EU AI Act consultant cost and what they do

What an EU AI Act consultant costs and who pays for what

The Commission's impact assessment estimated compliance for a high-risk AI system at around EUR 6,000 to 7,000 by 2025, about two thirds of a roughly EUR 10,000 maximum for companies following standard business procedures. Consultant fees come on top of that figure, and the Commission does not publish them, so any budget you set needs a written quote behind it. The estimate also assumes work companies would do anyway, which is why your own starting point matters more than the headline number.

Three factors move your number most: how many of your AI systems fall into the high-risk categories, how mature your existing technical documentation and logging already are, and whether any system needs a notified body. A single system with clean documentation costs far less to prepare than several systems that share no records. Ask a consultant to price each system separately, and to state which tasks are one-time (inventory, classification, first technical file, QMS design) and which recur (post-market monitoring, change control, periodic review, staff AI literacy training).

Be exact about who pays for what. Your organization owns its controls, and the consultant prepares systems, documents and evidence on your behalf. Only an independent body issues an assessment result or certificate, so no consultant fee buys a compliance finding. Ask each bidder to list deliverables, the people doing the work, what they assume about your existing records, and what is excluded, such as notified body fees or translation. Confirm the current provisions for SMEs, including reduced conformity assessment fees under Article 62(2), in the official Commission guidance before you negotiate.

Cost components: who is paid for what

This table separates the AI Act cost components by the party paid for each, whether the cost is one-time or recurring, and what moves it up or down. The Commission figures below are estimates from the 2021 impact assessment (SWD(2021) 84 final), not quotes, and they cover only part of the work, so use them as a reference point when you compare written proposals.

Cost component	Who is paid	One-time or recurring	What drives the cost
Inventory and risk classification	Implementation partner or consultant, or internal staff	One-time, then recurring as new systems appear	Number of AI systems, how many are embedded in products, and how much of the classification work already exists
Technical documentation and record keeping	Internal engineering time, with consultant support for templates and review	One-time per system, with updates after each substantial change	System complexity, number of versions, and whether a simplified form is available to SMEs and small mid-caps under Article 11(1)
Quality management system build	Implementation partner for design, internal staff for operation	One-time build, recurring operation and audits	Existing ISO-style management systems, number of teams involved, and whether harmonised standard EN 18286:2026 is adopted
Deployer processes (human oversight, monitoring, logs)	Internal staff (oversight roles), partner for process design	Recurring. The 2021 impact assessment estimated EUR 5,000 to 8,000 per year, around 0.1 of a full-time employee	Number of high-risk systems in use, staff training, and how much monitoring is automated
Notified body assessment (where required)	Notified body, paid directly by the provider	One-time certification, with recurring surveillance and re-assessment	Only applies to certain biometric systems and Annex I products. Confirm fees and scope in writing, and ask about SME reductions under Article 62(2)
Tooling and self-hosted evidence platforms	Software licensing, hosting, or internal platform team	Mostly recurring (hosting, support, upgrades), with some setup cost	Logging volume, retention needs, and whether tools are open source or commercial. Confirm license terms and edition limits
Regulatory sandbox and training	Sandbox access is free for SMEs under Article 58(2)(d); training is paid to the provider	One-time for most training, recurring for refreshers	Team size, role-based content, and whether training is delivered internally or by a partner
Commission compliance estimate (reference only)	Not a single payment; the 2021 estimate covered data, documentation and information duties	One-time per high-risk system, estimated at EUR 6,000 to 7,000 by 2025	Estimate covers maximum fixed costs of about EUR 10,000 for standard procedures, with about two thirds attributed to work companies would do anyway

What makes AI Act compliance more or less expensive

The cost of AI Act compliance depends less on the rulebook than on the size and shape of your own AI estate. The drivers below determine how much documentation, assessment and oversight work lands on your teams, and each one can be narrowed with scoping decisions made before any consultant is hired.

Number of AI systems in scope

Every system you place on the EU market or use in the EU is a separate piece of work, so the count drives cost more than any other factor. Build a complete inventory first, then mark which systems are actually in scope under Article 2 and which are internal tools with no EU output. Ask any consultant to price per system and to show how they group near-identical systems, such as one model deployed across several business units. Confirm whether the inventory includes shadow AI bought through SaaS subscriptions.

