The AI Act Implementation Challenge

The AI Act Implementation Challenge: Europe's Regulatory Leap into the Unknown

Analysis of Compliance Burdens, Enforcement Mechanisms, and Market Impact

Author: Victor Solé Ferioli, Founder & Director, Beresol

Date: June 2025

Location: Brussels, Belgium

---

Executive Summary

The EU Artificial Intelligence Act, the world's first comprehensive AI regulation, entered into force in August 2024 with a phased implementation timeline extending to August 2027. Controversial from the beginning, attacked especially by US large corporations such as Meta, Alphabet, or X, this law has been recently proposed a simplification reform by the Commission. As the first prohibitions stemming from the implementation of this law took effect in February 2025 and the AI Office has established its operational framework, significant compliance challenges are emerging across the AI value chain.

Key Findings:

Some basic information regarding this law:

• Phased implementation: prohibited practices banned from February 2025; General Purpose AI (GPAI) rules apply from August 2025; high-risk obligations from August 2026
• Compliance burden: an estimated 6000-7000 high-risk AI systems require conformity assessments... but this means that SMEs, especially, face disproportionate costs due to the new administrative burden
• Enforcement gaps: only 12 Member States have designated national competent authorities (NCAs) to comply with this law. The AI Office is now operating with circa 140 staff, but they have to monitor thousands of systems, algorithms, models...
• Classification disputes: 30%+ of AI providers contest their systems' risk categorisation, particularly in HR, finance, and biometrics
• Global divergence: the EU's AI Act has exposed the differences with the US, the UK, and China, all of which are pursuing fundamentally different regulatory approaches, creating fragmentation risks both in the market and the industry.

---

Table of Contents

1. Introduction
2. The AI Act Framework: A Tiered Approach
3. Implementation Timeline: Phased Obligations
4. The AI Office: Europe's New Regulatory Hub
5. High-Risk AI: Classification Challenges
6. General-Purpose AI: The Foundation Model Debate
7. Compliance Costs and Market Impact
8. Enforcement and Penalties
9. Global Regulatory Divergence
10. Conclusions and Recommendations
11. References

---

1. Introduction

1.1 Context

The Artificial Intelligence Act (Regulation (EU) 2024/1689) represents the European Union's attempt to establish global leadership in AI governance through the world's first comprehensive horizontal AI comprehensive law. Adopted in March 2024 after three years of negotiation, this Act applies a risk-based approach that categorises AI systems from unacceptable risk (prohibited) through high-risk (heavily regulated) to limited and minimal risk (transparency obligations only).

The regulation arrives at a critical juncture: generative AI capabilities have advanced faster than anticipated during the legislative process, forcing last-minute additions for general-purpose AI models and raising questions about regulatory adaptability. Vibe-coding, user-fetched data, algorithmically supervised or unsupervised agents are all becoming highly embedded into everyone's lives. Even if the EU may be seen as a giant who always arrives late to regulate, critics say that, this time, with the AI Act the EU has arrived to soon to regulate.

1.2 Scope

This report examines: (1) the AI Act's regulatory framework and risk tiers; (2) implementation timeline and current status; (3) AI Office operations and capacity; (4) high-risk classification challenges; (5) general-purpose AI provisions; (6) compliance costs; (7) enforcement mechanisms; and (8) global regulatory divergence.

---

2. The AI Act Framework: A Tiered Approach

The AI Act establishes four risk tiers determining regulatory obligations:

As of February 2025, the following AI applications are banned in the EU:

• Social scoring systems by public authorities
• Real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions)
• Emotion recognition in workplaces and educational institutions
• Biometric categorisation inferring sensitive attributes (race, political opinions, sexual orientation)
• Predictive policing based solely on profiling
• Facial recognition databases built through untargeted scraping
• Subliminal manipulation techniques causing harm
• Exploitation of vulnerabilities (age, disability, social/economic situation)

Annex III defines eight domains where AI systems are presumed high-risk:

1. Biometrics (remote identification, categorisation)
2. Critical infrastructure (traffic, water, gas, electricity)
3. Education (admissions, assessments, behaviour monitoring)
4. Employment (recruitment, promotion, termination decisions)
5. Essential services (credit scoring, insurance, emergency services)
6. Law enforcement (evidence evaluation, recidivism prediction)
7. Migration and border control (visa processing, asylum applications)
8. Justice and democracy (judicial decisions, election influence)

---

3. Implementation Timeline: Phased Obligations

Compliance milestones

As of June 2025:

• Prohibited practices: in effect since February 2025; limited enforcement activity reported
• AI Office: fully operational with ~140 staff; issued first guidelines on prohibited practices
• National authorities: only 12 of 27 Member States have formally designated competent authorities
• Standards development: CEN/CENELEC working on 10 harmonised standards; delays expected
• Codes of practice: GPAI Code of Practice under development with ~1,000 stakeholder participants.

