A growing number of U.S. companies, including Meta Platforms, Adobe, Airbnb, Lyft, and Mastercard, are alerting investors to potential risks associated with the European Union's Artificial Intelligence Act (AI Act).

In their recent 10-K filings with the U.S. Securities and Exchange Commission, these companies have cited concerns about substantial compliance costs and operational challenges posed by the new regulations. The AI Act, which came into force in August 2024, establishes a comprehensive legal framework for AI systems within the EU. It adopts a risk-based approach, categorizing AI systems based on their potential to cause harm. Certain high-risk applications are subject to stringent requirements, while the most hazardous uses are outright banned.

Companies like Airbnb have expressed that such regulations "may impact our ability to use, procure, and commercialize" AI and machine learning tools in the future. Similarly, Gartner noted that complying with the AI Act "may impose significant costs on our business."

Non-compliance with the AI Act carries substantial penalties. Violations related to prohibited AI practices can result in fines of up to €35 million or 7% of a company's total worldwide annual turnover, whichever is higher. Other infringements may lead to fines of up to €15 million or 3% of global turnover.

The enforcement of the AI Act involves multiple authorities. National market surveillance authorities are primarily responsible for compliance investigations and enforcement actions. Additionally, the European Commission has established an AI Office with exclusive jurisdiction over general-purpose AI models, equipped with investigative and corrective powers, including the ability to impose fines.

The ambiguity surrounding certain provisions of the AI Act adds to corporate concerns. Companies may need to consult various EU legislations to determine if their AI systems fall into the "high-risk" category, potentially complicating compliance strategies. The EU is working on supplemental guidelines to clarify enforcement expectations, but businesses remain wary of the regulatory uncertainty.

As more companies acknowledge AI-related risks in their filings, industry observers expect further disclosures and investor scrutiny on AI governance. "It will drive investor questioning around, ‘Well, what’s your response to the AI Act? Who is accountable in the organization?’" said Joe Jones, director of research and insights at the International Association of Privacy Professionals.

With significant financial and operational stakes at play, businesses operating in the EU market will need to navigate evolving compliance obligations carefully.