Article 99 of the EU AI Act establishes fines of up to 35 million euros or 7% of global turnover for non-compliance. Understanding total compliance costs by organisation size enables informed investment decisions and effective budget allocation across staffing, tooling, infrastructure, and advisory services.
This page presents worked cost estimates for EU AI Act compliance across six organisation profiles, from small organisations with a single high-risk AI system to large enterprises managing twenty-five systems. First-year costs range from 350,000 euros for a small organisation to 2,880,000 euros for a large one, with staffing consistently the largest component. Annual ongoing costs at steady state are substantially lower, ranging from 155,000 to 1,820,000 euros, reflecting the front-loaded nature of initial preparation. The page also sets these costs against enforcement exposure: a single Article 99(3) fine at 3% of turnover for a medium-sized organisation would reach 15 million euros, more than ten times the annual compliance cost. Guidance is provided on building the business case for four stakeholder audiences, tracking and optimising compliance expenditure through automation and shared services, and implementing a phased approach for organisations unable to commit the full investment immediately.
First-year compliance costs range from approximately 350,000 euros for a small organisation with one high-risk AI system to 2,880,000 euros for a large organisation managing twenty-five systems.
First-year compliance costs range from approximately 350,000 euros for a small organisation with one high-risk AI system to 2,880,000 euros for a large organisation managing twenty-five systems. These estimates include the initial ai system description profile preparation alongside ongoing operational expenditure. Staffing consistently represents the largest cost component, accounting for more than half of total spend across every organisation profile. The remaining budget divides among tooling, infrastructure, and external advisory services.
Annual ongoing compliance costs are substantially lower than first-year costs, reflecting the front-loaded nature of initial AISDP preparation and infrastructure investment.
Annual ongoing compliance costs are substantially lower than first-year costs, reflecting the front-loaded nature of initial AISDP preparation and infrastructure investment. A small organisation with one system can expect ongoing costs of approximately 155,000 euros per year, while a large organisation with twenty-five systems faces approximately 1,820,000 euros annually.
| Organisation Profile |
|---|
The cost model is incomplete without the enforcement exposure it is designed to mitigate.
The cost model is incomplete without the enforcement exposure it is designed to mitigate. The eu ai act establishes a tiered penalty structure with fines that substantially exceed the cost of any compliance programme, making the financial case for investment straightforward.
The business case for EU AI Act compliance investment should address four distinct audiences, each requiring different evidence and framing.
The business case for EU AI Act compliance investment should address four distinct audiences, each requiring different evidence and framing. Tailoring the argument to each stakeholder group increases the likelihood of securing the necessary budget and organisational commitment.
The CFO needs the cost model presented in the staffing, tooling, infrastructure, and total cost sections, the non-compliance exposure analysis, and the marginal cost reduction for additional systems. The key message for finance leadership is clear: the first system is the most expensive, each subsequent system is cheaper, and the cost of non-compliance dwarfs the cost of compliance at any scale.
The AI Governance Lead implements cost tracking for the compliance programme using the organisation's existing financial management tools.
The AI Governance Lead implements cost tracking for the compliance programme using the organisation's existing financial management tools. Each cost category, including staffing, tooling, infrastructure, and external advisory, is tracked separately to enable meaningful analysis. Per-system costs are tracked to support marginal cost calculations. Quarterly cost reports are provided to the CFO and reviewed by the AI Governance Lead for optimisation opportunities.
Three strategies reduce the ongoing cost of compliance. First, automation: every manual compliance task that can be automated, such as documentation generation, evidence collection, threshold monitoring, and report production, reduces the staffing cost. The governance pipeline is the primary automation mechanism. Second, shared services: monitoring infrastructure, evidence storage, governance pipeline components, and template libraries are shared across systems, reducing the per-system infrastructure and tooling cost. Third, process standardisation: a standard AISDP preparation process, applied consistently across systems, reduces the learning curve for each new system and enables the assessment team to work more efficiently. covers the specific tooling decisions that drive these cost reductions.