Annex III and Annex I classification

Whether a system is high-risk under Annex III or a product system under Annex I sets the obligations it carries. Document the classification reasoning for every system, including systems you conclude are not high-risk. Ask whether the Article 6(3) exemption applies, since a system that performs only a narrow procedural task or a preparatory task may fall outside high-risk status if the conditions are met and documented. Treat the exemption as a legal conclusion to confirm with counsel, not a cost shortcut.

Built in-house or bought

A system you build is usually a provider obligation, which includes the full quality management system, technical documentation and conformity assessment. A system you buy shifts most of that work to the vendor, leaving you with deployer duties such as human oversight, input data control, monitoring and informing affected persons. Ask each vendor for its declaration of conformity or equivalent evidence, its instructions for use and its incident process. Fine-tuning or substantially modifying a bought system can move you into the provider role, so record every modification.

Use of general-purpose AI models

Systems built on a general-purpose model from another provider inherit dependencies that affect your documentation burden. You need the upstream provider's technical information and downstream documentation, and you must check whether your use changes your role. Self-hosting an open model or building on a model of your own can change which obligations apply and which authority supervises your system. Ask each model supplier what documentation it provides for downstream use, and confirm how it applies to your deployment.

State of existing technical documentation

Documentation that already exists in engineering wikis, model cards, test reports and change logs usually reduces cost more than any new drafting. The gap between what exists and what the Act's technical documentation requires is what you pay to close. Ask a consultant to map existing artifacts to the requirements and to estimate how many are missing or out of date. Check whether the SME simplified technical documentation form under Article 11(1) is available to you, because it reduces the drafting load for qualifying small and mid-sized businesses.

SME relief routes

Smaller organizations can reduce cost through several routes written into the Act. Regulatory sandboxes offer free access under Article 58(2)(d), conformity assessment fees are reduced in proportion to size under Article 62(2), and simplified quality management elements apply to some SMEs under Article 63(1). Confirm eligibility with your national authority before you budget, and ask any consultant to scope SME-specific work separately. Relief lowers fees and some formal burdens but does not remove the obligations themselves.

How a consultant engagement runs from inventory to readiness

A well-scoped AI Act engagement moves from a complete list of AI systems to a documented, tested position that the organization can take into any required conformity assessment. Each phase produces an artifact the next phase depends on.

Build the AI system inventory
The consultant works with your product, engineering, HR, procurement and business owners to list every AI system and general-purpose AI model you provide, deploy, import or distribute, including third-party tools embedded in your processes. For each entry, the inventory records the purpose, the affected people, the data used, the vendor or model source and the named business owner. The phase is done when the owners have confirmed the list in writing and no known system is missing. Ask the consultant how they find shadow AI, such as employee use of external tools and features switched on inside existing software.
Classify each system by risk
Using the scope and definitions of the Act, the consultant tests each inventory entry against the prohibited practices, the two routes to high-risk status, the Article 6(3) exemption and the transparency duties. Borderline cases are documented with the reasoning, the facts relied on and the open questions for legal review. The output is a classification register that states, for each system, whether it is prohibited, high-risk (and under which Annex), subject to transparency duties, or outside the Act's obligations. Confirm that legal sign-off on classifications sits with your organization, since the consultant prepares the analysis.
Assess the gap against the applicable dates
For each high-risk system, the consultant compares your current practice with the requirements of Chapter III and the operator duties that apply to your role as provider or deployer. The dates that drive the plan are 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems, as amended in 2026. Prohibited practices and the AI literacy duty already apply, so they are assessed first. The output is a gap register with each gap linked to an owner, a remediation action and the evidence that will close it. Ask for the written scope to state how timing will be confirmed against the current consolidated text.
Build the technical documentation and quality management system
Providers receive help drafting the technical documentation, risk management records, data governance records, logging design, instructions for use and the quality management system described in Article 17. The consultant designs the procedures, roles and record-keeping so that engineering teams can produce evidence as part of normal work instead of at audit time. Where a harmonised standard is relevant, the consultant maps your procedures to it, noting that EN 18286:2026 on quality management was cited in the Official Journal on 14 October 2026 and gives a presumption of conformity. The output is a document set with version control, approvals and named owners, all held inside your systems.
Set up deployer processes for oversight and logging
Organizations that use high-risk systems built by others need their own processes. The consultant helps define who performs human oversight, what training they receive, how they can intervene or stop a system, how input data and logs are retained, and how the organization monitors performance and reports serious incidents to the provider and authorities. Ask the consultant to show how oversight is staffed, because the Commission's impact assessment estimated human oversight costs at EUR 5,000 to 8,000 per year per user organization, roughly 0.1 of a full-time employee. The output is a set of approved procedures, role descriptions and a log retention design tested with a sample case.
Run an internal readiness review
Before any notified body or other conformity assessment, the consultant tests whether the evidence can be produced on request. They walk through each high-risk system's file as an assessor would, check that records match what the system actually does, and look for gaps in traceability between requirements, tests and changes. Findings are logged with severity and owner, and the team re-tests after fixes. The output is a readiness report that states which items are complete, which are open and which the organization has accepted as residual risk. Confirm whether the readiness review is covered by the fixed scope, and who signs off the report.
Hand over to independent assessment
The engagement ends with a handover package: the inventory, classification register, gap closure record, technical file, procedures and readiness report, plus an agreed plan for maintaining them after each system change. Conformity assessment is then carried out by the internal control route or by a notified body, depending on the system. The consultant does not issue the assessment result, and no certificate follows from their work alone. Ask for the handover contents to be listed in the written scope so you know exactly what you receive.

