EU AI Act compliance cost

What does EU AI Act compliance cost, and what changes the number for us?

The most-cited figure from the Commission is EUR 6,000 to 7,000 per high-risk AI system by 2025, which the 2021 impact assessment (SWD(2021) 84) estimated at roughly 4 to 5% of an assumed EUR 170,000 average development cost. These are 2021 estimates for the original proposal, not a quote, and they predate the 2026 changes to the Act. Treat them as a sense of scale for budget conversations, not as a number to put in a purchase order. Your real figure depends on three things: how many of your systems are high-risk, whether a notified body must be involved, and how much of the required evidence you already produce. The organization owns its controls, and that ownership is what drives most of the cost. An implementation partner can prepare systems, logging, documentation and evidence packs, but cannot certify them. Only an independent auditor or notified body issues assessments where the Act requires one. Most Annex III high-risk systems use internal control under Annex VI, so your largest recurring spend is often internal staff time and the tooling that keeps evidence current, not an external fee. Where a notified body applies, the same impact assessment estimated a documentation review of one to two and a half days per system, and an initial quality management audit at EUR 1,000 to 2,000 per day, with yearly re-audits. Confirm current notified body rates directly with the body you approach. Before requesting a quote, build a system inventory and run a classification check so you know which systems are in scope and which high-risk route applies. Ask any implementation partner for a fixed-scope proposal that lists each system, each deliverable, the evidence it will produce, and what stays with your team. Separate one-time work (documentation baselines, logging design, risk management setup) from recurring work (monitoring, post-market evidence, re-assessment after substantial change). Ask the Commission's cost estimates for SMEs and small mid-caps to be checked against your own fee schedule, since the Act reduces some fees and fines for those companies.

Which cost components you pay for, and who gets paid

This table compares each cost component of AI Act compliance by who is paid, whether the cost is one-time or recurring, and what drives it up. Figures marked as from the 2021 impact assessment are the Commission's original estimates for the proposal and should be checked against your own systems and the final Act.

Cost component	Who is paid or who bears it	One-time or recurring	Source of figure and what drives it
Internal staff time for documentation and governance	Your own employees (no external payee)	Both: setup is one-time, upkeep recurs	No figure supplied. Drivers are the number of systems, their risk tier and how many roles must sign off on records.
Implementation partner work on systems and evidence	External partner, under a written scope	Mostly one-time, with recurring updates	No figure supplied. Drivers are system count, existing logging and documentation maturity, and how much evidence must be rebuilt.
Tooling and hosting for governance and logging	Software vendors or your own infrastructure	Recurring licences or hosting, plus one-time setup	No figure supplied. Open-source options reduce licence fees but still need staff to run them. Confirm hosting needs in your environment.
Human oversight staff for deployers	Your own staff, or contracted reviewers	Recurring	Impact assessment (SWD(2021) 84): EUR 5,000 to 8,000 per year, about 0.1 full-time employee, for human oversight where appropriate. Drivers are volume of decisions and the level of review required.
Notified body initial QMS audit	Notified body (where the system needs one)	One-time at initial assessment	Impact assessment (SWD(2021) 84): EUR 1,000 to 2,000 per day. Most Annex III systems use internal control, so this applies only to biometric systems and some Annex I products.
Notified body documentation review and yearly re-audits	Notified body (where the system needs one)	Documentation review is per system, re-audits recur	Impact assessment (SWD(2021) 84): documentation review of one to two and a half days, or EUR 3,000 to 7,500 per system. Re-audits are yearly. Drivers are system count and documentation quality.
Fines as a risk cost	Regulators, if you are found non-compliant	Contingent, not budgeted as a fixed cost	Article 99 (Regulation (EU) 2024/1689): up to EUR 35 million or 7% of worldwide turnover for prohibited practices, EUR 15 million or 3% for most operator obligations. SMEs face the lower of the fixed amount and the percentage.

What makes AI Act compliance cost more or less

Compliance cost is driven less by the Act's headline fines than by a handful of decisions you make early: how many AI systems you run, which of them are high-risk, which conformity route they take, and how mature your documentation and engineering practices already are. Each card below names one driver and the check that tells you where your organization stands.