Organisations that cannot commit the full investment should consider a phased approach that spreads the cost over eighteen to twenty-four months rather than concentrating it in a single preparation cycle.
Organisations that cannot commit the full investment should consider a phased approach that spreads the cost over eighteen to twenty-four months rather than concentrating it in a single preparation cycle. This approach prioritises the highest-risk system first, building governance infrastructure and institutional knowledge that reduce subsequent costs.
Phase 1 addresses the highest-risk system in the portfolio: the system most likely to attract regulatory attention, most likely to cause harm, or most commercially important. The investment in Phase 1 builds the governance infrastructure, the templates, and the institutional knowledge that reduce the cost of subsequent phases.
The first system bears the full cost of building governance infrastructure, templates, and institutional knowledge. Subsequent systems reuse this foundation, so the marginal cost per system decreases as the portfolio grows.
Staffing consistently represents more than half of total compliance spend across every organisation profile, both in the first year and at steady state.
The AI Governance Lead assesses enforcement risk for deferred systems and determines whether interim compensating controls, such as enhanced monitoring, restricted deployment, and increased human oversight, can reduce exposure until full compliance is achieved.
First-year costs range from 350,000 euros for a small organisation with one system to 2,880,000 euros for a large organisation with twenty-five systems, with staffing as the dominant cost component.
Steady-state annual costs range from 155,000 euros for one system to 1,820,000 euros for twenty-five systems, substantially lower than first-year costs due to front-loaded infrastructure investment.
Fines reach up to 35 million euros or 7% of global turnover for prohibited practices, 15 million or 3% for non-compliant high-risk systems, and 7.5 million or 1% for supplying incorrect information.
Address four audiences separately: the CFO with cost models, the CEO with market access framing, the board with risk exposure, and engineering leadership with tooling and FTE requirements.
Three strategies reduce costs: automating manual tasks through governance pipelines, sharing infrastructure across systems, and standardising AISDP preparation processes.
A phased approach over eighteen to twenty-four months starts with the highest-risk system, building infrastructure and templates that reduce costs for subsequent phases.
The following table presents estimated first-year costs, broken down by organisation profile and cost category.
| Organisation Profile | Systems | Staffing | Tooling | Infrastructure | External Advisory | Total First Year |
|---|---|---|---|---|---|---|
| Small (1 system, external-heavy) | 1 | 250,000 euros |
Small organisations with a single system rely more heavily on external advisory services relative to their total spend. As the system count increases, the per-system cost decreases because governance infrastructure, templates, and institutional knowledge are shared across systems. Compliance Cost Modelling provides the full breakdown of individual cost components, including staffing models and tooling investment profiles.
| Systems |
|---|
| Staffing |
|---|
| Tooling |
|---|
| Infrastructure |
|---|
| External Advisory |
|---|
| Total Annual |
|---|
| Small (1 system) | 1 | 80,000 euros | 40,000 euros | 20,000 euros | 15,000 euros | **155,000 euros** |
| Small (3 systems) | 3 | 200,000 euros | ||||
| Medium (5 systems) | 5 | 400,000 euros | ||||
| Medium (10 systems) | 10 | 700,000 euros | ||||
| Large (15 systems) | 15 | 850,000 euros | ||||
| Large (25 systems) | 25 | 1,300,000 euros |
Staffing remains the dominant cost category at steady state, though external advisory costs drop significantly once in-house expertise is established. Tooling and infrastructure costs remain relatively stable because these represent subscription and maintenance fees for compliance platforms and evidence storage. Staffing and FTE Requirements details the role-by-role staffing model that drives these estimates.
| Organisation Profile | Systems | Staffing | Tooling | Infrastructure | External Advisory | Total Annual |
|---|---|---|---|---|---|---|
| Small (1 system) | 1 | 80,000 euros |
For a medium-sized organisation with 500 million euros in annual turnover, a single Article 99(3) fine at 3% would reach 15 million euros. That figure is more than ten times the annual ongoing compliance cost for ten systems. The compliance programme functions, in financial terms, as an insurance premium whose expected return is substantial. Enforcement and Market Surveillance covers the enforcement mechanisms in detail.