How the Commission's cost estimates fit your budget

The most cited numbers on AI Act cost come from the Commission's impact assessment accompanying the proposal (SWD(2021) 84 final). For suppliers, it set maximum fixed costs per AI application of EUR 2,763 for data requirements, EUR 4,390 for documentation and traceability and EUR 3,627 for provision of information, around EUR 10,000 in total for companies following standard business procedures. Allowing for work companies would do anyway, the assessment put compliance at roughly two thirds of that maximum, or EUR 6,000 to 7,000 per high-risk system by 2025. For users, it estimated human oversight at EUR 5,000 to 8,000 per year. These are 2021 modelling figures, not quotes, and they do not reflect the 2026 amendments that moved the high-risk dates.

Read these figures as a rough floor for the internal work, not as a budget. They exclude consultant fees, tooling, legal review, and any notified body fee, which the assessment did not price for each case. Notified body involvement applies only to some biometric systems and Annex I products, so for most Annex III systems the largest external line will be your own engineering and governance time, plus a partner if you buy one. Ask any partner to show, in writing, which of the estimate's three supplier components their scope covers, which deliverables sit outside those components, and what is one-time and what recurs each year.

Use the figures as a sanity check against a written scope. If a partner's quote for one high-risk system is far below the impact assessment's range, ask which documentation, data governance or post-market monitoring tasks are excluded and who will perform them. If it is far above, ask what drives the difference, such as multiple systems, a notified body route, or a broader QMS build. For SMEs, check whether the quote assumes the simplified technical documentation form under Article 11(1) or the reduced conformity assessment fees under Article 62(2), since those change the work and the price. Confirm the current figures and any SME arrangements with the Commission's AI Act page before you commit.

Your team, the consultant and the independent assessor

Your organization remains the provider or deployer under the AI Act, so the legal duties, the risk decisions and the final sign-off stay with you, whatever partners you bring in. Your people decide whether a system is high-risk, which intended purpose is in scope, what residual risk is acceptable and who is accountable when the system is in use. A consultant can inform these decisions but cannot take them over.

Risk and classification decisions: Your leadership confirms the intended purpose, the Annex III or Annex I route and any Article 6(3) reasoning, and records why.
Human oversight design: Your business owners define who oversees each system, with what authority to intervene, and how that person is trained.
Quality management ownership: Your accountable executive approves the QMS, its policies and its resourcing.
Final sign-off: Your authorized signatory approves technical documentation and any declaration of conformity before the system is placed on the market or put into service.
Operational monitoring: Your teams watch the system after launch, handle incidents and decide on corrective action.

