When does the EU AI Act high-risk system deadline take effect?+
August 2, 2026. On that date, the majority of the EU AI Act enters application — including high-risk system obligations under Annex III (Articles 9–17 for providers, Article 26 for deployers), Article 50 transparency rules, and national-level enforcement. Prohibited-practice bans (Article 5) have been in force since February 2, 2025; GPAI model obligations have applied since August 2, 2025. Organizations deploying high-risk AI should have tooling in place well before the August deadline — conformity assessment preparation routinely takes six months or more.
Did the European Commission delay the August 2026 deadline?+
Not as of April 2026. On November 19, 2025 the Commission proposed in its Digital Omnibus package to push certain Annex III deadlines to December 2, 2027, citing the late arrival of harmonised standards (the first relevant standard, prEN 18286 on quality management, only entered public enquiry on October 30, 2025). However, that proposal requires European Parliament and Council approval and has not been enacted. Major firms — Orrick, WilmerHale, DLA Piper, and the EU AI Office in its public guidance — advise treating August 2, 2026 as the binding date.
What are the fines for EU AI Act non-compliance?+
Three tiers under Article 99 of Regulation 2024/1689: prohibited practices (Article 5) — up to €35M or 7% of worldwide annual turnover, whichever is higher. High-risk and GPAI obligation violations (Articles 8–15, 51–56) — up to €15M or 3%. Supplying incorrect or misleading information to authorities — up to €7.5M or 1%. The percentage applies to total worldwide turnover for the preceding financial year, not EU-only revenue. SMEs and start-ups receive the lower of the absolute or percentage cap.
Can an existing GRC platform handle EU AI Act compliance?+
Existing GRC platforms handle documentation and evidence collection well for lower-risk systems. For high-risk AI under Annex III, technical requirements — bias testing, drift monitoring, data governance, post-market monitoring — require AI-specific capabilities GRC tools typically do not provide standalone. Credo AI or Holistic AI cover both dimensions; teams already on Vanta or Drata can extend with cross-mapping but should validate Article-level workflow depth during evaluation.
What is the typical cost range for EU AI Act compliance software?+
Publicly disclosed pricing where available: Scrut Automation from $15,000/year on AWS Marketplace; IBM watsonx.governance Standard SaaS at $0.60/resource unit; Drata at roughly $15,000–$60,000+/year per third-party data (Vendr); Modulos AI free starter, paid tier from CHF 15,000. Credo AI, Holistic AI, OneTrust, ServiceNow, Collibra, and Monitaur are enterprise-only with no public rates and require a sales conversation. Conformity-assessment legal review and Notified Body fees are separate from software costs and frequently exceed them.