Every way companies comply with the EU AI Act, priced side by side
There are twelve ways to deal with the EU AI Act, from the Commission's free checker to an independent conformity assessment by a notified body. Not sure the Act catches you at all? The free checker answers that first, with no account. And one price below is different in kind: a ComplianceSME account is not an AI Act product but the whole compliance estate, 116 EU and UK obligation registers with the AI Act among them. This page sets out what each one produces, what each one costs as published, and where ComplianceSME sits. Every figure is as published by its named source on 13 October 2026.
The law this page is published under. Naming competitors in a comparison is lawful in the United Kingdom and the European Union, under the Business Protection from Misleading Marketing Regulations 2008 and Directive 2006/114/EC, where the comparison is objective and verifiable, sets services meeting the same need against one another, and neither misleads nor denigrates. Those conditions govern this page. Every figure appears as its source publishes it, with the date it was read. Every route carries the thing it does well, including the things done better than we do them. Counting units are kept apart: a framework count and a control count are not an obligation count, and the coverage column names which unit each route counts in. Trademarks identify their owners, with no logos, no vendor styling and no affiliation or endorsement implied. Any figure here that has moved is corrected on evidence at toolkit@compliancesme.com.
The bench
Where a vendor publishes no price, the cell says so. No figure here is a price reported on a vendor's behalf by a third party.
| Route | What it produces | Coverage, and the unit it is counted in | Published cost | What it does well |
|---|---|---|---|---|
| AI governance platform Credo AI, Holistic AI, Trustible, OneTrust AI Governance, Monitaur, Saidot | An AI system registry, a risk tier label, policy packs, control mappings, an evidence trail | Control sets mapped to the Act and ISO/IEC 42001; the unit is the control set, not the obligation | No price published; Credo AI's pricing page returned a 404 on the date read | Shadow AI and agent discovery; 20 or more integrations (Credo AI); runtime guardrails inside the estate (OneTrust) |
| Model governance in an enterprise data platform IBM watsonx.governance | A model inventory, risk and compliance workflows, evaluation metrics | The model lifecycle; the unit sold is the concurrent user | Basic from 3,500 dollars a month for one concurrent user; Advanced from 6,450; from 42,000 dollars on AWS Marketplace | Publishes its price, where most of this market quotes on request |
| Compliance manager inside the productivity estate Microsoft Purview Compliance Manager | Assessment templates with scored improvement actions | Four AI templates, one named EU Artificial Intelligence Act, classed premium; the unit is the improvement action | Premium regulations; A5, E5 and G5 licences may use any three at no further charge | Sits where the data and users already are, so a control can block behaviour rather than record it |
| GRC platform with an AI module Vanta, Drata, Scytale, Sprinto | Control dashboards, continuous evidence collection, audit preparation | The Act as one framework among many; Drata's page claims technical files and does not claim Annex IV, conformity assessment or a fundamental rights impact assessment | No price published by any of the four | Agent discovery (waitlist at Vanta), evidence written once and reused across frameworks, 300 or more integrations (Sprinto) |
| Readiness workflow inside an MLOps platform Dataiku EU AI Act Readiness Solution | Risk tier qualification and documentation workflows, with drift, bias and performance evidence from the models themselves | Systems built in the platform only, Advanced Govern required; its own documentation disclaims legal advice or a determination of compliance | No price published for the solution | Runtime monitoring of live models, at the place the models are built and served |
| Annex IV documentation tool AnnexOps, Openlayer, CompliAI, AiActo, systima aiact-docs | The legal documents themselves: Annex IV, the Article 17 quality management system, Article 43 conformity, the Article 47 declaration, Article 72 post-market monitoring | The Act alone, no breadth beyond it; a fundamental rights impact assessment is not mentioned on the AnnexOps page read | No prices published | The category whose own pages claim the document the Act asks for, rather than a dashboard about it |
