Why AI Projects Stall in Europe: Lessons from Fines, Rulings and Regulator Decisions

Most AI projects in European companies don't stall because the model isn't good enough. They stall in a meeting with legal, risk, procurement or the data protection officer, when nobody can answer a simple question: if a regulator asked us to defend this, could we?

AI governance is the work of being able to say yes. It sounds like an engineering topic, but most of it isn't. It's knowing which rules apply, writing down what the system does, deciding who checks its output, and asking your vendors the right questions. All of that is work a manager, a lawyer or an operations lead can own.

The fastest way to understand what regulators expect from AI is to look at what they have actually done: the fines, the court rulings and the guidance.

So we built a tracker of exactly that. This article walks through what it shows, in plain language, and ends with a checklist you can use before your next AI rollout.

The EU AI Compliance Tracker

The EU AI Compliance Tracker is an open, source-linked dataset of 23 fines, court rulings, regulator orders, guidance papers and laws from 2020 to 2026. It covers the EU, the Netherlands, Italy, Germany, Ireland, Norway, Luxembourg and Switzerland, with one US case for context.

Every entry has a factual summary, a link to at least one source, the date it was checked, and a lesson: what a company deploying AI should take from it. Entries are tagged by regulation (GDPR, the AI Act, DORA and others), by type of failure (no legal basis, lack of explanation, bias, hallucination, data location and so on) and by how relevant they are to financial services.

New entries are drafted with Claude from a source text, checked against the tracker's taxonomy, and reviewed by a person before they're added. The model drafts; a human decides. You can browse and filter every entry, read the one-page summary or suggest a correction on GitHub.

What the cases show: six things that block AI projects

1. "The AI only assists" doesn't hold up

In SCHUFA (2023), the EU's top court ruled that a credit score can count as the automated decision itself when a lender relies on it heavily, even if a person formally makes the final call. In Dun & Bradstreet Austria (2025), it added that people refused by an automated credit check are entitled to an explanation they can understand and challenge. Handing over the algorithm isn't enough, and "it's a trade secret" isn't a defence.

In practice: if AI shapes a decision about a person (credit, hiring, onboarding, fraud), build a real human review step, and make sure the system can give reasons a customer could contest.

2. Your AI vendor is an outsourcing relationship

Since 17 January 2025, DORA requires EU financial firms to keep a register of their technology contracts, include mandatory contract clauses and exit plans, and report major incidents. An AI model provider is one of those technology providers. Switzerland's FINMA and Luxembourg's CSSF and BCL point the same way: keep an inventory of AI systems, classify their risk, and treat AI risk as operational risk, including for tools you buy.

In practice: keep a list of every AI tool in use, who owns it and what it's used for. Treat an AI contract like any other critical supplier: audit rights, an exit plan and incident timelines.

3. Where the training data came from becomes your problem

The European Data Protection Board's Opinion 28/2024 says a company using an AI model can be affected if that model was trained on unlawfully processed data. Regulators have acted on training data at OpenAI (a €15M fine in Italy, suspended pending appeal), Clearview AI (€30.5M in the Netherlands) and X's Grok (an inquiry in Ireland). Outside the EU, the Bartz v. Anthropic settlement put a US$1.5B price on pirated training books.

In practice: ask every AI vendor, in writing, what their model was trained on, on what legal basis, and whether your data is ever used for training.

4. A hallucination about a person is a privacy issue

In a complaint filed in Norway, ChatGPT had falsely described a man as a convicted child murderer, mixed in with real details of his life. The complaint argues this breaches GDPR's accuracy principle, and that a "may contain mistakes" disclaimer doesn't fix it.

In practice: anything AI writes about a real customer or employee (a summary, a memo, a report) should be grounded in source documents, show where facts came from, and be signed off by a person before it becomes a record.

5. Where data is stored can end a project overnight

In January 2025, Italy's data protection authority ordered DeepSeek to stop processing Italian users' data within days, after the company gave "totally insufficient" answers about what it collects, why, and whether data is stored in China.

In practice: know where your AI tool stores data, for how long, which sub-processors it uses and how data leaves the EU, before you sign, not after.

6. The AI Act deadline moved, the work didn't

The Digital Omnibus pushed the AI Act's high-risk obligations, including credit scoring and life and health insurance pricing, from August 2026 to 2 December 2027. The requirements themselves didn't change. The good news: the European Banking Authority found no real conflict between the AI Act and existing banking law, so firms can build on the risk frameworks they already have.

