Compliance Costs Rise: KSeF, AI Act, NIS2 Penalties Start Now.
Pedro's Take
This week confirms what I have seen repeatedly: regulatory grace periods always end. The fines are no longer a distant threat; they are now an operational reality across KSeF, the AI Act, and NIS2. Businesses that postponed basic compliance checks will find this an expensive quarter. Signal: The Ministry of Finance confirmed KSeF invoicing errors can be fined up to 100% of VAT starting 1 January 2027. Every VAT-registered company issuing e-invoices through KSeF faces significant penalties for mistakes, with no further grace period coming. Signal: Brussels began enforcing the EU AI Act's transparency rules on 2 August 2026, with fines up to 15 million euro now on the table. Any European business using customer-facing AI tools must now clearly disclose this or face substantial financial penalties. Signal: Companies covered by Poland's NIS2 cybersecurity law have until 3 October 2026 to self-assess and register, with fines up to EUR 10 million for non-compliance. Many new sectors, from manufacturing to food production, must now actively assess their cybersecurity posture and register or face severe fines. These are not isolated incidents; they are the new operating baseline for European businesses.
The Week's Theme
This week's signals show a clear pattern: the grace periods are ending. From KSeF invoicing to AI Act transparency, regulators are now enforcing rules with significant penalties. Businesses must treat operational compliance as seriously as market strategy, because the cost of error is no longer theoretical. Ignoring the basics will cost you.