Before hiring anyone, confirm in writing which of these decisions you will make internally and which a partner may draft for your review.

How to check a consultant before you hire one

Consultants range from firms that write policies to firms that build and test the technical evidence an assessor will read. The checks below help you tell them apart before you sign, and each one maps to a decision you will have to live with for the life of the AI system.

Verified AI Act and ISO/IEC 42001 experience

Ask for named examples of AI Act work on systems similar to yours, including whether any of them were high-risk Annex III systems or Annex I products. Ask separately about ISO/IEC 42001 management system work, and whether the firm has built an AI management system that was later assessed by an independent certification body. Ask for references you can call, and ask what they would not be able to show you because of confidentiality. A firm that cannot describe a past engagement in concrete terms has not shown you the experience you are buying.

Independence from your notified body

If your system may need a notified body, the firm that prepared your documentation should not be the same organization that assesses it, and it should not be a body you plan to use. Ask whether the consultant has any ownership, reseller, or referral relationship with notified bodies or certification bodies, and whether it has ever been asked to advise both sides of the same assessment. Put the answer in writing before you agree on scope.

Written fixed scope and deliverables

A proposal should list the AI systems in scope, the roles you hold for each (provider, deployer, importer, distributor or other), the documents to be produced, and the acceptance criteria for each one. Ask what is excluded, such as ongoing monitoring, legal opinions or conformity assessment fees, and what happens if the inventory turns out larger than expected. Fixed-scope agreements make cost comparable between bids and make it clear who is responsible when a deliverable is late.

Named people and their qualifications

Ask who will actually perform the work, their roles, and how much of their time the engagement receives. Senior review is useful, but many engagements are done by junior staff under a partner who appears only at kickoff. Ask for the qualifications of the people doing the technical work, such as security engineering, data science or model evaluation experience, and confirm whether any subcontractors will be involved and how they will be supervised.

Explanation of the ISO/IEC 42001 gap

The European Commission's JRC found in 2023 that ISO/IEC 42001 is broadly in line with the AI Act's quality management system requirement, but that it is high-level and flexible, with optional risks and controls. A consultant should be able to explain which AI Act QMS elements a 42001 system does not cover by itself, such as specific documentation, post-market monitoring and incident reporting, and how they will close those gaps. Treat a firm that offers 42001 certification as a fix for the AI Act as a warning sign.

Evidence handover and working location

Agree in advance what you will receive at the end: editable source documents, evidence files, a traceability index, and records of decisions. Ask whether the firm can work inside your own cloud accounts, data center or air-gapped network, so that model logs, training data and test outputs never leave your environment. Confirm who retains copies after the engagement ends and how access is revoked.

What SME relief changes for smaller organizations

SME relief under the AI Act is a set of four specific routes, and none of them removes an obligation. Free access to regulatory sandboxes is granted under Article 58(2)(d), where authorities may offer testing environments at no charge. Conformity assessment fees for SMEs are reduced in proportion to company size under Article 62(2). Article 11(1) allows SMEs and small mid-caps to use a simplified form for technical documentation, and Article 63(1) allows some simplified elements of the quality management system. A consultant quote should state which of these routes it assumes and why, because each one changes the work and the fee in a different way.

Eligibility is the first thing to confirm. The SME status that matters is the one defined in EU law for enterprise size, and the simplified documentation and QMS routes apply only to the organizations and systems the Act names. Ask the consultant to show the headcount and turnover tests it applied, and check whether your group structure, partner enterprises or linked enterprises change the result. Also confirm whether your AI system is high-risk at all, since most of these reliefs attach to high-risk obligations that begin on the dates in the amended timeline, not to every AI system you run.

When pricing a quote, separate what relief reduces from what it does not. Fee reductions on conformity assessment only matter if a notified body is involved, and a simplified documentation form still has to show the same substance, including risk management, data governance and logging. Ask the consultant to price the full documentation set and state any line item it removes because of an SME route, with the article it relies on. Treat any reduction the consultant claims as a question for the relevant national authority or notified body to confirm in writing before the budget is set.

What usually inflates AI Act consulting cost

Most overruns in AI Act consulting trace back to a handful of early decisions that were never written down. The cards below cover the five causes that appear most often, and for each one, the scoping step that keeps the engagement inside a fixed written scope.

