Cost and resourcing planning for the AI Act should be built from the work, not from a headline figure. The work includes classification and screening, risk management, data governance, documentation, testing, human oversight design, conformity assessment, registration, post market monitoring and training. Each item needs named people, time, external advice where needed, and a review point. This guide does not state costs, fees or timelines, because those depend on the system, the conformity route, the standards, the notified body and the advisers. It gives a planning structure that lets a small firm estimate its own effort, record the actual effort, and revise the plan as the file develops.
What work drives AI Act cost?
The work that drives cost is the work required to produce evidence that a reviewer can test. Classification and screening require time to read the intended purpose, the system description and the legal provisions, and to record the reasoning. Risk management requires time to identify hazards, assess risks, design mitigations and record residual risk. Data governance requires time to describe data sources, quality checks, representativeness and limitations. Technical documentation requires time to write, review and maintain the file. Testing requires time to design tests, run them, record failures and retest. Human oversight requires time to design the interface, the training and the escalation arrangements. Conformity assessment requires time to prepare the file, to respond to notified body questions and to close findings. Post market monitoring requires ongoing time to collect data, review incidents and update the file. Training requires time to prepare material and to deliver it. Each of those items also requires the time of the people who review the work, because a file written by one person and never reviewed is weaker than a file that has been tested by a second pair of eyes. A plan that counts only the writing time, without the review and rework time, will understate the effort.
How should a small firm estimate its own effort?
A small firm should estimate effort by breaking the work into items, assigning each item to a named person or role, estimating the time in hours or days, and recording the assumptions. The estimate should be based on the system in front of the team, not on a figure taken from a blog, a vendor or another company. The team should ask: how many systems, how many versions, how much data, how many tests, how many reviewers, how many external advisers, and how many customer or authority questions are expected. It should estimate the first file, the review and rework, the conformity process, and the first year of post market monitoring separately, because those phases have different effort profiles. It should add contingency for findings, for standards changes and for questions that cannot be answered from existing evidence. The estimate should be recorded with the date and the person who made it, and should be revised when the actual effort is known. A plan that is never revised will become a record of optimism rather than a management tool. The estimate should also separate internal time from external cost, because the two are managed differently and because external cost without internal time will not produce a usable file.
For the broader regulatory framework, see SMEs, startups and open source overview.
What external costs should be budgeted for?
External costs can include legal advice, technical advice, standards purchases, testing, notified body fees, sandbox costs where applicable, training, and tooling for documentation, logging and monitoring. Legal advice should be budgeted for borderline classification, role and contract questions, not for every routine task. Technical advice should be budgeted for standards, testing and evaluation questions where the team does not have the expertise. Standards are paid documents in many cases, and the cost of the standards needed for the system should be checked with the standards body. Notified body fees should be confirmed at the start of the conformity process, with the SME proportionality provision in Article 62 raised explicitly. Testing costs depend on the testing required, the test environment and whether external test facilities are needed. Tooling costs depend on whether the team builds its own logging and monitoring or buys a tool, and on the ongoing cost of maintaining it. Each external cost should be recorded with the supplier, the scope, the date and the amount agreed, so that the total cost can be reconciled at the end of the project. No figure in this guide should be used as a budget, because no figure is stated and none should be inferred from general statements about proportionality.
How should resourcing be organised in a very small team?
In a very small team, the same person may design, build, test and document a system, which creates a review problem. The team should separate the roles as far as possible, even where the people are few. One person can write the file, and another person, whether internal or external, can review it. One person can design the test, and another can run it or review the results. The founder can be the person responsible for the launch, but should not be the only reviewer of the risk assessment. The team should name the responsible person for each duty, the reviewer, and the escalation route where the reviewer and the author disagree. It should schedule review points in the plan, with time protected for them, rather than treating review as an activity that will happen if time allows. It should also plan for absence, turnover and growth, so that the file does not depend on the memory of one person who may leave. A file that can be understood by a new joiner, without an oral briefing, is a file that will survive the growth of the team. A file that depends on oral knowledge will not.
What should be recorded about actual effort?
Actual effort should be recorded in the same structure as the estimate, so that the two can be compared. The record should show the hours spent by each person on each item, the external costs incurred, the findings raised and closed, the rework required, and the time taken for authority or customer questions. The record should be reviewed at the end of the project and at the end of the first year of post market monitoring, with lessons recorded for the next product. Lessons can include which tests were most useful, which documentation was most questioned, which standards were most difficult to apply, and which advice was most valuable. Those lessons should be used to revise the estimate for the next product, rather than repeating the same optimistic estimate. The record of actual effort also supports pricing, funding and investor discussions, because it shows the real cost of compliance for the system concerned. A record that shows only the external fees, without the internal time, will understate the cost and will mislead the next planning round.
Continue with proportionate duties and support.
What does this guide not estimate?
This guide does not estimate any cost, fee, timeline or headcount, and it does not state that compliance is cheap, expensive, easy or difficult in general. Costs and timelines depend on the system, the risk, the conformity route, the standards, the notified body, the advisers and the team. A small firm should build its own estimate from the work, confirm external costs with the suppliers concerned, and record the actual effort. A general guide that stated a figure would be misleading, because the figure would not describe the system in front of the reader. This guide gives the structure for planning, not the numbers for a budget.
Frequently asked questions
How much does AI Act compliance cost for an SME?
No general figure is given in this guide, and none should be inferred. Cost depends on the system, the classification, the conformity route, the standards, the notified body and the advisers. A small firm should estimate from the work items, confirm external costs with suppliers, and record actual effort against the estimate.
What is the largest hidden cost?
In practice, review and rework time is often understated, together with post market monitoring time in the first year. A plan that counts only writing time, without review, findings, retesting and monitoring, will understate the effort. The estimate should include review, rework and monitoring as separate items.
Should a small team hire a dedicated compliance person?
That depends on the number of systems, the risk and the growth plan. A very small team can work with named responsibilities, external review and external advice, provided that review is genuinely independent and time is protected for it. A team with several high risk systems, or with rapid growth, may need a dedicated role. The decision should be recorded with the reasons and reviewed as the portfolio grows.
Are notified body fees reduced for SMEs?
Article 62 requires fees to be reduced proportionately to size, market size and other relevant indicators, taking account of SME interests. It does not set a fee. The arrangement must be confirmed with the notified body or relevant authority at the start of the conformity process, with SME evidence and the fee scope recorded.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689 ↗AI Act Service Desk timeline ↗