How this tracker is built

Three tiers, and every record is tagged with which one it is, because mixing them is how a tracker starts producing wrong headlines.

AI Act direct. An action taken under Regulation (EU) 2024/1689, or a published decision that expressly invokes one of its provisions. As of 20 August 2026 there are 1 of these and 0 of them are fines.

AI adjacent. An action under another regime, principally the GDPR or the Digital Services Act, whose subject is an AI system. This is the bulk of the dataset, because it is the bulk of what has actually happened.

Context. A complaint, a coordinated regulator position or a taskforce report that shapes enforcement without being enforcement. Context records are excluded from action counts.

No record is published without at least one named source. Primary sources are preferred and flagged as such: the authority's own decision or press release, the Official Journal, or a court judgment. 18 of 18 records carry at least one primary source. Where a decision is not published, a reputable secondary source is used and marked secondary, and the record says what is not confirmed.

A record whose amount, date or outcome cannot be verified is marked incomplete and excluded from every headline count until it is resolved. That flag exists so that a careful reader can tell the difference between what we know and what we have heard, which is the same distinction that made the CMS GDPR tracker the dataset academics chose.

The lesson of 2026 is that an announced European fine is not a fine until a court has finished with it. The Court of Rome annulled the Italian authority's 15 million euro decision against OpenAI in full on 18 March 2026, and that amount still appears as a live figure in reporting and in AI answers. Any tracker that counts headline amounts without tracking what happened next gets the story wrong.

So every record carries a status and an appeal field, every total on this site can be sliced by status, and annulled amounts are struck through and excluded. Today that means 80.91 million euro confirmed, 5 million euro under appeal and 15 million euro annulled.

A fine is not the only outcome and, under the AI Act, it may not be the most common one. Article 93 lets the Commission accept binding commitments through structured dialogue, which produces an outcome and no penalty. A tracker that counts only fines will report a quiet field while a great deal is happening.

Every record carries an identifier in the form AIT, the year of the action, and a four digit sequence. That identifier is permanent. It never changes and it is never reassigned to a different action, even if a record is later withdrawn. It appears in the URL, on the page, in the CSV and in the JSON, so a citation of AIT-2026-0003 resolves to the same action in five years.

Record URLs are clean paths, never query parameters. A citation that depends on a query string is a citation that breaks when the site is rebuilt.

Every Monday, and the same day for any action under Article 5 or Article 101 of the AI Act, any first of its kind measure, and any landmark appeal outcome.

The Monday pass runs a fixed checklist: the Commission's AI Act enforcement page and the AI Office, the AI Act Service Desk and its national resources page, the Official Journal, the EDPS and the EDPB national news feed, the Digital Services Act enforcement page, then the national market surveillance authority and data protection authority press pages, then Curia and the national administrative courts holding appeals on tracked records. Anything new is verified against a primary source before it is published, and every existing record has its verification date stamped even when nothing changed.

A week with no new action still produces a changelog entry. Dated silence is a finding: "as of this date, no fine has been issued under the AI Act" is the most quoted sentence on this tracker and it needs a date behind it.

Counts are a floor, not a ceiling. European authorities publish on their own timetable, some decisions are never announced, and several publish only in their national language. A count of 18 means we have verified 18, not that 18 is all there is.

A fine is not a payment. Three authorities have fined the same company for facial recognition and none has publicly confirmed collection. The tracker records what was imposed, not what was paid.

An adjacent action is not an AI Act action. Most of this dataset is GDPR enforcement against AI systems. It is on the tracker because it is what the AI Act era inherited, and it is tagged so that nobody can read it as something it is not.

Nothing here is legal advice or a prediction. Where the page says an outcome is expected, it says so and labels it as an expectation.

A missing action, a wrong amount, an appeal we have not picked up: all of it is a bug and we want it. Corrections are made with a dated changelog entry naming what changed, so the record of the record is public too. Send a correction, or read every change made so far.

The dataset is published as JSON, CSV and an Atom feed, licensed CC BY 4.0. Check our working.