Number of AI systems in scope

Cost scales with the count of systems, not the count of teams or vendors. Build a complete inventory first, recording every AI system you provide or deploy, including features bought inside SaaS products and models embedded in internal tools. The Commission's impact assessment expected only 5% to 15% of AI applications to be high-risk, so most of your inventory may fall outside the heavy obligations. Ask whether each entry has been classified, and by whom, before you price any work.

High-risk classification of each system

Whether a system is high-risk is the single largest switch on cost. Classification depends on whether it falls under a use listed in Annex III or is a safety component of a product covered by Annex I. Each high-risk system then needs the Chapter III requirements in full, while transparency-only systems carry much lighter duties. Document the reasoning for every classification decision, because an assessor will ask for it and reversing a wrong call later is expensive.

Annex III or Annex I conformity route

Most Annex III systems use internal control under Annex VI, so the cost is mainly your own engineering, documentation and quality management effort. Annex I product systems follow the route set by their sectoral law and often involve a third party. Confirm which route applies before you scope the work, since the route determines whether you need an external body at all.

Notified body involvement

A notified body is required only for some biometric systems and for Annex I products where sectoral law requires one (Article 43). Where it applies, the impact assessment estimated an initial quality management system audit at EUR 1,000 to 2,000 per day, with yearly re-audits, plus a documentation review per system. Ask any body for a written quote per system and per audit cycle, and confirm early whether your system triggers this route at all.

Existing documentation and quality maturity

The Commission's impact assessment assumed companies already following standard business procedures would absorb much of the work, which is why its estimate sat near two thirds of the theoretical maximum. Teams with version-controlled technical files, traceable datasets and documented change control start far ahead. Teams without them face the cost of building that record from scratch. Audit your current artifacts against the Article 11 and Article 12 expectations before you accept any quote.

State-of-the-art development practices

The impact assessment estimated an additional EUR 10,733 per system for companies not following state-of-the-art procedures for robustness and accuracy. That gap is where engineering maturity shows up as money. Testing practices, reproducible training pipelines, monitoring and regression checks either exist or must be built. Check which practices your teams already run, because closing this gap is usually the most expensive item on a plan.

Third-party and open-source components

Models, libraries and datasets you did not build still sit inside your system. Obtain the upstream documentation, licence terms and version history from suppliers, and write those duties into contracts along the value chain. Open-source components can lower build cost but require you to track versions, vulnerabilities and provenance yourself. Ask each vendor what documentation it will supply, in what format and at what price, before you assume it is included.

How the 2026 Digital Omnibus and SME relief change the bill

The Commission's proposal for the Digital Omnibus on AI (COM(2025) 836, 19 November 2025) gave initial estimates of administrative savings of about EUR 297.2 million to 433.2 million. Read these as the Commission's estimate for the proposal as a whole, not a saving any one organization can bank. Your share depends on how many systems you operate, whether they are Annex III or Annex I, and whether you were already doing the documentation and governance work the Act requires. The amended Act was adopted as Regulation (EU) 2026/1744, which moved the high-risk dates to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I product systems. That shift changes when the spending starts, not what the controls cost, so budget the remediation work against the new dates and confirm which milestones your plan now needs to meet.

SME relief is set out in several articles, and each one needs checking against your size and role. Article 58(2)(d) gives SMEs free access to regulatory sandboxes. Article 62(2) reduces conformity assessment fees in proportion to size, which matters only where a notified body is involved. Article 11(1) allows a simplified technical documentation form for SMEs and small mid-caps, and Article 63(1) allows simplified quality management system elements for some SMEs. Ask your provider or counsel which of these apply to your enterprise category and to each system, because eligibility can turn on headcount, turnover and whether you are a provider or a deployer. Ask any consultant to quote the work with and without these simplifications so you can see the difference in writing.

Before you assume any of this lowers your bill, confirm eligibility with counsel and ask for it in writing. Ask whether the simplified documentation form covers every technical file element for your high-risk systems, and whether the reduced fee applies to any notified body you would use. Also ask whether the small mid-cap fine caps apply to your case under Article 99(6) and (6a). Plan for the fact that relief reduces some fees and formalities but does not remove the obligations themselves. Your budget should still include the controls, evidence and oversight staff time that the Act requires, because a relief provision that simplifies a document does not waive the underlying duty.

