EU AI Act Compliance Statistics 2026

EU AI Act Compliance Statistics 2026

Last updated: June 7, 2026 Next scheduled update: Q3 2026 (September 7, 2026) Primary Author: Axis Intelligence Research Co-Author: Sarah Mitchell, AI & Regulation Correspondent | Download CSV ↓

Quick Answer: As of June 2026, 78% of organizations have taken no meaningful steps toward EU AI Act compliance, despite the regulation entering partial enforcement in February 2025. The AI Omnibus agreement of May 7, 2026, has pushed standalone high-risk AI system obligations to December 2, 2027 — but the compliance readiness gap documented across five independent datasets remains the defining risk for any enterprise operating AI systems in the European market.

---

Key Findings

• 78% of enterprises remain unprepared: A Vision Compliance analysis of assessments across eight EU industries (April 2026) found that nearly four in five organizations have implemented no meaningful AI Act compliance steps — despite enforcement having begun for prohibited practices in February 2025.
• Over 50% still lack an AI inventory: Cloud Security Alliance research (March 2026) confirms that more than half of organizations have not completed a systematic inventory of their AI systems — the minimum prerequisite for any subsequent compliance step, including risk classification and conformity assessment.
• Only 8 of 27 EU member states met the August 2025 governance deadline: The requirement to designate national competent authorities was due August 2, 2025; fewer than a third of member states complied, creating fragmented enforcement infrastructure across the bloc.
• The AI Omnibus deferred standalone high-risk deadlines to December 2027: A provisional political agreement reached May 7, 2026, moves standalone Annex III high-risk system obligations from August 2, 2026, to December 2, 2027 — but the deferral changes timelines, not obligations, and organizations face accelerated pressure once formal adoption completes.
• Compliance costs range from $500K to $15M per organization: Enterprise compliance investment for a large organization with high-risk AI systems is estimated at $8–15M initial; SMEs face $500K–$2M with proportional fee structures embedded in the Act’s text.

---

Axis Intelligence EU AI Act Compliance Readiness Index (ACRI) — Q2 2026

This index is an original Axis Intelligence Research calculation. No other publication presents this composite readiness score.

The ACRI synthesizes five independently sourced metrics into a single 0–100 readiness score, updated quarterly. A score of 100 would represent full enterprise and regulatory infrastructure readiness across the EU.

Methodology snapshot date: June 7, 2026

Dimension	Indicator	Value	Weight	Weighted Score
Enterprise readiness	% orgs with meaningful compliance steps	22%	30%	6.6
AI inventory completion	% orgs with systematic AI inventory	45%	25%	11.3
Member state infrastructure	% member states with designated authorities	30% (8/27)	20%	6.0
Harmonized standards availability	% of required standards formally adopted	~40%	15%	6.0
Regulatory enforcement density	Active enforcement actions / potential scope	~5%	10%	0.5
ACRI Score — Q2 2026			100%	30.4 / 100

Interpretation: An ACRI of 30.4 means the EU AI Act ecosystem — across both enterprise compliance programs and member state enforcement infrastructure — is operating at roughly 30% of what full readiness would require. The gap between regulatory ambition and operational reality is the central story of AI governance in Europe in 2026.

Sources: Vision Compliance (April 2026); Cloud Security Alliance (March 2026); artificialintelligenceact.eu national implementation tracker (June 2026); CEN/CENELEC standardization progress reports (October 2025); European AI Office enforcement activity log (Q1 2026).

Cite this metric: “According to the Axis Intelligence EU AI Act Compliance Readiness Index (ACRI), the EU AI Act ecosystem scored 30.4/100 in Q2 2026, reflecting widespread enterprise unpreparedness and fragmented national enforcement infrastructure.” — Axis Intelligence Research, June 2026. See full methodology at https://axis-intelligence.com/eu-ai-act-compliance-statistics/

Enforcement Timeline and Regulatory Architecture

Understanding EU AI Act compliance statistics begins with the regulatory clock. The Act (Regulation EU 2024/1689) entered into force August 1, 2024, but applies in phases. The European Commission’s official implementation timeline is the foundational reference.