In practice: check each AI use case against the AI Act's high-risk list now. Most assistants, search and drafting tools aren't high-risk. Anything that scores people for credit or insurance is.

Where the Digital Services Act fits

The Digital Services Act (DSA) isn't an AI law. It regulates online services that carry other people's content or help people find it: platforms, marketplaces, app stores and search engines. It has applied to all of them since 17 February 2024. The largest, with more than 45 million users in the EU, are designated “very large” and must assess and reduce the risks their service and its algorithms create, from illegal content to harm to minors and elections. Fines can reach 6% of global turnover.

AI is now squarely inside it. Three steps by the European Commission show how:

• The first fine, 5 December 2025. The Commission fined X €120M for a misleading paid “blue checkmark”, an incomplete advertising repository and blocking researchers' access to data. It isn't an AI case, but it proved the Commission will use the law.
• Grok, 26 January 2026. The Commission opened an investigation into whether X assessed and reduced the risks of putting its Grok AI features into X, including manipulated sexually explicit images, and whether it should have sent a risk assessment before launch. It also widened an existing probe to cover X's switch to a Grok-based recommendation system.
• ChatGPT, 31 August 2026. The Commission designated ChatGPT a very large online search engine, alongside Google Search and Bing, because it answers questions by searching the web. OpenAI must meet the extra obligations, including risk assessments and independent audits, by January 2027.

In practice: if your business runs a platform, marketplace or search feature and adds AI to it (AI recommendations, AI-generated content, AI answers), the DSA applies to that feature. Be ready to explain how recommendations work, handle reports of illegal content, and assess the risks before launch, not after. If you only use AI tools internally, the DSA doesn't apply to you directly, but the biggest tools you buy are now supervised under it, which gives you more published evidence to ask for.

All three are now in the tracker, tagged under the DSA.

The dates that matter

Date	What applies	Who it affects
17 Feb 2024	Digital Services Act applies to all platforms, marketplaces and search engines	Online services that host or find content, including their AI features
17 Jan 2025	DORA: technology-supplier registers, contract clauses, incident reporting	EU banks, insurers, funds, payment firms
2 Feb 2025	AI Act bans on prohibited practices; duty to train staff in AI literacy	Every company using AI in the EU
2 Aug 2025	Obligations for general-purpose model providers (documentation, training-data summary)	Model providers; useful evidence for their customers
2 Aug 2026	AI Office can fine general-purpose model providers	Model providers
Jan 2027	ChatGPT must meet the DSA duties for very large search engines	OpenAI; useful evidence for ChatGPT customers
2 Dec 2027	High-risk duties (e.g. credit scoring, insurance pricing)	Anyone using AI to score or decide about people

One duty is easy to miss: AI literacy has been a legal requirement since February 2025. If your teams use AI tools, training them is already part of compliance.

A checklist before your next AI rollout

You don't need to read a model's code to govern it. Before you roll out an AI tool, make sure you can answer these in writing:

1. What is it for? Write down the use case, who uses it, and which decisions it influences.
2. Is it high-risk? Does it score, rank or decide about people (credit, hiring, insurance, benefits)? If so, plan for the December 2027 duties now.
3. Does it show content to the public? If AI recommends, generates or ranks content on a platform, marketplace or search feature you run, the Digital Services Act applies to it.
4. Who checks the output? Name the person who reviews it, and make sure they can actually overrule it.
5. Can we explain a decision? Could you tell an affected customer why, in words they'd understand?
6. What data goes in, and where does it go? Storage location, retention, sub-processors, transfers outside the EU.
7. What was the model trained on? Get the vendor's answer in writing, including whether your data is used for training.
8. What if the vendor fails? Contract clauses, audit rights, an exit plan, incident timelines.
9. Has it been tested for bias and accuracy? Keep the results.
10. Are people trained? AI literacy is already a legal duty.
11. Is it on the list? Add it to your AI inventory with an owner and a review date.

Most of these are answered with evidence, not more model capability. That's the real lesson of the tracker: the projects that make it to production are the ones that show up to the compliance meeting with the paperwork already done.

This article summarises public sources as checked on 26 October 2026 and isn't legal advice. Statuses can change after appeals; read the primary text before relying on any entry.