AI systems already on the market before August 2026 benefit from transitional arrangements:

• Existing high-risk systems have until August 2027 to comply if significantly modified
• GPAI models placed on market before August 2025 have two years to comply
• Public authority systems receive additional flexibility for legacy system adaptation.

---

4. The AI Office: Europe's New Regulatory Hub

The AI Office, established within DG CONNECT in February 2024, serves as the EU's central AI regulatory body with direct enforcement powers over general-purpose AI models. It has the following organisational units, staffed by circa 140 persons (as of summer 2025):

• Regulation and Compliance Unit: GPAI model oversight, codes of practice
• AI Safety Unit: systemic risk assessment, incident monitoring
• AI for Societal Good Unit: innovation support, sandboxes
• AI Innovation and Policy Coordination Unit: international cooperation, research
• AI Office Business Operations: administrative functions.

Staffing and resources are divided as follows:

But the AI Office faces significant capacity constraints:

• Scope mismatch: ~140 staff to oversee an estimated 50+ GPAI model providers and coordinate 27 national authorities
• Technical expertise: competition with private sector for AI specialists. And there are also salary constraints and limited recruitment, also due to the sheer lack of efficiency seen in the Commission's EPSO service (which permeates the whole Commission workforce)
• Standards delays: harmonised standards are not expected before late 2026. There is too much reliance on codes of practice as interim measures
• Enforcement tools: full penalty powers untested, and no GPAI model investigations concluded as of yet.

---

5. High-Risk AI: Classification Challenges

Determining whether an AI system qualifies as high-risk has emerged as the Act's most contentious implementation challenge. Providers must self-assess against Annex III categories, with contested classifications subject to market surveillance authority review.

Article 6(2) creates ambiguity around systems that are "safety components" of products covered by existing EU legislation. Industry estimates suggest 40% of potentially high-risk systems claim exemption under this provision, arguing their AI is a component of already-regulated products.

One of the main criticisms on this law is about its exceptions, which further complicate classification:

• Research and development exemptions until market placement
• Open-source exemptions for non-commercial models (excluding GPAI with systemic risk, and this is much benefitted from China's innovate open-source models, since Chine is, by far, the leading open-source provider of the world, especially since the DeepSeek breakthrough)
• Military and national security complete exclusions (due to the need for the EU to innovate, scale, produce and break-even in terms of defence spending in a world where the Union faces stark geopolitical challenges)
• SME simplified procedures for conformity assessments (although SMEs face larger administrative burden due to the very same law).

---

6. General-Purpose AI: the foundation model debate

The AI Act creates a distinct regime for general-purpose AI models—systems trained on broad data that can be adapted for multiple downstream applications. This category, added late in negotiations, primarily targets foundation models like GPT-4, Claude, and Gemini.

Tiered GPAI obligations

FLOps? "FLOP" (another EU Bubble acronym) is a "FLoating-point OPeration", a single mathematical calculation involving real numbers (e.g., addition, multiplication): the cumulative number of FLOPs used to train an AI model is used as a proxy for its capability and potential systemic risk. The 10^25 FLOP threshold (from "FLoating-point OPeration") for systemic risk designation has proven controversial:

• Current capture: only ~5-7 models globally exceed threshold (i.e., GPT-4 and 5, Claude Sonnet and Opus models, Gemini Ultra and 3)
• Threshold criticism: compute alone may not predict risk and smaller fine-tuned models pose greater domain-specific risks
• Update mechanism: the Commission can revise threshold via delegated acts, but process takes 12+ months.

The AI Office launched GPAI Code of Practice development in September 2024:

• Participation: ~1000 stakeholders across four working groups participated in this project launched and monitored by the Commission's AI Office
• Scope: copyright compliance, transparency, systemic risk mitigation
• Timeline: final code expected came out on 10 July 2025 and provides compliance "safe harbour": https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai
• Tensions: model providers resist detailed disclosure; civil society demands algorithmic transparency.