How to build a cost estimate before you ask for quotes

This sequence turns a vague budget question into line items that a quote can match, starting from your AI system inventory and ending with a budget tied to the date each obligation applies. Each step produces an output you can hand to a consultant, notified body or implementation partner.

Inventory every AI system and your role for each
Your compliance or AI governance lead, working with system owners in IT and the business, lists every AI system in use, in development or bought from a vendor. For each entry, record the purpose, the affected people, the data it processes, the vendor, and whether your organization is the provider (it builds or places the system on the market under its own name) or the deployer (it uses a system under its own authority). This step is done when every system has one row in a register and each row names a role. Without this list, no later cost line has a unit to attach to.
Classify each system against the risk tiers
Using the register, legal or compliance staff assign each system to a tier: prohibited, high risk through Annex III or Annex I, transparency risk under Article 50, or minimal risk. Mark any system where the Article 6(3) exemption may apply and record the reasoning. Systems that are high risk or carry transparency duties become the cost-bearing units for the rest of the estimate. Check the outcome against the current application dates for each tier, since the 2026 amendments changed when high-risk rules start. The output is a classified register that a counsel or auditor can review.
Identify which high-risk systems need a notified body
For each high-risk system, determine the conformity assessment route. Most Annex III systems follow internal control, so the cost sits mainly with your own staff and any readiness partner. Systems in the biometric categories and Annex I products may require a notified body where sectoral law demands it (Article 43). Mark each system as internal control or notified body. Ask the relevant regulator or counsel to confirm the route for any borderline case. The output is a route column in the register, which determines whether a third-party assessment line item belongs in the budget.
Estimate internal effort and partner effort per system
For each high-risk system, split the required work into two lists. The first covers work your own staff will do, such as product ownership, data governance decisions and sign-off. The second covers work you plan to buy, such as gap assessment, technical documentation drafting, logging setup or quality management system build. Estimate effort in person-days for your staff and in the units each partner quotes. Where a notified body is involved, ask for its daily rate and documentation review scope in writing. The output is one line per system per activity, each traceable to a scope statement that a quote can match.
Add tooling and oversight costs for deployers
For each system where you are a deployer, add lines for human oversight, monitoring, log retention and any tooling needed to meet your duties. The impact assessment's per-user oversight figure is a useful starting point for the oversight line only, and it reflects 2021 assumptions. Separate one-time setup (configuration, integration, training design) from recurring costs (staff time for oversight, log storage, periodic review). Identify which tools you already own and which must be bought or self-hosted. The output is a cost sheet with one-time and recurring columns for each deployed system.
Check SME relief and fine exposure against your size
If your organization is an SME or small mid-cap, confirm which relief applies to your situation, including reduced conformity assessment fees in proportion to size, simplified documentation and the Article 99 caps. Record the relief as a reduction line, not as an assumption you bake into the total. Then compare the budget with the maximum fines in Article 99 for each violation type, expressed against your worldwide turnover. The output is a note on eligible reliefs and a short exposure table that shows what non-compliance could cost, so the budget decision is made against both sides.
Set the budget against the applicable date
Assign each cost line the date by which the obligation must be met, using the current application dates for each tier and system. Group the lines into work that must finish before the relevant date and work that can follow it. Add a contingency line only as an explicit, labeled assumption that your finance team approves. Confirm the final dates with the official EUR-Lex text and the Commission's guidance before you commit funds. The output is a dated budget with each line matched to a system, a role and a scope statement, ready to send to vendors as the basis for comparable quotes.

Where AI Act budgets usually go wrong

Most AI Act cost overruns start with the scope, not the controls. Organizations undercount their AI systems, classify too few or too many of them, and then budget against figures that were never meant for their architecture. Each card below names one gap and the check that closes it before the budget is approved.

Undercounting the systems in scope

Budgets are often built around the one or two AI products the business already knows about. Embedded features in HR software, scoring modules in vendor platforms and internal models built by analytics teams are frequently missed. Build a full AI system inventory across procurement records, engineering repositories and business unit interviews before requesting any quote, and ask each implementation partner to price against that inventory, not an estimate.

