Who Can Afford to Comply

The European Commission announced yesterday that it will put €63.2 million behind AI innovation in health and online safety. The press release framed it as support, a bridge for European builders as the AI Act's full enforcement deadline of 2 August 2026 comes into view. A hundred days, give or take, until the regime that Europe has spent four years negotiating actually starts to bite across the board.

I've been reading the compliance estimates that have been circulating among European industry associations this spring, and I keep getting stuck on the same arithmetic. A European SME building a high-risk AI system, the category that covers, among other things, tools used in hiring, education, credit scoring, medical triage, and critical infrastructure, is looking at somewhere between €160,000 and €330,000 per system to get compliant.¹ A large enterprise, the kind that can absorb a legal team and a dedicated conformity function, faces an initial outlay in the range of $8 to $15 million.²

Those two numbers are, in a certain sense, doing the same thing: both are the price of admission to a regulated market. But they are not equivalent costs, and I don't think the conversation about the AI Act has yet reckoned with what that gap is going to do.

Those two numbers are, in a certain sense, doing the same thing: both are the price of admission to a regulated market.

€63.2 million spread across health and online safety, across a continent, is not a bridge. It is a gesture in the direction of one. The compliance cost for a single large enterprise building a handful of high-risk systems will exceed the entire announced package. The gesture is worth making, I'm not dismissing it, but it should not be confused with a policy response to the distributional problem the AI Act is about to create.

What the early enforcement tells us

The pattern of early 2026 enforcement is instructive. The first actions under the general-purpose AI obligations have landed on Grok, xAI's model, and on parts of Meta's Llama ecosystem, disputes over transparency documentation, training data disclosure, and the systemic-risk tier thresholds.³ These are the companies the Act was, in significant part, designed to discipline. They have the resources to contest enforcement, to litigate definitions, to restructure deployments, to wait out the rulemaking. Meta has been doing exactly that, withholding its multimodal models from the EU market while it fights the classification regime.⁴

What's striking is not that the big labs are being targeted. That's the Act working as advertised. What's striking is what the enforcement posture implies for everyone downstream.

If you are a German medtech startup with eleven employees and a diagnostic tool that falls under Annex III's high-risk category, the Act doesn't care that Meta can afford a conformity team of forty and you can afford to hire one part-time compliance consultant. The obligations are, in structure, the same. The proportionality mechanisms that were negotiated into the final text, regulatory sandboxes, simplified documentation for SMEs, the conformity assessment pathways, help at the margin. They do not close the gap between €330,000 and what an eleven-person company has in the bank.

I want to be careful here. The AI Act is not a bad law. I think the core premises, that high-stakes automated decisions should be auditable, that general-purpose models above certain capability thresholds warrant scrutiny, that people subjected to AI systems should have some rights, are correct. The alternative, which is what the United States has de facto chosen, is to let deployment outrun accountability and sort out the harms in litigation and journalism after the fact. That is not a better system; it is a system that pushes the costs onto the people who get misdiagnosed, wrongly denied, or algorithmically sorted out of opportunity, and lets the builders keep the upside.

The question is not whether to regulate. The question is who ends up able to operate inside the regulation, and who doesn't.

The shape of the squeeze

Three things are happening simultaneously, and they compound.

First, the fixed cost of compliance per system is high and largely non-scalable downward. A conformity assessment for a high-risk system requires documentation of training data, risk management processes, human oversight provisions, accuracy metrics, cybersecurity measures, and post-market monitoring. Much of that work is roughly the same whether your system is used by ten hospitals or ten thousand. The €160K floor that European SME associations are reporting is not a negotiation, it's what it costs to do the work competently.⁵

Second, the cost of not complying is asymmetric. For a large platform, a fine of up to 7% of global turnover is painful but survivable, and often cheaper than restructuring a product line. For a small firm, a fraction of that fine is terminal. This means smaller firms cannot rationally take the regulatory risk that larger firms can absorb. They comply fully or they exit the category. There is no middle position.

Third, the ambient cost of building AI systems in a compliance-heavy environment, the legal review, the documentation burden on engineers, the slower iteration cycle, falls disproportionately on firms whose entire headcount is smaller than a FAANG compliance team. A lawyer on retainer is a rounding error at Microsoft. At a twelve-person Lisbon startup, it is a product hire you didn't make.

Put these three together and you get a market structure I think is worth naming plainly: the AI Act, as currently resourced, is likely to accelerate consolidation in the European AI market at exactly the moment the Commission is announcing it wants to support European AI sovereignty.

This is not an argument that the Act should be weakened. It is an argument that the support structure is catastrophically underpowered relative to the regulatory burden it is supposed to cushion.

Who pays, who builds, who decides

When I ask the question I always ask of these shifts, who gains, who loses, who pays, who decides, the answers in this case are less satisfying than usual, because they're not a clean story of bad actors.

Who gains: consolidated incumbents, US and Chinese, and a small number of well-capitalised European firms that can absorb the compliance cost as a moat. Once you have paid your €15 million, you quite like the fact that your competitors have to pay theirs too. Regulatory compliance as a competitive strategy is old news in pharmaceuticals, finance, and aerospace. It is now arriving, on schedule, in AI.

Who loses: European small and medium AI builders, particularly in the high-risk categories where the regulatory burden is heaviest. Also: European public-sector deployers, hospitals, schools, municipal services, who were meant to be buying diverse, local, auditable AI systems and will increasingly find themselves choosing between a handful of large vendors who can afford the full conformity stack.