| Source-available governance platform VerifyWise | A self-hosted governance registry with framework mappings | 30 or more frameworks on its own page; the unit is the framework | Licensed BSL 1.1, self-host or cloud, free to start by its own page | The source can be read, and the deployment can stay inside your own infrastructure |
| Readiness consultancy OpenEmpower, Owl and Goats, EY | A readiness report; Annex IV-style documentation and transparency notices named among the Owl and Goats deliverables | Whatever the engagement scopes; the unit is the week of work | OpenEmpower 12,000 euros for a single platform over two weeks, to 28,000 to 38,000 euros enterprise over four to six weeks; Owl and Goats price after a call; EY publishes no fee | A person reading your actual systems and judging intended purpose, which a questionnaire cannot reach |
| Independent conformity assessment TUV SUD | A third-party assessment and a certificate | Voluntary conformity assessment ahead of the mandatory procedure | No fee published | A signature from outside the business, which no software or toolkit substitutes |
| Template pack | Blank documents to fill in | Blanks across the set, counted in documents | 19 to 349 euros; 39.90 dollars for an Excel risk register; 399 dollars reduced from 699; 699 dollars for a kit of 80 or more documents; 997 to 24,997 dollars across one range; ISO/IEC 42001 itself a separate purchase | A cheap start and a structure to argue with |
| Free official resources Commission AI Act Service Desk, Compliance Checker, AI Act Explorer, AESIA guides, GPAI Code of Practice, AI Pact | Guidance, a compliance checker, a checklist manual and a self-assessment path | AESIA published 16 guides in English on 10 December 2025 with a checklist manual; the Commission's Service Desk and platform launched 8 October 2025; the AI Pact describes its pledges as voluntary and non-binding | Free | Written by the authorities applying the Act; any paid pack is worth measuring against these before it is bought |
| ComplianceSME | The free EU AI Act checker returns your role under the Act, your duties with article citations and dates, and a printable duty card, no account; the toolkit holds 17 compliance agents and produces documentation with the article cited on every line | One of 116 EU and UK registers on the same account, across 10,313 catalogued obligations; an obligation is a duty written in an instrument, a different unit from a framework or a control | The checker is free, no account; 140 pounds a month all in buys the whole compliance account at the Micro level, 46 registers with the EU AI Act one of them | The documents the Act names, produced from the Regulation's own words, on the dates as amended by Regulation (EU) 2026/1744 |
The inventory and the file
The platform category produces an inventory, a tier label and an evidence trail. The Act asks for a technical file in nine parts, a declaration of conformity, a fundamental rights impact assessment, transparency notices, and literacy records tied to named staff and named systems. An inventory tells you what you have. A file is what an inspection reads.
The two are also kept current by different means. A platform watches your models, and when the Regulation moves it is the vendor's mapping that has to catch up. Regulation (EU) 2026/1744 came into force on 27 July 2026 and moved four application dates. Any plan still scoped to the old August 2026 high-risk date is pointed at the wrong month.
The questions this page gets asked
We already have an AI governance platform. What is worth checking?
Most platforms produce an AI system inventory, a risk tier and a control-mapped evidence trail, and that is real work worth having. None of the product pages read for this page claims to produce the Annex IV technical file, which has nine parts including the design specifications, the data requirements, the Article 9 risk management system and the Article 47 declaration of conformity. The useful test is which of those nine you can put on a desk today.
When is the EU AI Act high-risk deadline now?
It moved. Regulation (EU) 2026/1744 came into force on 27 July 2026 and pushed stand-alone Annex III high-risk obligations from 2 August 2026 to 2 December 2027, and embedded Annex I systems to 2 August 2028. Regulatory sandboxes were deferred to 2 August 2027.
Did the Digital Omnibus delay the Article 50 transparency duties?
No. Article 50 transparency applied from 2 August 2026 and was not deferred. The grace period for machine-readable marking of generative systems already on the market ends on 2 December 2026, and two further Article 5 prohibitions apply from that date, covering non-consensual intimate imagery and the generation of child sexual abuse material. Transparency notices for anything that interacts with people or generates content are due now, not in 2027.
What does IBM watsonx.governance cost for a small business?
