The AI Act (Regulation (EU) 2024/1689) phases in through 2026-2028. This is the commercial comparison; for a plain-language explainer of the tool category, our AI Act compliance tools page is the TOFU companion.
Key Takeaways
- The core modules: AI system register, risk classification, FRIA support, GPAI documentation, transparency records.
- The AI Act runs alongside GDPR — a tool that links the AI register to the ROPA removes duplicate work.
- High-risk system obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I product-embedded) after the Digital Omnibus on AI deferral; GPAI provider obligations applied from 2 August 2025, and the Art. 50 transparency duties still bite on 2 August 2026.
- Penalties reach EUR 35M or 7% of global turnover for prohibited practices, EUR 15M or 3% for other breaches.
- Pricing: EUR 5,000-30,000/year (focused tools) to EUR 100,000+/year (enterprise GRC).
What an AI Act Compliance Tool Must Do
Article by article, the AI Act translates into five software capabilities:
- AI system inventory and register. A living record of every AI system in use, its purpose, provider/deployer role, and data used. This is the foundation — you cannot classify or govern what you have not inventoried.
- Risk classification workflow. Guided classification into the AI Act’s tiers (prohibited, high-risk per Annex III, limited-risk with transparency duties, minimal). See our AI Act risk classification breakdown.
- FRIA support (Art. 27). For high-risk systems, deployers in scope must conduct a Fundamental Rights Impact Assessment; the tool should structure and evidence it.
- GPAI documentation. For providers of general-purpose AI models, the technical documentation and transparency obligations that applied from August 2025.
- Transparency records (Art. 50). Evidence of disclosures for AI that interacts with people or generates content.
For the full obligation map, work through the EU AI Act compliance guide and the definition of in-scope high-risk AI systems.
The distinction that trips up buyers is provider versus deployer. The AI Act assigns different obligations depending on your role: a provider builds or substantially modifies an AI system and carries the heavier conformity, documentation and quality-management burden; a deployer uses a system built by someone else and carries narrower duties, chiefly around use, human oversight and — for certain high-risk deployments — the FRIA. Most organisations are deployers of third-party AI and, increasingly, also providers of their own or fine-tuned systems, which means they wear both hats for different systems in the same inventory. Good software makes the role explicit per system and surfaces the right obligation set for each, rather than applying one generic checklist. If a tool cannot distinguish provider from deployer duties, it will either over-burden you with provider obligations you do not have or, worse, hide the ones you do — and getting that wrong is what turns an inventory into a liability.
Vendor Comparison
Ranges are market-realistic estimates; enterprise pricing is quoted on request. The comparison ranks AI Act fit, not overall platform size — a broad suite is not automatically the better AI Act tool. Two things move the price within each band: how many AI systems you operate, and whether you act as a provider (heavier obligations, more documentation) or only as a deployer. A company running a handful of third-party AI tools will land near the bottom of its band; an organisation building and shipping its own models will sit near the top, because provider obligations demand technical documentation, conformity evidence and quality-management records that a pure deployer never produces.
The GDPR Link Is the Differentiator
Most AI systems process personal data, so the same system appears in your AI Act register and your Article 30 ROPA. Tools that treat these as one dataset save real work: a high-risk AI system that is also large-scale personal-data processing needs both a FRIA and a DPIA, and the underlying facts — data used, purpose, affected individuals — are shared. A tool that links the two lets you build once and reuse. This is exactly the case for a combined platform, which we cover in GDPR + AI Act dual-compliance platforms. The AI Act does not replace the GDPR — see AI Act vs GDPR — and the EDPB (edpb.europa.eu) remains the authority on the personal-data side.
Enforcement and Timeline Make the Register Urgent
The AI Act’s penalties are the highest in EU digital regulation: up to EUR 35M or 7% of global annual turnover for prohibited-practice breaches, EUR 15M or 3% for other obligation breaches, and EUR 7.5M or 1% for supplying incorrect information. The European Commission’s AI Office oversees general-purpose AI models, while national market-surveillance authorities enforce the rest.
