The €63 million consolation prize

The European Commission announced a €63.2 million funding package on 21 April to support AI innovation in health and online safety. In the same month, European SMEs are reporting compliance costs of €160,000 to €330,000 per high-risk AI system under the AI Act, with large enterprises quoting $8–15 million in initial outlay to meet the 2 August 2026 full-enforcement deadline. Grok and parts of Meta's Llama ecosystem have already been pulled into early GPAI enforcement actions this year.¹

The numbers are worth sitting with for a moment. €63.2 million, spread across health and online safety, across the 27 member states, is roughly the compliance bill for 200 European SMEs deploying a single high-risk system each. It is, in other words, a rounding error against the cost the same Commission is imposing on the firms it says it wants to help.

€63.2 million, spread across health and online safety, across the 27 member states, is roughly the compliance bill for 200 European SMEs deploying a single high-risk system each.

I don't think this is hypocrisy. I think it's something more interesting, and worse: it's what happens when a regulatory regime is designed around the assumption that AI is a capability problem, at a moment when AI has become a deployment problem.

The shape of the asymmetry

Start with who pays what. A European SME building a hiring-adjacent tool, or a diagnostic-support product, or a fraud-detection system, all high-risk categories under Annex III, is looking at something between €160,000 and €330,000 to get a single system through conformity assessment, documentation, post-market monitoring, and the quality management system the Act requires. That is not a one-time cost; a meaningful portion recurs.

A US hyperscaler looks at $8–15 million and books it. It's a line item. It's less than the Q1 inference bill for a mid-sized product. The compliance team that handles it already exists and is already being paid.

What this means, in practice, is that the Act is a tax with a steeply regressive structure. Not regressive in the headline rate, a GPAI obligation lands on OpenAI harder than on a three-person startup in absolute euros, but regressive in the share of operating budget it consumes, and therefore in the share of engineering attention it diverts from the thing the business is actually trying to do. A 12-person European health-AI company spending €250,000 and six months of its senior engineers' time on conformity documentation is not building product during those six months. Anthropic is.

The €63 million is meant to close this gap. It does not close this gap. It gestures at it.

What the Commission thinks it's regulating

The AI Act, read carefully, is a product-safety regime. Its architecture, risk tiers, conformity assessment, CE marking, notified bodies, post-market surveillance, is lifted almost wholesale from the regulatory apparatus that governs medical devices and machinery. This is not a criticism on its own terms. That apparatus works, more or less, for the things it was built for.

The assumption underneath it is that AI systems are discrete, classifiable artefacts: you build one, you assess it, you place it on the market, you monitor it. The regulated unit is the system.

This is already the wrong unit, and it's getting more wrong every month. The systems being deployed in European enterprises right now are not discrete artefacts. They are compositions: a frontier model accessed via API, wrapped in retrieval over the customer's data, orchestrated through a handful of MCP connections to internal systems, with agents calling other agents. The "high-risk system" is a runtime assembly that may not have existed in that configuration yesterday and may not exist in that configuration tomorrow.

Conformity assessment assumes something stable enough to assess. Agentic deployments, by design, aren't. You can certify the model. You can certify the wrapper. You cannot meaningfully certify the emergent behaviour of the composition, and the Act's current guidance on this is, being generous, in development.

Who benefits, and who knew they would

The firms best-placed to absorb this regime are the ones with: large existing compliance functions, frontier models whose training they can document in the form the Act wants, and the legal resources to shape the implementing acts and codes of practice as they're written. Those firms are, overwhelmingly, not European.

The early GPAI enforcement actions against Grok and parts of the Llama ecosystem are worth reading in this light. They are not evidence that the Act hits US firms hardest. They are evidence that the Act hits the US firms that haven't invested in the European compliance stack. The ones that have, OpenAI, Anthropic, Google, are moving through it. Painfully, expensively, but they are moving through it, because they can afford to.

The European SME cannot afford to move through it at the same speed. So it does one of three things: it descopes its product to stay out of Annex III; it relocates its go-to-market to the UK, the US, or Singapore; or it sells to a US acquirer who can absorb the compliance cost as a fixed overhead on a much larger revenue base. All three outcomes are visible in the 2025–26 data, and all three reduce the European AI footprint the €63 million is notionally funding.

What the funding actually buys

I want to be fair to the Commission here. €63.2 million for health and online-safety AI is not nothing. It will fund real research. Some of it will produce useful work.

But it is not a counterweight to the compliance regime. It cannot be. The compliance regime is a structural cost imposed on every firm deploying a high-risk system; the funding is a discretionary grant to a small number of selected projects. One is a tax on deployment breadth; the other is a subsidy on deployment depth in two narrow verticals. They do not cancel.

If the Commission's actual goal is European AI adoption, and the White Paper rhetoric says it is, the binding constraint is not research funding. The binding constraint is that the 12-person company cannot afford the compliance overhead, and the 12-person company is where adoption happens, because adoption happens wherever the technology gets close enough to a specific problem for someone to solve it.

The €63 million doesn't change that. It was never going to. What would change it is a genuinely tiered compliance regime, one where conformity cost scales with revenue or deployment scale, not with system count. That is not what the Act does. It is not, on current evidence, what the Act is going to do.

The deadline is 2 August. The asymmetry is the policy.

Footnotes

¶