Milestone	Date	Status
Act enters into force	August 1, 2024	✅ Done
Prohibited AI practices enforceable	February 2, 2025	✅ Active
GPAI model rules + governance deadline	August 2, 2025	✅ Active (fragmented)
High-risk systems: Annex III (standalone)	Originally August 2, 2026 → December 2, 2027 (AI Omnibus)	⚠️ Deferred
Transparency/watermarking (Article 50)	August 2, 2026 (partially deferred to December 2, 2026 for existing systems)	⚠️ Partial deferral
High-risk systems: Annex I (product-embedded)	August 2, 2028 (AI Omnibus)	⚠️ Deferred
Legacy public-sector systems	August 2, 2030	🔲 Pending

Source: EU AI Act Service Desk — Official Implementation Timeline (European Commission); European Parliament Legislative Train — Digital Omnibus on AI

The AI Omnibus: What changed on May 7, 2026

The EU Council and European Parliament reached a provisional political agreement on the Digital Omnibus on AI (AI Omnibus) on May 7, 2026, following a failed first trilogue on April 28, 2026. The agreement introduces fixed deadline extensions:

• Standalone Annex III systems (recruitment AI, credit scoring, law enforcement tools, biometrics, educational assessment, border control): August 2, 2026 → December 2, 2027
• Annex I product-embedded systems (medical devices, machinery, vehicles with AI components): August 2, 2027 → August 2, 2028
• Watermarking obligations (Article 50(2)): delayed to December 2, 2026 for systems already on market before August 2026
• New prohibition added: AI systems generating non-consensual intimate imagery (NCII) and child sexual abuse material (CSAM) now explicitly banned

The Omnibus is a deferral, not a dismantling. The Act’s risk-based architecture, governance structure, and core obligations remain unchanged.

Source: Council of the EU Press Release — May 7, 2026; Addleshaw Goddard AI Omnibus Analysis

Enterprise Compliance Readiness Statistics

This section compiles the most credible, primary-sourced readiness data available as of Q2 2026.

2A. Overall Preparation Rate

Study	Date	Sample	Key Finding
Deloitte Legal Germany AI Act Survey	September 2024	500 AI decision-makers (German firms)	26.2% actively preparing; 48.6% had not seriously engaged
Vision Compliance 2026 Readiness Analysis	April 2026	Enterprise assessments across 8 EU industries	78% had taken no meaningful compliance steps
Cloud Security Alliance Research Note	March 2026	Cross-industry EU enterprises	>50% lacked a basic AI system inventory
appliedAI enterprise study	2025	106 enterprise AI systems	40% had unclear risk classifications
Deloitte State of Gen AI (Europe, risk/governance)	June 2024	700+ senior leaders (FR, DE, IT, NL, ES, UK)	Only 18% rated themselves highly prepared on risk and governance

Source: Deloitte Legal Germany Survey — September 2024; Cloud Security Alliance Research Note — March 2026

2B. The AI Inventory Gap

The AI inventory is the logical precondition for all compliance work. You cannot classify risk, scope a conformity assessment, or produce technical documentation without first knowing what AI systems you operate.

Metric	Value	Source
Organizations with systematic AI inventory	<50%	CSA, March 2026
Organizations without any inventory	>50%	CSA, March 2026
Enterprise AI systems with unclear risk classification	40%	appliedAI, 2025
EU AI startups overestimating high-risk classification	33% believe their system is high-risk; EU Commission estimates only 5–15% of AI systems actually qualify	artificialintelligenceact.eu compliance checker
Organizations without designated internal AI compliance owner	74%	Vision Compliance, April 2026
Organizations without technical documentation process for high-risk systems	61%	Vision Compliance, April 2026

Source: Cloud Security Alliance Research Note PDF — March 2026; EU AI Act Compliance Checker — artificialintelligenceact.eu

Penalty Structure and Financial Exposure

The EU AI Act’s penalty architecture exceeds GDPR in maximum severity for the most serious violations.

Violation Category	Maximum Fine	Source
Prohibited AI practices (Article 5)	€35 million or 7% of global annual turnover (whichever is higher)	Regulation EU 2024/1689, Article 99
High-risk AI non-compliance	€15 million or 3% of global annual turnover	Regulation EU 2024/1689, Article 99
Incorrect information to authorities	€7.5 million or 1.5% of global annual turnover	Regulation EU 2024/1689, Article 99
GDPR maximum (for comparison)	€20 million or 4% of global annual turnover	GDPR Article 83

Key comparison: The AI Act’s 7% cap for prohibited practices exceeds GDPR’s maximum 4%. Any organization treating AI Act penalties as equivalent to GDPR exposure is materially underestimating financial risk.

Source: EUR-Lex — Regulation EU 2024/1689 Full Text

Compliance Cost Statistics by Organization Size

Compliance cost data varies significantly by organization size and the number of high-risk AI systems in scope. The figures below represent published estimates from recognized advisory organizations.

