If your company uses AI and wants to know what complying with the AI Act will cost, it's the first question anyone asks, and it doesn't have a single answer in the form of a figure. Not because nobody wants to give one, but because the question isn't well posed: it asks for a number for something that's the product of three very unequal factors.
What can be given is what determines it, and three scenarios with their hypotheses in view, so that each organisation can put in its own and work out its figure.
Three scenarios, with the hypotheses in view
An order of magnitude helps decide where to start. The table gives three: an organisation of 20 people, one of 80 and one of 300, each with a different inventory. What separates them isn't headcount but what's in that inventory: how many systems, and how many of them are high-risk.
| Scenario | 20 employees | 80 employees | 300 employees |
|---|---|---|---|
| AI systems in the inventory(hypothesis) | 6 | 15 | 40 |
| Of which high-risk(hypothesis) | 0 | 1 | 3 |
| People who use AI (Article 4)(hypothesis) | 10 | 40 | 150 |
| Module covering what the classification requires | M1 Visibility | M3 High-Risk Ready | M3 High-Risk Ready |
| Platform users(hypothesis) | 3, within the 3 included | 6, within the 8 included | 12: 8 included + 4 additional |
| Inventory and classification, per system(hypothesis) | 2 h–4 h | ||
| Article 26 measures and documentation, per high-risk system(hypothesis) | 20 h–40 h | ||
| AI literacy, per person using AI(hypothesis) | 1 h–2 h | ||
| Cost of an internal hour(hypothesis) | €30–€60 per hour | ||
| Review cycle(hypothesis) | every six months | ||
| External support, per high-risk system(hypothesis) | €800–€2,000 | ||
| Billing cycle(hypothesis) | Figures for the annual cycle. A monthly card cycle exists at a different price; see /pricing. | ||
| Scenario | 20 employees | 80 employees | 300 employees |
|---|---|---|---|
| Internal hours, first year(hypothesis) | 22 h–44 h | 90 h–180 h | 290 h–580 h |
| Cost of those hours, first year(hypothesis) | €660–€2,640 | €2,700–€10,800 | €8,700–€34,800 |
| Alethexis subscription | €1,980 a year, VAT excluded (equivalent to €165 a month) | €3,960 a year, VAT excluded (equivalent to €330 a month) | €4,728 a year, VAT excluded (equivalent to €394 a month) |
| External support, first year(hypothesis) | — | €800–€2,000 | €2,400–€6,000 |
| Maintenance, hours per year(hypothesis) | 6 h–12 h | 23 h–46 h | 64 h–128 h |
How to read it:
- Internal hours, their cost and external support are hypotheses, and they're marked as such. They come from multiplying each column's inventory by the hours per unit in the first table; if your hours or your hourly cost differ, the result changes in the same proportion.
- The Alethexis subscription comes from the current prices, in euros per month, excluding VAT and billed annually. The module is the one that covers what the inventory's classification requires: with no high-risk systems, the visibility module is enough; with any, the one that includes their documentation.
- Maintenance is the work that repeats at each review — every six months in the hypotheses: checking that the inventory still holds and that the measures for high-risk systems are still in place.
- What the table leaves out: the provider's obligations, which aren't the deployer's; external training, if it's bought in; and the agents add-on.
No column is a quote, and the table doesn't compare with other ways of doing the work: it says how much work there is under those hypotheses, not how much is saved. The three factors below explain why the columns differ so much.
Factor 1 — how many systems, not how much company
Cost doesn't scale with headcount or turnover. It scales with the number of distinct AI systems the organisation uses.
A two-hundred-person company with three tools can have less work than a twenty-person one with fifteen, because each system is an independent unit of analysis: it has to be identified, understood, classified, and matched to what applies to it.
And this is where the first estimation risk shows up: it's easy not to know how many you have. The count that's done off the top of the head counts the AI that was deliberately bought. It doesn't count the AI features built into tools that were already there — like the software used to hire and evaluate people — nor the ones someone uses on their own without going through anyone.
So the first factor isn't estimated: it's counted. And counting is the part of the job that can't be skipped, because the other two factors are calculated on top of it.