The calendar changed in mid-2026 and it changes how you sequence the work, not whether you do it. The Digital Omnibus on AI — adopted by the European Parliament on 16 June 2026, with final Council approval on 29 June 2026 — defers Annex III standalone high-risk obligations from 2 August 2026 to 2 December 2027, and Annex I product-embedded high-risk systems from 2 August 2027 to 2 August 2028. The trigger was late harmonised standards, not a softening of the requirements, which are unchanged. Publication in the Official Journal was still pending at the end of July 2026; the amending regulation enters into force three days after it appears.
The deferral is narrow: the Art. 5 prohibitions, the Art. 4 AI-literacy duty, the GPAI obligations under Arts. 53 and 55 and the Art. 50 transparency duties all keep their existing dates. The general application of the Act and the Art. 50 duties still land on 2 August 2026, and they catch every organisation with a chatbot or a generated-content workflow — no high-risk system required. So the near deadline is unchanged and the far one has moved, and both point at the same first task: a complete, classified AI system register. You cannot evidence a transparency disclosure for a system you have not recorded, and you cannot assemble Annex IV documentation in December 2027 for design decisions taken in 2026 unless something has been capturing them since. That is precisely what a compliance tool produces. For the phased dates, see the AI Act timeline and deadlines.
How to Stand Up Your AI System Register
Everything in the AI Act flows from the register, so building it well is the first practical task — and it is harder than it sounds, because most organisations do not actually know how many AI systems they run. Start with discovery, not data entry. Canvass the teams that procure and build software — engineering, marketing, HR, customer support, finance — and ask specifically about tools with AI features, not just systems labelled “AI.” The chatbot on the support site, the CV-screening add-on in the ATS, the fraud model in payments and the fine-tuned model a data-science team quietly shipped all belong in the register, and shadow AI is as real as shadow IT.
For each system, capture the minimum that later obligations depend on: purpose, whether you are provider or deployer, the data it uses, and enough detail to classify it against the AI Act’s tiers. Classification is the step that turns an inventory into a compliance tool, because it determines which systems trigger a FRIA, which carry transparency duties, and which are prohibited outright. Get the provider-versus-deployer flag right per system, since it decides whether the heavier conformity and documentation obligations apply.
Then make the register live rather than a one-off audit. AI estates change fast — new tools, new versions, new fine-tunes — so the register must be updated as systems are adopted or materially modified, ideally hooked into your procurement and change processes so nothing enters production unclassified. A tool that makes that upkeep cheap is worth more than one with a richer feature list, because a stale register is exactly the gap a market-surveillance authority will find first. Build the complete, classified register, keep it current, and the rest of the AI Act becomes tractable.
FAQ
What does AI Act compliance software do?
It automates the AI Act’s core obligations: maintaining an AI system inventory, classifying each system by risk tier, supporting Fundamental Rights Impact Assessments for high-risk systems, producing GPAI provider documentation, and evidencing Article 50 transparency. The best tools link this to the GDPR ROPA, since most AI systems process personal data.
How much does AI Act compliance software cost?
Roughly EUR 5,000-30,000/year for focused tools and EUR 100,000+/year for enterprise GRC platforms. Vendors above the SME tier generally quote on request. Where the tool also covers GDPR, expect pricing similar to a dual-compliance platform.
Do I need separate AI Act and GDPR software?
Usually not. Because most AI systems process personal data, a platform that covers both — linking the AI register to the ROPA and reusing evidence between the FRIA and the DPIA — is more efficient than two silos. Standalone AI Act tools make sense only if your GDPR programme is already well-served elsewhere.
When must high-risk AI systems comply?
High-risk system obligations under Annex III apply from 2 December 2027, with Annex I product-related high-risk systems from 2 August 2028 — both deferred by the Digital Omnibus on AI, given final Council approval on 29 June 2026. GPAI provider obligations applied from 2 August 2025 and prohibited practices from 2 February 2025. The deferral does not touch those dates, nor the Art. 50 transparency duties and the general application of the Act on 2 August 2026.