GDPR takes effect (2018)
The EU's General Data Protection Regulation began applying across the bloc after a two-year grace period. It set fines up to 4% of global revenue and forced companies worldwide to change how they handle personal data.
Firms rushed to add consent banners and privacy notices, and early enforcement was slow as regulators staffed up.
GDPR became a global template; several countries copied it, and large fines against US tech firms followed years later.
The AI Act follows the same playbook: a grace period, revenue-based fines, and reach far beyond Europe's borders. GDPR's slow start also hints at how AI enforcement may open.