Factor 2 — what each classification requires, which is the most unequal part
This is the factor that blows the total up or brings it down, and the one that's almost never explained well.
A minimal-risk system requires little: that the organisation takes measures to support the AI literacy of those who use it on its behalf (Article 4), and that its use doesn't fall under any prohibited practice in Article 5. If it also interacts with people or generates or manipulates content, the Article 50 transparency duties are added, split between the provider and the deployer. Documenting it properly is a matter of knowing what it is, who uses it, and for what.
A high-risk system requires, among other things, what Article 26 sets out: using it in accordance with its instructions, with technical and organisational measures; assigning human oversight to people with the necessary competence, training and authority, as well as the necessary support; monitoring its operation; keeping the logs it automatically generates, to the extent they are under the deployer's control, for at least six months unless applicable law provides otherwise; if the deployer is an employer, informing workers' representatives and the affected workers; and, for Annex III systems that make or assist in making decisions related to natural persons, informing those persons.
Article 26 applies from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for Annex I systems; it does not reach Annex I, Section B products.
And, if the deployer is a body governed by public law or a private entity providing public services, or deploys systems referred to in points 5(b) or (c) of Annex III, a fundamental rights impact assessment (Article 27), whose only date of application is 2 December 2027 and which only reaches Article 6(2) systems other than those in point 2 of Annex III.
The difference between the two columns isn't one of degree: it's one of kind. That's why the number that matters isn't "how many systems do I have" but "how many of them are high-risk" — and the answer may sit somewhere other than where people look.
Factor 3 — how much of this already exists
The third factor is the one nobody counts, and it's usually the one that cuts the most.
An organisation with reasonably solid GDPR practice already has a record of processing activities, a lawful basis for each one, contracts with processors and, where it applied, impact assessments already done. Part of what the AI Act asks for on those same systems can build on that material: Article 26(9) points deployers to the information provided by the provider for the data protection impact assessment under Article 35 GDPR, and Article 27(4) allows the fundamental rights impact assessment to include cross-references to that assessment or relevant parts of it, without replacing it.
The reverse also holds: an organisation starting from zero on data protection isn't doing one job for the AI Act. It's doing two, and the second one was already required before the first.
What does NOT determine the cost
Worth saying, because these are the three variables that come up most in conversations, and none of them drives it.
The sector, except for how it changes the classification. Belonging to a regulated one doesn't in itself raise the cost: it raises the cost if your systems fall under high risk through that route.
Urgency. The high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems, and the date still circulating in some guides is not the applicable one. Working against a deadline that doesn't exist doesn't change the work: it changes the price someone is willing to pay to have it done fast.
Size, except for its correlation with factor 1. More people usually means more tools, but that's a correlation, not a cause.
How to estimate it with your own inventory
Four steps, in this order, and the first two don't require buying anything.
Count the systems — including the ones that administer people and the ones someone uses on their own.
Separate the ones that decide something about people from the ones that only produce or assist. That's the cut that approximates much of Annex III before doing the classification formally; it misses the Article 6(1) route — safety components of Annex I products, or products under that Annex, that must undergo a third-party assessment — and critical infrastructure under point 2 of Annex III.
Look at what you already have documented on those systems through the GDPR route.
And only then ask about the cost, with those three data points in hand. Any quote requested before that point is being calculated on an inventory that doesn't exist — yours or someone else's.
What applies in the meantime, whatever the outcome turns out to be, is Article 4 on AI literacy, applicable since 2 February 2025 — rewritten by the Digital Omnibus without ceasing to be an obligation —; Article 5 since the same date, except the new points (ba) and (bb) of its paragraph 1, which apply from 2 December 2026; and, since 2 August 2026, Article 50 for systems that interact with people or generate or manipulate content (with a transitional period until 2 December 2026, for providers only, for the marking of systems placed on the market before 2 August 2026). None of that depends on any inventory, and it's the floor of any calculation.
Content in line with Articles 2, 4, 5, 6, 26, 27, 50, 111 and 113 and Annexes I and III of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (Official Journal of the EU, 24 July 2026).
This article is for informational purposes only and does not constitute legal advice.