Treating every AI use as high-risk

Applying full high-risk controls to every system inflates the budget and delays low-risk projects. Classify each system first against the prohibited practices, the Annex III and Annex I routes and the Article 6(3) exemption, then budget high-risk controls only for systems that land there. Record the classification rationale so an assessor can test it later.

Ignoring deployer oversight costs

Deployers of high-risk systems carry duties of their own, including human oversight, which the Commission's impact assessment costed for users. Those costs recur every year and fall on operations and HR teams, not only on compliance. Name an accountable owner for each deployed high-risk system, add the oversight roles to the operating budget, and confirm the duties with the provider in the contract.

Relying on the 2021 per-system figure

The impact assessment's per-system figures reflect the original proposal and the process assumptions of 2021. Current architectures with retrieval pipelines, third-party models and frequent retraining change the documentation and logging effort. Treat the 2021 numbers as a historical reference point, then build a bottom-up estimate for each system's actual data, model and change-management setup.

Missing the notified body route

Most Annex III systems follow internal control, but some biometric systems and Annex I products require a notified body under Article 43. Notified body audits, documentation reviews and re-audits add external fees and lead time that internal budgets rarely include. Check each high-risk system against the conformity route before planning, and ask any notified body for a written scope and fee basis before committing a launch date.

Budgeting fines without SME caps

Organizations sometimes set fine exposure at the headline maximum, which overstates the risk for smaller firms. For SMEs, each fine is capped at the lower of the fixed amount and the turnover percentage, and since 2026 the same applies to small mid-caps for most fines. Use the capped figure in the risk register, but keep the uncapped maximum on record for any group entity that does not qualify.

What to ask for in a written quote

DeployOpen does not publish a price list. A quote follows from a written scope that names the work, the deliverables and the dates before any work starts, so the first thing to ask for is that scope in writing. For EU AI Act compliance cost, the scope should list each AI system in the inventory by name, its intended purpose, whether it is a provider or deployer system, and which risk tier you believe applies. A quote that says "AI Act readiness" without naming systems cannot be compared with another quote. Ask the partner to state which systems they have assumed are high-risk, and which Annex III or Annex I route they used to reach that view, because the number of systems in scope drives almost every other line.

Next, ask who does what. Separate the work the partner performs (for example, preparing technical documentation drafts, configuring logging, building the risk management file or setting up a quality management system in your environment) from the work your own staff, legal team or product owners must perform, such as sign-off on intended purpose, data governance decisions and business-level accountability. Ask whether the quote includes the independent conformity assessment, and if a notified body is needed for any system, what its fee covers and what is excluded. Notified body and auditor fees are paid to those bodies, not to the implementation partner, and no partner can issue a conformity assessment result or certificate. Ask for the retainer terms for post-deployment support, monitoring and reassessment, and list the assumptions that would change the price, such as new systems, changed intended purpose, a move to a different model provider or a delayed Annex I product schedule.

Questions buyers ask about AI Act compliance cost

How much does AI Act compliance cost per high-risk system according to the Commission?

The Commission's 2021 impact assessment (SWD(2021) 84) estimated roughly EUR 6,000 to 7,000 per high-risk AI system by 2025, or about 4 to 5% of an assumed average development cost of EUR 170,000. That figure is the estimate of additional work after allowing for steps companies would take anyway. It was calculated for the original proposal and predates the final text. The starting point was a maximum of about EUR 10,000 in fixed costs per application for companies following standard business procedures, covering data requirements, documentation and traceability, and information provision. Companies not following state-of-the-art procedures faced an extra EUR 10,733 for robustness and accuracy. Ask any vendor or consultant to show how its quote maps to these categories and which steps it assumes you already perform.

Do deployers have to pay for human oversight under the AI Act?

Yes, in practice deployers carry the cost of human oversight where it applies. The Commission's impact assessment estimated it at EUR 5,000 to 8,000 per year, around 0.1 of a full-time employee, for users of high-risk systems. That estimate covers the people and time needed to supervise a system, review its outputs and intervene when necessary. The cost recurs every year the system runs, so it belongs in the operating budget as well as the project budget. Costs rise with the number of decisions reviewed, the number of systems and the seniority of reviewers. They fall where oversight is built into existing workflows. Confirm with counsel which deployer duties apply to your system's classification and role, and ask your system supplier whether it provides oversight tooling, logs or training, and what those cost.