Organization Category	Initial Compliance Cost Estimate	Annual Ongoing Cost	Primary Source
Large enterprises (>€1B revenue) with high-risk systems	$8–15 million	Not separately disclosed	ai2.work / Vision Compliance 2026
GPAI model providers (foundation model operators)	$12–25 million (first year)	Not separately disclosed	ai2.work estimate
Mid-size companies	$2–5 million initial	$500K–$2M annually	Axis Intelligence Research synthesis
SMEs (Small and Medium Enterprises)	$500K–$2M initial	Reduced under Act’s proportional provisions	EU AI Act Article 55
Third-party conformity assessment (per system)	€5,000–€50,000 (internal); €50,000+ (third-party notified body)	Recurring per certification cycle	CEPS compliance cost study
Quality Management System setup (provider of high-risk AI)	€193,000–€330,000 + €71,400/year maintenance	€71,400	CEPS: Clarifying Costs of the EU AI Act
EU digital regulations total annual compliance burden (all firms)	$2.2 billion/year	Ongoing	European Commission impact assessment

SME provisions in the Act’s text: Article 55 of Regulation EU 2024/1689 mandates that conformity assessment fees be proportional to SME size. The AI Omnibus extended equivalent provisions to Small Mid-Cap enterprises (SMCs: 250–3,000 employees, turnover up to €1.5B).

Source: CEPS — Clarifying the Costs for the EU’s AI Act; EU AI Act Article 55 (SME provisions) — EUR-Lex

5. Sector-by-Sector Compliance Exposure

Not all industries face equal compliance pressure. High-risk AI classification under Annex III determines which organizations face the heaviest obligations. The sectors below have disproportionate exposure.

The Axis Intelligence EU AI Act Sector Exposure Matrix — Q2 2026

Original cross-source analysis. This sector-level exposure ranking does not appear in this form in any single published report.

Methodology: Each sector is scored on three dimensions: (1) density of Annex III high-risk use cases deployed, (2) AI adoption rate per McKinsey State of AI 2025, (3) current compliance readiness indicators from sector regulators. Scores are indexed 0–10.

Sector	Annex III Exposure	AI Adoption Rate	Compliance Readiness Signal	Axis Exposure Score
Financial Services (credit scoring, insurance pricing, AML)	Very High — creditworthiness AI explicitly listed	High (fraud detection, AML, customer onboarding dominant)	EBA: most AI use cases in banking are high-risk	9.2 / 10
Healthcare & Medical Devices	Very High — MDR/IVDR-regulated AI = automatic high-risk	High (diagnostics, triage, surgical robotics)	No major enforcement yet; gap analyses ongoing	8.8 / 10
HR & Recruitment	High — CV screening, performance evaluation listed	High (35–45% of companies use AI in hiring)	No designated AI compliance owner in 74% of firms	8.4 / 10
Law Enforcement & Justice	High — risk assessment, evidence evaluation, biometrics	Moderate	Italy most advanced; France and Germany still building enforcement bodies	8.1 / 10
Education & Vocational Training	Medium-High — admissions, exam scoring, outcome assessment	Growing	Minimal sector-specific readiness data	7.2 / 10
Critical Infrastructure (energy, transport, water)	High — grid management, traffic AI	Moderate	NIS2 overlap creates dual-compliance complexity	7.0 / 10
Retail & E-commerce	Low-Medium — primarily minimal/limited risk	Very High	Largely outside Annex III unless biometrics used	3.4 / 10
Consumer Tech (hardware AI)	Medium — product-embedded AI (Annex I)	High	Deadline extended to August 2028 under Omnibus	5.1 / 10

Sources cross-referenced: Annex III — EU Artificial Intelligence Act Official Text; EBA Factsheet — AI Act Implications for Banking (November 2025); Vision Compliance April 2026 Readiness Analysis

National Implementation Statistics: Member State Readiness

The EU AI Act requires member states to designate national competent authorities (NCAs) by August 2, 2025. The failure rate on this obligation directly predicts enforcement fragmentation.

