The cost of compliance: reality vs perception
One of the most frequent concerns among AI startup founders is how much AI Act compliance will cost. The answer depends fundamentally on two variables: your system’s risk category and the maturity of your internal processes.
Minimal-risk systems: zero regulatory cost
If your AI system is classified as minimal risk — spam filters, content recommendation systems without impact on fundamental rights, inventory optimisation — you have no specific obligations under the AI Act. The only cost is performing the initial classification to confirm this category.
Estimated cost: €1,500 - €3,000 (professional risk classification).
Limited-risk systems: mandatory transparency
Chatbots, content generators, and emotion recognition systems must implement transparency mechanisms. The main cost is technical: modifying interfaces to include clear notifications.
Typical costs:
- Legal analysis of obligations: €1,500 - €3,000
- Technical implementation of labelling: Variable by complexity (generally absorbed by the product team)
- Review of terms of service and notices: €1,000 - €2,000
- Indicative total: €3,000 - €6,000
High-risk systems: the bulk of the investment
This is where the AI Act demands the most resources. Systems operating in health, finance, education, employment, or critical infrastructure need a complete compliance package.
Cost breakdown by phase:
1. Classification and initial assessment
- System analysis and risk classification: €1,500 - €4,000
- Gap analysis against AI Act requirements: €2,000 - €5,000
2. Technical documentation
- System technical sheet preparation: €3,000 - €8,000
- Training data documentation: €2,000 - €5,000
- Instructions manual for deployers: €1,500 - €3,000
3. Quality management system
- QMS design and implementation: €3,000 - €10,000
- Integration with existing development processes: €2,000 - €5,000
4. Data governance
- Training data audit: €2,000 - €6,000
- Traceability and metrics implementation: €3,000 - €8,000
5. Conformity assessment
- Self-assessment (Annex VI): €3,000 - €7,000
- Third-party assessment (if applicable): €10,000 - €30,000+
6. Registration and ongoing compliance
- EU database registration: €500 - €1,500
- Annual monitoring and updates: €3,000 - €8,000/year
Indicative total for high-risk: €20,000 - €80,000 (first year), €5,000 - €15,000/year (maintenance).
GPAI models: specific costs
If you train general-purpose models, additional costs include:
- Model technical documentation: €5,000 - €15,000
- Copyright compliance policy: €3,000 - €8,000
- Training content summary: €2,000 - €5,000
- Systemic risk assessment (if applicable): €15,000 - €40,000
Factors that reduce cost
Not every startup pays the maximum. Several factors can significantly reduce investment:
1. Maturity of existing processes. If you already have ISO 27001 or mature GDPR compliance, much documentation and many processes are reusable. This can reduce costs by 30-40%.
2. Micro-enterprise exemptions. The AI Act simplifies certain QMS requirements for companies with fewer than 10 employees, provided they document essential elements.
3. Regulatory sandboxes. Participation in national sandboxes offers free guidance from regulators and can reduce the need for external consultancy.
4. Early planning. Integrating AI Act requirements during product development (compliance by design) is significantly cheaper than retrofitting an already-built system.
The cost of non-compliance
AI Act fines are proportional but severe:
- Prohibited practices: Up to €35M or 7% of global turnover
- High-risk non-compliance: Up to €15M or 3% of global turnover
- Incorrect information to authorities: Up to €7.5M or 1% of global turnover
For a startup generating €500,000 in annual revenue, the minimum fine for high-risk non-compliance would be €15,000 — comparable to the cost of proper compliance from the start.
How to optimise your compliance investment
- Start with classification. A professional risk analysis avoids investing in unnecessary compliance if your system turns out to be minimal or limited risk.
- Prioritise technical documentation. It is the most universal and reusable requirement. Good technical documentation also serves investors, clients, and internal audits.
- Reuse GDPR processes. If you already comply with GDPR, your DPO, impact assessments, and data governance procedures are a solid foundation for the AI Act.
- Choose advisors who understand your technology. Fluent technical communication between your engineering team and legal advisors significantly reduces consultancy hours.
At A2 we offer tiered compliance plans designed specifically for startups. If you need a budget tailored to your system and stage, contact our team.