Unclear system inventory

If nobody can say which AI systems the organization builds, buys or runs, every later step is priced against a moving target. Consultants spend billable hours interviewing teams to discover systems that should have been listed. Before requesting a quote, build a short inventory with an owner, purpose, data types and user groups for each system, including vendor tools with embedded AI. Ask the consultant to scope inventory validation as a fixed deliverable, with a stated count of systems in scope and a rule for adding new ones through change control.

Late classification decisions

Risk classification determines whether a system needs high-risk documentation, a quality management system and possibly third-party assessment. When the classification is decided late, documentation work done under the wrong assumption must be redone. Ask for the classification rationale per system to be drafted early, reviewed by legal counsel, and signed off by the accountable owner before any documentation work begins. Put a written decision gate in the scope so that reclassification triggers a defined change order rather than open-ended rework.

Documentation written after the fact

Technical documentation that is reconstructed months after a system was built costs far more than documentation kept during development. Engineers must recall design choices, data sources and test results from memory, and consultants must then verify each claim against logs and repositories. Ask the provider to define which artifacts are produced at each development stage, who maintains them, and where they are stored. A fixed scope should name the documents to be produced and the evidence each one must cite.

No owner for deployer duties

Deployer obligations, such as human oversight, monitoring of operation and keeping logs, often fall between the business unit that uses a tool and the IT team that hosts it. When no one owns these duties, the consultant ends up writing procedures, assigning roles and chasing evidence across departments. Before scoping, name one accountable owner per deployed system and a reviewer for oversight procedures. Ask the consultant to deliver the deployer procedures as a fixed set of documents with named roles, so that the handover does not become an ongoing coordination service.

Scope creep from general-purpose model questions

Questions about whether the organization is a provider of a general-purpose AI model, or whether fine-tuning a model changes its role, can expand an engagement quickly. These questions require separate legal analysis and may pull in provider obligations that the original scope did not cover. Ask the consultant to confirm in writing which roles the organization holds for each system, and to list general-purpose model questions as an excluded item with a separate quote. A written exclusion keeps the core engagement fixed while the open question is answered on its own terms.

Questions buyers ask before hiring an AI Act consultant

How much does an AI Act consultant cost, and are the fees fixed?

Fees depend on the written scope, not on a standard rate, so ask for a quote tied to named deliverables. The Commission's impact assessment gives a useful benchmark for the compliance work itself: it estimated maximum fixed costs per AI application for suppliers of EUR 2,763 for data requirements, EUR 4,390 for documentation and traceability and EUR 3,627 for provision of information, around EUR 10,000 in total for companies following standard business procedures. Allowing for work companies would do anyway, it put compliance at roughly EUR 6,000 to 7,000 per high-risk AI system by 2025. Those are estimates, not consultant fees. Your quote should separate one-time work (inventory, classification, documentation, quality management setup) from recurring work (monitoring, log reviews, updates after model changes), and it should say which items are fixed-price and which are time-based. DeployOpen does not publish a price list; most engagements are fixed-scope and agreed in writing before work starts.

How long does AI Act readiness take, and what sets the timeline?

The timeline is set by how many AI systems you have, how many are high-risk, and how much of the evidence already exists. The main external date to plan around is 2 December 2027 for Annex III high-risk systems and 2 August 2028 for Annex I product systems, following the 2026 amendment in Regulation (EU) 2026/1744. Before any date, the work starts with an inventory and a classification of each system. Systems that turn out to be out of scope or only subject to transparency duties need far less work. Other drivers include whether you are a provider or a deployer, whether a notified body is required, how mature your logging and testing already are, and how many teams must sign off on documents. Ask any consultant for a phased plan with milestones and the dependencies on your own staff, and confirm the start date and access to systems in the written scope.

What does an AI Act engagement need from our internal team?

The engagement needs named people who own decisions, not only people who answer questions. Expect to supply a sponsor with budget authority, a system owner for each AI system, technical staff who can explain the model, data sources and testing, and a legal or compliance reviewer who can sign off on classifications. Human oversight is a continuing duty for deployers, and the impact assessment estimated its cost for users at EUR 5,000 to 8,000 per year, around 0.1 of a full-time employee. Plan for that time to be recurring, not a one-off. Ask the partner which tasks they will perform, which your staff must perform, and how many hours of your people's time each phase assumes.

