EU AI Act First Enforcement Actions — Spain Fines Insurer, Italy Investigates Bank

The EU's landmark AI regulation moved from theory to practice with its first real enforcement actions. Spain's data protection authority fined an insurance company 200,000 euros for using biometric data to profile customers without proper legal basis — one of the practices the AI Act explicitly targets. In Italy, the privacy regulator opened a formal investigation into a major bank's use of AI to decide whether to approve or reject loan applications, raising concerns about transparency and discrimination. These are the first cases where regulators are actually acting under the new rules, not just warning companies. For businesses across Europe, it sent a clear signal: the era of deploying AI systems without legal documentation and impact assessments is over. Legal and compliance teams began urgent reviews of their AI inventories and use cases.