The EU's regulation of artificial intelligence is no longer on the drawing board. This week marked the start of active enforcement of the EU AI Act — a regulation that will impact all companies developing or offering AI systems to users in the EU. For Norwegian tech companies, which are deeply integrated into the European market through the EEA Agreement, this is not foreign legislation that can be ignored.
According to Silicon Canals, most AI startups report that they are not ready to comply with the requirements.
What is the EU AI Act?
The EU AI Act is a risk-based regulation that categorizes AI systems according to the potential harm they can cause. Systems classified as «high-risk» — for example, in health diagnostics, recruitment, credit granting, and critical infrastructure — are subject to the strictest requirements. Low-risk systems such as text recognition, recommendation algorithms, and marketing tools are largely exempt.
Costs can be crushing for smaller players
Research reviews of the regulations show that the cost picture is highly variable, but potentially severe for small companies with high-risk classified products. For an SME with up to 50 employees and a turnover of around 10 million euros, the total compliance cost for a single high-risk product can reach up to €400,000 — which, according to analyses from the Centre for Data Innovation, could mean a 40 percent reduction in profit.
For companies with 50 to 100 employees, establishment costs are estimated at between €200,000 and €280,000, with ongoing annual costs of €80,000 to €100,000.
The costs are broken down into several components. Conformity assessment via a third party (a so-called «notified body») alone can cost between €50,000 and €150,000. Technical documentation is estimated to cost €30,000 to €60,000 to establish, plus €15,000 to €25,000 in annual updates. Setting up a Quality Management System (QMS) can cost between €193,000 and €330,000, with an annual operating cost of around €71,000.
Norwegian companies are not immune
Although the EU AI Act is EU legislation, it practically applies to any entity offering AI services to European users — regardless of whether the company is located in Oslo, Bergen, or outside Europe. Norwegian companies operating in the EU market or having European customers are directly subject to the regulations through the EEA Agreement.
This means that a Norwegian health tech startup offering diagnostic AI to German hospitals, or a Norwegian HR tech company with customers in Sweden and Denmark, must already comply with the law's requirements.
The EU has built-in support schemes — but experts are skeptical
EU lawmakers are not blind to the potential burden. The regulations include several support measures aimed at SMEs and startups: free and prioritized access to regulatory sandboxes, reduced fees for conformity assessment, and simplified format requirements for technical documentation. Micro-enterprises with fewer than ten employees can also use simplified processes for quality management, which, according to research, can save between €80,000 and €150,000.
Nevertheless, experts warn that these measures are insufficient. Analyses cited by Silicon Canals, among others, point out that the EU AI Act could collectively cost the European economy €31 billion over five years and reduce AI investments by nearly 20 percent. The fundamental problem, according to critics, is that smaller players lack the legal, technical, and administrative capacity that large tech corporations can absorb the costs with.
What should Norwegian companies do now?
The first step for any Norwegian AI company with activity in the EU should be to map the risk category of its own products. Companies that fall outside the high-risk classification have far simpler obligations. Those that fall within should seek legal advice and consider whether access to a regulatory sandbox can provide useful room for maneuver during a transition phase.
Enforcement is underway. Waiting and seeing is no longer a strategy.