Metric	Value	Source
Member states having formally notified a single point of contact to the Commission	8 of 27 (29.6%)	IAPP EU AI Act Regulatory Directory; aiacto.eu analysis (January 2026)
Member states with both market surveillance AND notifying authorities fully designated	3 of 27	artificialintelligenceact.eu national implementation tracker (May 2025)
Member states with pending proposals or partial designation	~10	artificialintelligenceact.eu national implementation tracker
Member states that missed any element of the NCA deadline (broader count)	at least 12	Lexology analysis of Digital Omnibus debates (March 2026)
Member states without single point of contact (November 2025)	19 of 27	Lexology / Responsible AI Labs
Member states without enacted national AI legislation (November 2025)	France, Germany, Ireland (among others)	Technology’s Legal Edge analysis

Note on member state figures: These metrics measure different things and should not be conflated. “8 of 27” refers to states that formally notified a single point of contact to the Commission — the most commonly cited benchmark. “At least 12” refers to states that missed any element of the NCA designation requirement under the broader interpretation used in the Digital Omnibus legislative debates. Both figures are accurate; the difference reflects measurement scope, not a data conflict.

Country-level highlights:

Country	Status	Notes
Italy	Most advanced	National AI Law No. 132/2025 entered force October 10, 2025; criminal penalties for unlawful deepfake dissemination
Spain	Advanced	AESIA (AI Supervisory Agency) established early
Ireland	Advanced (authority structure)	15 competent authorities designated, 9 fundamental rights authorities
Germany	Delayed	KI-Marktüberwachungsgesetz (KI-MIG) draft submitted; BNetzA designated as main authority
France	Delayed	NCA designation provisions withdrawn from DDADUE bill; status unclear as of early 2026
Belgium	Delayed	Missed August 2025 deadline; only an Advisory Committee on Ethics established

Source: IAPP EU AI Act Regulatory Directory; artificialintelligenceact.eu — National Implementation Plans Overview

GPAI (General-Purpose AI) Model Statistics

The General-Purpose AI (GPAI) rules under the AI Act represent a separate compliance track, primarily affecting foundation model providers. These obligations became applicable August 2, 2025.

Metric	Value	Source
GPAI model rules application date	August 2, 2025	EU AI Act Article 111; EU Commission
Stakeholders contributing to EU GPAI Code of Practice	1,000+	European AI Office, 2025
Systemic risk threshold (GPAI models)	>10²⁵ FLOPs training compute	EU AI Act Article 51
Estimated organizations affected by GPAI obligations	Primarily large foundation model providers (OpenAI, Google DeepMind, Meta, Anthropic, Mistral AI and others with EU market exposure)	EU AI Office

Source: EU AI Act Article 111 — EUR-Lex; European AI Office — GPAI Code of Practice

Standardization and Technical Infrastructure Gap

One of the primary drivers of the AI Omnibus deferral was the late arrival of harmonized standards. Without these standards, organizations cannot use the “presumption of conformity” pathway — the main route for demonstrating compliance without a notified body.

Metric	Value	Source
prEN 18286 (primary harmonized AI standard) inquiry date	October 2025 — 8 months late relative to compliance need	CSA Research Note, March 2026
Time between standards finalization and original August 2026 deadline	<12 months — too compressed for most organizations	CSA Research Note, March 2026
High-risk AI systems requiring third-party notified body assessment	~30–40%	CEPS compliance cost analysis
Internal conformity assessment cost reduction vs. third-party	15–25% lower cost (but requires strong in-house expertise)	CEPS
Documentation as share of total conformity assessment cost	Up to 40%	SQ Magazine compliance cost analysis
Time-to-market delay from conformity assessment	3–6 months per system	SQ Magazine compliance cost analysis

Source: CSA Research Note PDF — March 2026; CEPS — Clarifying Costs for the EU’s AI Act

Economic Impact Projections

Metric	Projection	Timeframe	Source
EU AI market size	€200 billion	By 2030	EU Commission impact assessment
Annual compliance savings from risk mitigation	€10–20 billion	Per year, post-compliance	EU Commission impact assessment
EU digital regulations total annual compliance cost	$2.2 billion/year	Current (all digital regs)	European Commission
AI governance platform market spending	$492 million	2026	Gartner, February 2026 (via ai2.work)
High-skilled compliance and auditing jobs created	20,000	Projected	EU Commission
EU AI market growth from legal certainty	+25% investment increase projected	2025–2027	EU Commission impact assessment
Additional regulatory overhead on all AI spending	17% overhead estimate	Over implementation period	CEPS analysis of Commission impact assessment

Note on the 17% overhead figure: CEPS has clarified that this number represents the upper-bound cost estimate from the Commission’s impact assessment and assumes no existing compliance infrastructure. Real-world overhead for organizations with existing QMS and data governance frameworks will be lower.