Can our internal team do AI Act compliance without a consultant?

Yes, in many organizations, particularly where few systems are high-risk and a capable compliance or legal team already runs risk and documentation processes. The Act does not require an outside firm. What an internal team must have is time, a clear classification method and technical access to logs, testing results and model documentation. Where it usually struggles is the technical file and quality management system, which must be kept current across the system lifecycle. A consultant or implementation partner can be used for specific gaps, such as building the inventory, preparing evidence or setting up logging, while your team keeps the decisions. Split the work deliberately, and keep in-house the duties the Act places on your organization, including the classification and the responsibility for conformity.

Can a consultant issue an AI Act certificate or conformity report?

No. A consultant or implementation partner can prepare systems, documents and evidence, but only an independent body issues certificates or reports. For most Annex III high-risk systems, the provider carries out an internal-control conformity assessment under Annex VI, which means the provider's own declaration and documentation, not a third-party certificate. Notified bodies are involved for some biometric systems and for Annex I products under Article 43, and those bodies are the only ones that can certify. Before you sign, confirm in writing that the partner's deliverables are preparation work, and check whether your system falls under the notified body route. Do not accept language that suggests the consultant can certify compliance.

Which AI Act dates should we plan around after the 2026 amendment?

Plan around the dates in the consolidated text. Chapters I and II applied from 2 February 2025, and the general-purpose AI, governance, notified body and penalty chapters applied from 2 August 2025, except Article 101. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and moved the high-risk rules for Annex III systems to 2 December 2027 and for Annex I product systems to 2 August 2028. The rest of the Act applies from 2 August 2026 where the amendment does not change it. The harmonised standard EN 18286:2026 on quality management was cited in the Official Journal on 14 October 2026, giving a presumption of conformity from that date. Confirm each date against the EUR-Lex consolidated text before you set milestones, since your legal advisers own the final interpretation.

What should we check before we sign with an AI Act consultant?

Check four things: the written scope, the deliverables, the people doing the work and the exit terms. The scope should list each AI system, the role you hold for it (provider, deployer or both) and the frameworks the evidence must align with. Deliverables should be documents, registers and evidence you own afterwards. Ask who performs the technical work and whether they have hands-on experience with the systems you run. Confirm that the partner does not issue certificates or attestations, and that any notified body or auditor is chosen and paid by you. Ask how changes to scope are priced and how the work is handed over. Small firms may also offer simplified routes where the Act provides SME relief, including the simplified technical documentation form under Article 11(1) and reduced conformity assessment fees under Article 62(2), so ask whether those apply to you.

How DeployOpen scopes and prepares AI Act evidence

DeployOpen works on the technical side of AI Act readiness: the platforms, logs, test records and documentation that an AI consultant's plan depends on. Your organization keeps ownership of its obligations, and we prepare the systems and evidence for your own team or an independent assessor to review.

How we scope

We agree a written scope covering which AI systems, roles and obligations are in the work before any work starts.
Engagements are fixed-scope, with deliverables and timelines confirmed in writing.
We identify which parts are advisory, which are technical build work, and which must be handled by your legal team or a notified body.

How we build

We deploy and configure self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
We set up logging, access records, version tracking and testing workflows that produce the evidence your documentation relies on.
We integrate these tools with your existing ticketing, identity and change management systems so records are kept as work happens.

How we hand over

You receive configuration records, runbooks and documentation for each system we build, written for your own staff to operate.
We map each deliverable to the AI Act obligation it supports, so your reviewers can trace evidence to requirements.
We confirm with you which items need independent assessment, and we do not issue reports, attestations or certificates ourselves.

How we support

Ongoing support, upgrades and continuous testing are available as retainers once the initial scope is complete.
Retainers can cover monitoring of logs, periodic re-testing after model or system changes, and updates as the dates in the Act and its standards change.
Ask us to confirm in writing what a retainer includes, how often it is reviewed and how changes to scope are priced.