The CEO needs the strategic framing. Compliance is a market access requirement, not a discretionary investment. High-risk AI systems cannot legally be placed on the EU market after August 2026 without a conformity assessment and AISDP. The choice is not whether to invest; it is whether to invest now, when the organisation has time to do it well, or later, under time pressure that will increase cost and reduce quality.
The board needs the risk exposure analysis: the maximum fine thresholds, the personal liability dimensions for executive leadership, and the reputational risk assessment. Board members with fiduciary responsibilities should understand that knowingly operating non-compliant AI systems after August 2026 creates a governance risk that the board has a duty to manage. Conformity Assessment Procedures explains the assessment requirements that the board should understand.
The engineering leadership needs the tooling and infrastructure investment breakdown, the FTE allocation model, and the implementation timeline. The compliance infrastructure, once built, serves every system in the portfolio and generates compliance evidence as a byproduct of normal engineering workflows. The marginal compliance cost per system decreases as the infrastructure matures.
Phase 2 extends to the next tranche of systems, leveraging the infrastructure and templates established in Phase 1. Phase 3 addresses the remaining systems. The phased approach carries an explicit risk: systems in Phase 2 and Phase 3 remain non-compliant during the preparation period. The AI Governance Lead assesses this risk and determines whether interim compensating controls, such as enhanced monitoring, restricted deployment, and increased human oversight, can reduce enforcement exposure until full compliance is achieved.
CTO of Standard Intelligence. Leads platform engineering and contributes to the PIG series technical content.
| 40,000 euros |
| 20,000 euros |
| 40,000 euros |
| **350,000 euros** |
| Small (3 systems) | 3 | 550,000 euros | 50,000 euros | 35,000 euros | 80,000 euros | **715,000 euros** |
| Medium (5 systems) | 5 | 750,000 euros | 120,000 euros | 50,000 euros | 100,000 euros | **1,020,000 euros** |
| Medium (10 systems) | 10 | 1,200,000 euros | 180,000 euros | 70,000 euros | 150,000 euros | **1,600,000 euros** |
| Large (15 systems) | 15 | 1,500,000 euros | 250,000 euros | 80,000 euros | 200,000 euros | **2,030,000 euros** |
| Large (25 systems) | 25 | 2,200,000 euros | 300,000 euros | 100,000 euros | 280,000 euros | **2,880,000 euros** |
| 50,000 euros |
| 35,000 euros |
| 25,000 euros |
| **310,000 euros** |
| 120,000 euros |
| 50,000 euros |
| 40,000 euros |
| **610,000 euros** |
| 180,000 euros |
| 70,000 euros |
| 65,000 euros |
| **1,015,000 euros** |
| 250,000 euros |
| 80,000 euros |
| 85,000 euros |
| **1,265,000 euros** |
| 300,000 euros |
| 100,000 euros |
| 120,000 euros |
| **1,820,000 euros** |
| 40,000 euros |
| 20,000 euros |
| 15,000 euros |
| **155,000 euros** |
| Small (3 systems) | 3 | 200,000 euros | 50,000 euros | 35,000 euros | 25,000 euros | **310,000 euros** |
| Medium (5 systems) | 5 | 400,000 euros | 120,000 euros | 50,000 euros | 40,000 euros | **610,000 euros** |
| Medium (10 systems) | 10 | 700,000 euros | 180,000 euros | 70,000 euros | 65,000 euros | **1,015,000 euros** |
| Large (15 systems) | 15 | 850,000 euros | 250,000 euros | 80,000 euros | 85,000 euros | **1,265,000 euros** |
| Large (25 systems) | 25 | 1,300,000 euros | 300,000 euros | 100,000 euros | 120,000 euros | **1,820,000 euros** |