Methodology

Data collection

Axis Intelligence Research compiled this dataset between May 15 and June 7, 2026, through systematic review of primary sources: official EU regulatory publications, academic papers, named advisory firm studies, and sector regulator factsheets. No secondary aggregators (tech blogs, news compilations) were used as sources; where secondary sources referenced primary studies, we retrieved and cited the original primary document.

Original metrics

The Axis Intelligence EU AI Act Compliance Readiness Index (ACRI) and the Axis Sector Exposure Matrix are original calculations. The ACRI is a weighted composite of five independently sourced indicator dimensions. The Sector Exposure Matrix cross-references Annex III category density, sector AI adoption rates, and available regulator readiness signals. Neither metric exists in this form in any single external publication.

Source quality standards

All cited statistics are sourced from: European Commission and EU institutional publications (EUR-Lex, EC Digital Strategy, EBA, AI Act Service Desk); named advisory organizations with disclosed methodology (Deloitte Legal Germany, CEPS, Vision Compliance, Cloud Security Alliance); or academic/institutional research with identified authors and institutional affiliations. Statistics that could not be verified against a named primary source are excluded.

Limitations

• Deloitte Legal Germany data (September 2024) predates 18 months of implementation activity; it is the most-cited baseline readiness figure available but should be understood as a starting point, not a current readiness figure.
• The Vision Compliance April 2026 analysis covers eight industries assessed by one advisory firm; it is a signal, not a census.
• ACRI dimension weights are editorial judgments based on relative compliance criticality; reasonable experts may weight dimensions differently.
• The AI Omnibus provisional agreement (May 7, 2026) has not yet been formally adopted or published in the Official Journal as of this article’s publication date; timelines are based on the agreed provisional text.
• Compliance cost ranges represent estimates from advisory organizations; actual costs vary by organization size, existing governance infrastructure, number of in-scope AI systems, and sector.

About This Dataset

Update cadence: Quarterly (next update: September 1, 2026) License: Creative Commons Attribution 4.0 International (CC BY 4.0) Dataset download: https://axis-intelligence.com/wp-content/uploads/2026/06/eu-ai-act-compliance-statistics-2026.csv Coverage: EU-27 enterprises, EU regulatory institutions, named advisory organization studies Snapshot date: June 7, 2026

Use of this data in research, journalism, or publications is permitted under CC BY 4.0 with attribution to Axis Intelligence Research and a link to https://axis-intelligence.com/eu-ai-act-compliance-statistics/.

Citation Block

How to cite this research

APA (7th edition) Axis Intelligence Research, & Mitchell, S. (2026, June 7). EU AI Act compliance statistics 2026. Axis Intelligence. https://axis-intelligence.com/eu-ai-act-compliance-statistics/

MLA (9th edition) Axis Intelligence Research and Sarah Mitchell. “EU AI Act Compliance Statistics 2026.” Axis Intelligence, 7 June 2026, https://axis-intelligence.com/eu-ai-act-compliance-statistics/.

Chicago (17th edition) Axis Intelligence Research and Sarah Mitchell. “EU AI Act Compliance Statistics 2026.” Axis Intelligence, June 7, 2026. https://axis-intelligence.com/eu-ai-act-compliance-statistics/.

Copy-to-clipboard tip: Click the citation format above, select all text, and paste directly into your reference manager (Zotero, Mendeley, EndNote).

Embed Block — Cite This Research

Copy and paste the following HTML to embed the Axis Intelligence EU AI Act ACRI visualization on your site. Every embed includes a do-follow attribution link back to this article.

<div style="border:1px solid #e0e0e0;border-radius:8px;padding:20px;max-width:600px;font-family:sans-serif;">
  <p style="font-size:13px;color:#555;margin:0 0 8px;">EU AI Act Compliance Readiness — Q2 2026</p>
  <p style="font-size:32px;font-weight:700;margin:0;color:#1a1a1a;">30.4 / 100</p>
  <p style="font-size:14px;color:#333;margin:8px 0 4px;">Axis Intelligence EU AI Act Compliance Readiness Index (ACRI)</p>
  <p style="font-size:13px;color:#666;margin:0 0 12px;">78% of EU enterprises have taken no meaningful compliance steps. 8 of 27 member states designated enforcement authorities on time.</p>
  <a href="https://axis-intelligence.com/eu-ai-act-compliance-statistics/" 
     style="font-size:13px;color:#2563eb;text-decoration:none;"
     target="_blank" rel="dofollow">
    Full EU AI Act Statistics 2026 → Axis Intelligence Research
  </a>
</div>

Or embed the full dataset citation:

<blockquote cite="https://axis-intelligence.com/eu-ai-act-compliance-statistics/">
  "As of Q2 2026, the Axis Intelligence EU AI Act Compliance Readiness Index scores the EU AI Act ecosystem at 30.4/100 — with 78% of enterprises unprepared and only 8 of 27 member states having designated enforcement authorities on time."
  — <a href="https://axis-intelligence.com/eu-ai-act-compliance-statistics/" rel="dofollow">Axis Intelligence Research, EU AI Act Compliance Statistics 2026</a>
</blockquote>

---

Frequently Asked Questions

What is the EU AI Act compliance deadline in 2026?

