The EU AI Act Was Built for Big Tech.
Not for You.

The EU AI Act is the world's first comprehensive AI regulation. It was designed with good intentions — trustworthy AI, fundamental rights, safety. But the compliance costs it imposes are threatening to wipe out the very companies driving European AI innovation: startups and SMEs. Here's what the data says, and why this problem is more urgent than most founders realise.

The Numbers Are Alarming

When the EU published its impact assessment for the AI Act, it estimated that compliance would add roughly 17% overhead to AI spending for companies developing high-risk systems.¹ That sounds abstract until you translate it into real money for a company with 20 employees and a tight runway.

• €400K
  Maximum compliance cost for a single high-risk AI system including a Quality Management System.
  Source: EU Commission Impact Assessment / CEPS Study
• €12K
  Estimated per-system compliance cost for a 45-person AI recruitment company — equal to 20% of quarterly R&D budget.
  Source: AI Policy Bulletin, 2025
• 60%
  EU and UK tech startups and SMEs facing delayed access to frontier AI models due to regulation.
  Source: ACT | The App Association Survey, Oct 2025
• €322K
  Maximum annual losses per SME from regulatory delays and compliance burden.
  Source: ACT | The App Association Survey, Oct 2025

For context: the median EU tech SME has annual revenue of around €2.15 million. A €400,000 compliance bill is not a rounding error — it is a company-ending event for many.

What the Act Actually Requires

The EU AI Act takes a risk-based approach. Not all AI systems are treated equally — the higher the potential harm, the stricter the requirements. The critical threshold for most AI companies is the high-risk classification.

High-risk AI systems — those used in critical infrastructure, employment, education, credit scoring, law enforcement, and several other categories — must comply with:

Requirement	What it means in practice	Estimated cost	Risk level
Risk Management System (Art. 9)	Continuous process to identify, analyse and mitigate risks throughout the AI lifecycle	€6,000–€7,000	High-risk
Quality Management System (Art. 17)	Full QMS covering data governance, testing, monitoring and corrective action procedures	€193K–€400K	High-risk
Technical Documentation (Art. 11)	Comprehensive documentation of training data, architecture, testing results, intended purpose	€3,500–€7,500	High-risk
Conformity Assessment (Art. 43)	Third-party or internal assessment demonstrating the system meets all Act requirements	€3,500–€7,500	High-risk
Human Oversight (Art. 14)	Technical measures ensuring humans can monitor, intervene and override the AI system	Variable	High-risk
Transparency (Art. 13)	Clear disclosure that users are interacting with AI; explainability of decisions	€1,000–€5,000	Limited risk

For a large enterprise with a dedicated legal team, a compliance department and existing ISO quality processes, this is manageable overhead. For a 10-person startup? It is an existential question.

The Compliance Clock Is Ticking

The Act rolled out in phases. Here is where we stand today:

• 1 August 2024 — Act enters into force. The EU AI Act is officially law and implementation begins.
• 2 February 2025 — Prohibited AI practices banned. Article 5 prohibitions enforceable: social scoring, manipulation, certain biometrics.
• 2 August 2025 — GPAI model obligations & penalties live. Fines up to €35M or 7% of global turnover now enforceable.
• 2 August 2026 (5 months away) — Full enforcement of high-risk AI system obligations. All high-risk AI systems must be fully compliant. This is the deadline most startups and SMEs are unprepared for.

The Innovation Paradox

Here is the cruel irony at the heart of this debate: the companies most likely to build the most innovative AI in Europe are also the companies least equipped to comply with the regulation designed to govern it.

Research published in AI Magazine (Wiley, 2025) confirms that compliance costs disproportionately affect SMEs, potentially stifling innovation and creating barriers to market entry.² Big tech can absorb these costs. For a startup, the same requirements can mean choosing between building the product and paying the lawyers.

Compliance cost as a proportion of quarterly R&D budget varies sharply by company size. A large enterprise (500+ employees) typically absorbs roughly 2% of quarterly R&D on compliance. A mid-size company (50–500 employees) absorbs around 10%. An SME or startup with fewer than 50 employees can face over 20% — sometimes significantly more for companies in early growth stages. The data point that crystallises this: a 45-person AI company estimated compliance at 20% of its entire quarterly R&D budget for a single high-risk system. (Source: AI Policy Bulletin, 2025.)

The result is a predictable market dynamic: large incumbents can afford to comply, thereby locking in their position. Startups, unable to absorb the costs, either exit the EU market, downgrade their products, or simply ignore the regulation and hope for the best.

None of these outcomes serve the stated goals of the EU AI Act. The regulation was meant to make AI trustworthy — not to make it the exclusive preserve of companies with in-house legal teams.

The Red Tape Problem Is Real

Beyond the financial cost, there is a less-discussed burden: the sheer complexity of the compliance process itself. A startup with a high-risk AI system must:

• Determine its precise classification under Annex III — which is ambiguous for many real-world systems
• Establish a formal risk management system with documented iterative processes
• Produce technical documentation covering training data provenance, model architecture, and test results
• Implement logging and record-keeping systems for automated audit trails
• Design and document human oversight mechanisms
• Register in the EU database for high-risk AI systems
• Undergo conformity assessment — internally or via a notified body
• Maintain all of the above on an ongoing basis, with updates for every significant model change

Without specialist knowledge, navigating this process takes 6–8 weeks of senior technical and legal time — for each system. A startup deploying three AI features has, in effect, a full-time compliance function it never budgeted for.

How Vigilens Fixes This

We built Vigilens because we believe this problem is solvable. The EU AI Act does not have to be a threat to innovation — it can be a competitive advantage, if you can demonstrate compliance fast and without burning your runway.

We are specifically built for SMEs and startups — the companies the regulation hurts most. We are not a compliance consultancy with an enterprise price tag. We are infrastructure that makes compliance a built-in function of building AI, not a separate and prohibitively expensive exercise.

The Bottom Line

The EU AI Act is here. Enforcement is real — fines of up to €35 million or 7% of global turnover are enforceable today for the most serious violations, and high-risk AI obligations arrive in August 2026. Ignoring the regulation is not a strategy.

But the answer is not to hand the compliance problem to expensive lawyers and consultants while your runway shrinks. The answer is to automate it — to make compliance a fast, continuous, affordable process that keeps you legal without distracting you from building.

That is what Vigilens is for. Start by finding out where you actually stand.