AI Act cost and timeline depend on four things: your risk category, whether you are a provider or deployer, which conformity route applies, and how much documentation you already have. We give no prices because they vary too much. Here are the published dates, caps and drivers so you can scope your own work.
What are the dates?
The European Commission's AI Act page lists these milestones. The Act entered into force on 1 August 2024. Prohibited practices and AI literacy duties began on 2 February 2025, and general purpose AI obligations on 2 August 2025. General applicability is 2 August 2026. The AI Omnibus, in force from 27 July 2026, moved high-risk rules for Annex III use cases to 2 December 2027 and for AI in regulated products to 2 August 2028 (European Commission).
Dates have shifted before. Check the Commission page again before you plan against any of them.
What are the risk categories?
The Act sets four levels: unacceptable risk, which is banned, high risk, transparency risk and minimal risk. Most of the cost sits in high risk, where obligations include risk management, data quality, documentation, logging and human oversight. Transparency risk covers duties like telling people they are talking to a chatbot.
If your system is minimal risk, the work is mostly classification and a record of your reasoning.
What drives cost?
Classification effort. Deciding whether a system is high risk takes legal and technical reading. Do it early and write down the result.
Your role. Providers carry heavier duties than deployers. If you build on a third party model, you may be both for different parts.
Conformity route. Article 43 describes two paths. Internal control, where the provider checks its own compliance, applies to most Annex III areas. A notified body route, where an outside body assesses the quality system and technical documentation, applies to some biometric systems and where standards are missing or not fully applied (Article 43). The second adds external fees and waiting time.
Documentation gap. Teams with model cards, data lineage, test records and change logs spend less. Teams without them must build the records retroactively, which is slow.
Number of systems. Each system is its own assessment. An inventory tells you the size of the job.
Change rate. A substantial modification requires a new assessment, so fast changing systems keep the work going.
What is the penalty exposure?
Article 99 sets caps: up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 percent for other obligations, and up to 7.5 million euros or 1 percent for supplying incorrect information to authorities. For SMEs, the lower of the two figures applies (Article 99). Those are maximums, not predictions. That page shows two versions of one paragraph, so confirm against the official text.
What to do
- Inventory every AI system you build, buy or embed.
- Classify each by risk level and record your reasoning.
- Identify your role for each: provider, deployer or both.
- Check which conformity route applies to the high risk ones.
- Audit existing documentation against the high risk obligations and list the gaps.
- Build a timeline backward from the application date that applies to you.
- Get legal review before you rely on a classification.
Quick check
Does every AI system need a conformity assessment?
No. That applies to high risk systems. Minimal risk systems have no specific obligations, and transparency risk systems have disclosure duties.
Can you give an estimate in euros?
Not honestly. Cost depends on your systems, role and documentation. Use the drivers above to scope and request quotes.
Sources
Last reviewed: 18 October 2026.