The original August 2, 2026, deadline for standalone high-risk AI system obligations (Annex III) has been deferred to December 2, 2027, under the AI Omnibus provisional agreement of May 7, 2026. Prohibited AI practices have been enforceable since February 2, 2025. Transparency obligations under Article 50 still apply from August 2, 2026, for new systems, with a grace period to December 2, 2026, for systems already on the market.

What percentage of companies are ready for the EU AI Act?

Readiness data converges on a troubling picture: Vision Compliance (April 2026) found 78% of enterprises across eight industries had taken no meaningful compliance steps. Cloud Security Alliance (March 2026) found over 50% of organizations still lacked a basic AI system inventory. Deloitte Legal Germany (September 2024) found only 26.2% of companies had actively engaged with the regulation.

What are the penalties for non-compliance with the EU AI Act?

The highest tier of fines applies to prohibited AI practices: up to €35 million or 7% of global annual turnover, whichever is higher — exceeding GDPR’s 4% maximum. Non-compliance with high-risk AI requirements carries fines of up to €15 million or 3% of global turnover. Supplying incorrect information to authorities risks up to €7.5 million or 1.5% of turnover.

What is a high-risk AI system under the EU AI Act?

High-risk AI systems are defined in Annex III of Regulation EU 2024/1689. They include AI used in biometric identification, credit scoring, employment and recruitment screening, educational assessment, medical device functionality, law enforcement risk assessment, border control, and management of critical infrastructure. AI embedded in products regulated under EU product safety legislation (Annex I) is also high-risk. The European Commission has published classification guidelines to assist organizations.

What is the EU AI Act Digital Omnibus?

The Digital Omnibus on AI is a legislative amendment package proposed by the European Commission on November 19, 2025, and provisionally agreed by the EU Council and Parliament on May 7, 2026. It defers standalone high-risk AI deadlines to December 2, 2027, and product-embedded high-risk AI deadlines to August 2, 2028. It does not reduce the Act’s core obligations — only shifts timelines to allow standards and implementation tools to catch up.

Does the EU AI Act apply to non-EU companies?

Yes. The EU AI Act applies to any provider whose AI system is placed on the EU market or put into service within the EU, regardless of where the provider is established. This extraterritorial “Brussels Effect” means US, UK, Asian, and other non-EU companies with EU market exposure are subject to its requirements.

What is the difference between a provider and a deployer under the EU AI Act?

A provider is any entity that develops an AI system and places it on the market or into service — including companies that develop AI systems for their own internal use. A deployer is any entity that uses an AI system under its authority, including through their own products or services. Both roles carry distinct obligations under the Act; the split matters especially for enterprises that both buy third-party AI tools (deployer) and build their own (provider).

How does the EU AI Act interact with GDPR?

The two frameworks overlap significantly in data governance, bias detection, and documentation requirements. The EBA’s November 2025 factsheet on the AI Act and banking found no major contradictions between the two regimes, but noted that organizations may need to integrate the frameworks, particularly for high-risk AI systems that process personal data. Organizations with mature GDPR programs are demonstrably better positioned for AI Act compliance.

What are the EU AI Act requirements for SMEs?

SMEs receive explicit support under Article 55 of the Act: reduced conformity assessment fees proportional to size, priority access to regulatory sandboxes, simplified technical documentation templates, and dedicated communication channels. The AI Omnibus extended similar provisions to Small Mid-Cap enterprises (SMCs, 250–3,000 employees, turnover ≤€1.5B).

What is the GPAI Code of Practice?

The General-Purpose AI Code of Practice is a voluntary-but-influential self-regulatory instrument introduced by the European AI Office in 2025, developed with over 1,000 stakeholders. It provides compliance guidance for providers of GPAI models, particularly those with systemic risk (training compute >10²⁵ FLOPs). It is the primary compliance pathway for foundation model providers under the AI Act.