Who pays: in the first instance, European taxpayers underwriting compliance support programmes, training budgets, and sandbox infrastructure. In the second instance, European citizens, who will find their high-stakes AI decisions made by a narrower set of providers than the Act's drafters imagined. In the third instance, non-European builders in emerging markets who will find that "Brussels effect" compliance, the convergence of global standards on the EU baseline, has raised the floor everywhere, on terms set by the firms that could afford to help write the Act.

Who decides: this is the part that I think gets least examined. The Commission is, at this stage, largely hearing from firms and associations that have the resources to participate in consultations, technical working groups, and implementation dialogues. The eleven-person diagnostic startup is not at those meetings. Neither is the Estonian municipal IT department trying to figure out whether its scheduling tool has just become a high-risk system. The people designing the guidance are, in a structural sense, designing it for the firms whose lawyers show up.

I'm not accusing anyone of bad faith. The Commission's stated intent, across multiple documents, is to protect exactly the constituencies I'm saying are being squeezed. But intent and consequence diverge when the tools aren't resourced. €63.2 million, against a compliance burden in the billions, is not a serious attempt to close that gap.

The inevitability framing I don't accept

There's a version of this argument that says: well, this is just what regulation costs. Every industry goes through this. GDPR squeezed small adtech firms too, and the market sorted itself out. Welcome to being a regulated sector.

I don't find that convincing, and I think it's worth saying why.

GDPR's compliance burden for a typical small firm was in the low tens of thousands of euros, with readily available templated tools and a strong ecosystem of affordable consultancies that emerged within a couple of years.⁶ The AI Act's per-system cost for high-risk categories is an order of magnitude higher, the methodologies are newer, and the ecosystem of affordable compliance support is substantially less mature. The comparison flatters the Act.

More importantly, the "this is just what regulation costs" framing assumes the current cost structure is fixed. It isn't. Much of the compliance burden is high because standards are still being written, notified bodies are thin on the ground, documentation templates are not yet standardised across member states, and every firm is essentially paying to build its own conformity infrastructure from scratch. This is a solvable problem. It requires funding the standards bodies properly, accelerating the buildout of notified body capacity, and, this is the part the €63.2 million announcement does not do, directly subsidising SME conformity assessments for an initial period while the ecosystem matures.

The Commission knows all of this. The question is whether it will fund what it knows.

What to watch

Three indicators over the next hundred days, before full enforcement on 2 August, that will tell us which way this is going.

First, whether the Commission moves on meaningful SME conformity support, not €63 million in innovation grants, but direct underwriting of conformity assessment costs for firms below a revenue threshold, similar to what exists in medical devices for certain categories. If that doesn't arrive before August, it probably isn't coming, and the squeeze plays out as currently structured.

Second, the market exit signal. Watch for European SMEs in high-risk categories either pivoting out of those use cases, relocating operations outside the EU, or being acquired by larger firms in the twelve months around the enforcement date. Some of this is already visible in the medtech and edtech sectors. The acquisition route, in particular, is worth tracking, it's the quiet form of consolidation, and it tends to look on paper like a success story for the firms being acquired.

Third, the downstream deployer effect. Hospitals, schools, and municipalities across the EU are in the middle of multi-year AI procurement cycles. If their shortlist of viable vendors shrinks substantially over the next eighteen months, if the Estonian municipality ends up choosing between three American providers and one German one, rather than a dozen local options, then we will know the Act has, in its first generation, succeeded at everything except the thing the Commission most wanted it to do.

What's actually at stake

I want to end where I started, which is with the arithmetic. €63.2 million is not a policy response to the distributional consequences of the AI Act. It is a communications response. The policy response, if the Commission wants one, is direct conformity subsidy at a scale that matches the compliance burden: billions, not tens of millions, and targeted specifically at firms under a size threshold in high-risk categories.

The alternative, and I think this is the path of least resistance, which is why it's the likely path, is a European AI market that looks, by 2028, substantially more consolidated than the one the AI Act's drafters imagined, dominated by a small number of firms whose regulatory compliance functions have become a competitive advantage, with European public services buying from a shortlist that is shorter than it should be.

That outcome is not inevitable. It is a choice about what to fund. The fact that it will be presented, in 2028, as the natural working-out of a well-intentioned regulation does not make it natural. It makes it the version of the story that flatters the people who wrote the rules and the people who could afford to follow them.

I think the AI Act is, on balance, a better regulatory framework than the alternatives on offer. I also think that unless the support structure is rebuilt at something like a serious scale in the next hundred days, the people who were meant to be its beneficiaries, small European builders, public-sector deployers, citizens whose high-stakes decisions land in front of AI systems, will find themselves the ones paying for it.

That's worth saying clearly, while there's still time to do something about it.

---

Footnotes

Footnotes

1. European SME compliance cost range of €160,000–€330,000 per high-risk system, as reported in industry association estimates circulated in Q1 2026 and consistent with earlier Commission impact assessments for high-risk conformity assessment pathways. ↩

2. Large enterprise initial outlay estimate of $8–15M, covering legal, conformity infrastructure, documentation, and post-market monitoring systems across multiple high-risk products. ↩

3. Early 2026 enforcement actions under the GPAI obligations have focused on transparency and systemic-risk classification disputes involving Grok (xAI) and components of the Llama ecosystem. ↩

4. Meta's decision to withhold multimodal model releases from the EU market, citing regulatory uncertainty, has been publicly documented across 2024–2025 and extended into the 2026 enforcement window. ↩

5. The fixed-cost floor for high-risk conformity is driven by non-scalable documentation and assessment requirements under Articles 9–17 of the AI Act. ↩

6. GDPR comparative compliance-cost analyses from 2018–2020 consistently placed small-firm burdens in the low tens of thousands of euros, with a mature templated ecosystem emerging within roughly twenty-four months of enforcement. ↩

¶