---

7. Compliance Costs and Market Impact

Cost estimates

Early evidence suggests compliance costs may accelerate market concentration through intra-EU M&A processes... but also US- and China-led buy-outs:

• SME deterrence: 23% of EU AI startups report reconsidering high-risk applications
• Big Tech advantage: major providers can absorb compliance costs, whereas smaller competitors cannot. This is fresh and easy ground for the (already) larger incumbents, which are, normally, either American or Chinese
• Geographic arbitrage: some providers are considering non-EU market focus due to their antipathy towards the same law we are explaning in this open report.

Innovation impact assessment

---

8. Enforcement and penalties

Penalty structure

SMEs and startups receive proportionally reduced maximum penalties.

• National market surveillance authorities: primary enforcement for high-risk AI. So far, 12 of 27 Member States have designated their own monitoring and implementing authorities
• AI Office: this is the direct enforcement "authority" for GPAI models. It has a coordination role for cross-border cases
• European AI Board: this is the coordination body; issues guidance and opinions
• Scientific Panel: Independent expert advice on systemic risks.

As of June 2025:

• No major penalties issued under AI Act provisions
• 3 formal investigations opened into prohibited practice allegations (social scoring, workplace emotion recognition)
• 12 compliance notices issued to GPAI providers regarding documentation deficiencies
• 27 sandbox applications approved across 8 Member States.

---

9. Global regulatory divergence

Comparative approaches

EU-US divergence creates operational challenges for global AI providers:

• No adequacy framework for AI governance mutual recognition
• TTC AI working group progress limited; no binding outcomes
• Conflicting requirements: EU transparency rules may conflict with US trade secret protections
• Regulatory competition: US officials criticise AI Act as innovation barrier.

Multiple bodies competing for AI governance standard-setting:

• ISO/IEC JTC 1/SC 42: AI management standards (ISO 42001 adopted)
• IEEE: ethics and transparency standards
• OECD: AI Principles (non-binding)
• G7 Hiroshima Process: code of Conduct for advanced AI
• UN: Advisory Body recommendations pending.

---

10. Conclusions and Recommendations

The AI Act represents an ambitious attempt to establish enforceable AI governance, but implementation challenges threaten its effectiveness. Key tensions include:

1. Capacity-scope mismatch: regulatory resources inadequate for comprehensive oversight
2. Classification ambiguity: self-assessment model creates inconsistent risk determinations
3. Standards delays: harmonised standards unlikely before compliance deadlines
4. Innovation trade-offs: compliance costs may deter beneficial AI development, particularly by SMEs
5. Global fragmentation: divergent international approaches create compliance complexity and competitive distortions.

Recommendations

For the European Commission and AI Office:

• Accelerate harmonised standards development through emergency procedures
• Issue detailed classification guidance to reduce self-assessment disputes
• Establish compliance support programmes for SMEs and startups
• Pursue mutual recognition arrangements with like-minded jurisdictions.

For Member States:

• Urgently designate and resource national competent authorities
• Coordinate enforcement approaches to prevent forum shopping
• Establish regulatory sandboxes to support compliant innovation.

For AI providers:

• Engage proactively with classification determinations before enforcement
• Participate in codes of practice development to shape compliance standards
• Document AI system design choices to demonstrate good faith compliance
• Build compliance functions early; retrofitting is costlier.

For AI deployers:

• Conduct supply chain due diligence on AI system classifications
• Establish human oversight mechanisms for high-risk deployments
• Prepare incident reporting and fundamental rights impact assessment capabilities.

The AI Act's success will be measured not by its ambition but by its execution. The next 18 months—through August 2027 when full enforcement begins—will determine whether the EU has created a workable governance model or an innovation-constraining bureaucratic burden. The answer will shape not only European AI development but global regulatory convergence or fragmentation for decades to come.

---

11. References

European Parliament and Council (2024). Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act). OJ L 2024/1689.

European Commission (2024). Communication on AI Act implementation guidelines. COM(2024) XXX.

European Commission AI Office (2025). Guidelines on prohibited artificial intelligence practices. February 2025.

European Commission AI Office (2025). General-Purpose AI Code of Practice: First Draft. September 2025.

European AI Board (2025). Opinion on high-risk AI system classification. 2025.

CEN-CENELEC (2025). AI Act standardisation roadmap. JTC 21 Work Programme.

ISO/IEC (2023). ISO/IEC 42001:2023 Artificial intelligence management system.

Centre for Data Innovation (2024). The EU AI Act: Compliance costs and market impact assessment.

Stanford HAI (2025). AI Index Report 2025. Human-Centered Artificial Intelligence.

Access Now (2025). First year of the AI Act: Enforcement gap analysis.