual documentation. It is necessary to check terms of use, provider agreements, data protection clauses, confidentiality guarantees, intellectual property rights, liability, security and the use of information entered into the system.<\/p>\n

The fourth step is to approve an internal AI usage policy<\/a>. This policy should specify which tools are authorised, which uses are prohibited, what data must not be entered, what controls must be applied and when the legal or compliance team must be involved.<\/p>\n

AI, data protection and digital law: a combined legal analysis<\/h2>\n

One of the most common mistakes is to analyse artificial intelligence only from a technological perspective. In reality, many AI uses directly affect data protection, intellectual property, consumer law, advertising, contracts, confidentiality, cybersecurity and corporate liability.<\/p>\n

For example, entering clients’ personal data into an AI tool without reviewing the provider’s terms may result in a GDPR breach. Using AI to generate commercial content may create risks relating to misleading advertising or intellectual property. Automating decisions about individuals may require transparency, human oversight and a prior impact assessment.<\/p>\n

Legal advice on artificial intelligence for companies<\/h2>\n

At Letslaw, we help companies prepare for the new regulatory framework on artificial intelligence, combining our experience in digital law, data protection, technology, commercial contracts, intellectual property and regulatory compliance.<\/p>\n

Our services include the legal review of AI tools, the preparation of internal AI usage policies, risk analysis, contractual adaptation, review of technology providers, compliance with the AI Act and coordination with GDPR obligations.<\/p>\n

Artificial intelligence can be a major opportunity for companies, but only if it is used with control, legal oversight and an appropriate compliance strategy. August 2026 is closer than it seems. Companies that start preparing now will be ready; those that wait will assume unnecessary risks.<\/p>\n

Contact Us<\/h2>\n
\n

<\/p>

    <\/ul><\/div>\n
    \n
    \n<\/fieldset>\n
    <\/span><\/div>\n
    <\/span><\/div>\n
    <\/span><\/div>\n
    <\/span><\/div>\n