Does every high-risk AI system need a notified body assessment?

No. Most Annex III high-risk systems use internal control under the conformity assessment route in Annex VI, so the provider assesses conformity itself without a notified body. Notified bodies are needed for some biometric systems and for Annex I products where sectoral law requires third-party assessment (Article 43). Where one is involved, the 2021 impact assessment estimated an initial quality management system audit at EUR 1,000 to 2,000 per day, with yearly re-audits, and a documentation review of one to two and a half days per system, or EUR 3,000 to 7,500. Those figures come from the original proposal, so confirm current fees directly with the body. Ask for a written scope, the basis of its day rates and the re-audit cycle before you commit. Confirm with counsel whether your system falls into a category that needs one.

What relief do small and medium enterprises get under the AI Act?

SMEs receive several specific reliefs, and none of them removes the underlying obligations. They get free access to regulatory sandboxes under Article 58(2)(d). Conformity assessment fees are reduced in proportion to size (Article 62(2)). A simplified technical documentation form is available to SMEs and small mid-caps (Article 11(1)), and some SMEs may use simplified quality management system elements (Article 63(1)). On fines, each penalty for an SME is capped at the lower of the fixed amount and the turnover percentage (Article 99(6)). Since 2026, the same cap applies to small mid-caps for most fines (Article 99(6a)). Eligibility depends on the headcount and turnover definitions in the Act, so confirm which reliefs you qualify for with counsel before you plan your budget.

What is the maximum fine under the AI Act?

The maximum fine is EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most operator obligations. Providing misleading information to authorities can cost up to EUR 7.5 million or 1% (Article 99). The ceiling is whichever amount is higher, so for companies with large turnover, the percentage figure sets the exposure. For SMEs, the lower amount applies instead (Article 99(6)). National market surveillance authorities enforce the Act for AI systems, and the Commission's AI Office enforces the general-purpose AI model rules. A ceiling is not the expected outcome of an investigation. Ask counsel to model your exposure against your group turnover and the tier of each system.

Can our own staff run AI Act compliance in-house, and what skills does it need?

Yes, many organizations do this work in-house, but it needs named owners across legal, risk, engineering and the business. The work includes classifying each AI system, keeping the technical documentation and logs the Act requires, running human oversight, managing incidents and handling supplier contracts. Engineers must produce evidence from the systems themselves, legal staff must apply the classification and role rules, and risk staff must run the assessments and record decisions. Most Annex III systems use internal control, so no certificate is needed for them. Be precise about capacity: the 2021 impact assessment put oversight alone at about 0.1 of a full-time employee per system. An implementation partner, such as DeployOpen, can prepare systems and evidence, but only an independent assessor or notified body issues formal results. Ask any partner to state in writing which tasks it performs and which stay with your staff.

How DeployOpen scopes AI Act work and prepares evidence

DeployOpen prepares the systems, documentation and evidence that an AI Act compliance program needs, inside your own infrastructure. We scope the work in writing before it starts, so cost drivers such as the number of AI systems, their risk tier and the evidence each one needs are visible up front. Independent auditors and notified bodies, not DeployOpen, issue any assessment outcome.

How we scope

We start with a written inventory of the AI systems in scope, their roles and their likely risk tier.
The written scope lists which evidence artifacts, logging and oversight controls we will prepare for each system.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work begins.

How we build

We set up logging, record-keeping and human oversight controls on the self-hosted platforms you already run.
We prepare technical documentation templates and populate them from the configuration and data your teams provide.
We test the controls against the written scope and record the results so your assessor can review them.

How we hand over

You receive the evidence pack, control descriptions and configuration records, organized by system and by AI Act article.
We document who in your organization owns each control, so the duties stay with you after handover.
Any conformity assessment, notified body review or certificate is issued by an independent body, which we support but do not replace.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer for systems that change over time.
A retainer can keep documentation current when models, data sources or intended purposes are updated.
Ask for a written quote that separates one-time preparation work from any recurring support you choose to buy.