The enforcement of policies is done in the systems using these certificates for authentication or similar, i.e. web browser, mobile apps, mail clients (S/MIME), IPSec peers, ... . There are a few policies which are clearly defined in the standards and which are usually implemented in all of the systems dealing with X509 certificates (i.e. things like expiration, key usage...).
Any uncommon and/or vendor specific policies will likely not be supported universally. They might be supported for a specific use case (i.e. authentication in HTTPS) or in some vendor specific environments but not everywhere.
X509 has a way to mark extensions as required though and a client which does not understand a specific extension still knows if the understanding of a extension is required or not. This means that a standard-conforming client which does not understand a specific required extension will treat the certificate as invalid. If the extension instead is not marked as required then the client can simply ignore such an unknown extension.