IBM publishes Risk and Compliance from 3,500 dollars a month for one concurrent user, Advanced from 6,450 dollars a month, and from 42,000 dollars on AWS Marketplace. It is one of the few published prices in this market: the IAPP's own AI Governance Vendor Report 2026 was compiled with no pricing data at all. If you have been quoted by anyone else in the category, there is no list to benchmark that quote against.
How do we get EU AI Act documentation without paying for a platform?
Start with the free EU AI Act checker on this site, which settles your role and your duties with their article citations in a minute and needs no account. For the documents themselves, the 140 pounds a month all in buys the whole compliance account at the Micro level, 46 EU and UK obligation registers with the EU AI Act one of them. The published alternatives are 3,500 to 6,450 dollars a month for one IBM user, or 12,000 to 38,000 euros once for a readiness report.
Does Vanta or Drata cover the EU AI Act?
They map it as one framework beside the others and collect control evidence continuously, which they do better than we do: Sprinto's page states ISO/IEC 42001 pre-mapped at 10 clauses and 38 Annex A controls, Scytale's states 80 or more frameworks, and Sprinto's states 300 or more integrations. Vanta's AI governance page is built on agent discovery across laptops, production code and vendor platforms, and carries waitlist status. Drata's page claims technical files and stops short of Annex IV, Article 43 conformity assessment and the Article 27 assessment. None of the four publishes a price.
Does one platform cover the whole EU AI Act?
The IAPP's AI Governance Vendor Report 2026 concludes that no single vendor covers all functions, which is why most estates run several. Eurostat puts AI use at 17 per cent of small EU enterprises and 30.36 per cent of medium ones in 2025, up 6.47 points in a year, so most companies now in scope adopted AI inside the last two years and have no governance function to spread across several tools. If your coverage is one platform, the work is mapping which duties sit outside it.
Is the Commission's free Compliance Checker enough for the EU AI Act?
It is a good first hour and it costs nothing. The AI Act Service Desk and Single Information Platform launched on 8 October 2025 with the Compliance Checker and the AI Act Explorer, and Spain's AESIA published 16 guides in English in December 2025 covering conformity assessment, quality management, risk management, human oversight, data governance, transparency, robustness, records, post-market monitoring, incident reporting and technical documentation. What those resources tell you is what the Act requires. They do not write your file.
What does an EU AI Act readiness assessment cost?
OpenEmpower publishes fixed brackets: 12,000 euros for a single platform over two weeks, rising to 28,000 to 38,000 euros for an enterprise engagement over four to six weeks, with a 15 to 25 page report as the deliverable. Owl and Goats price after a call and name Annex IV-style technical documentation and transparency notices among the deliverables. EY publishes no fee. One readiness report costs more than a year of almost any subscription in this market, and what it buys is a person who has read your systems.
Can a template pack make us EU AI Act compliant?
A pack gives you blanks. Published prices run from 19 to 349 euros, 39.90 dollars for an Excel risk register, 699 dollars for a kit of 80 or more documents, and up to 24,997 dollars at the top of one governance toolkit range, with ISO/IEC 42001 bought separately. Before any of that, measure the pack against Spain's AESIA guides and the Commission's Service Desk, which are free and written by the authorities applying the Act.
Can AI write our Annex IV technical documentation?
Read what the tool says about its own output first. Dataiku's documentation for its EU AI Act Readiness Solution states that the solution does not constitute legal advice, regulatory approval or a definitive determination of compliance. Our toolkits work the other way round: the system teaches the Regulation to a member of your own staff, interviews them about the systems you run, and the document that comes back cites the article behind every line.
Does ISO 42001 certification cover the EU AI Act?
ISO/IEC 42001 is a real management-system route and a good one, but it is a standard, not the Regulation. Presumption of conformity comes from harmonised standards cited in the Official Journal, and the Commission states that the first are expected from CEN and CENELEC in 2026, with CEN-CENELEC adopting acceleration measures in October 2025 towards the fourth quarter of 2026. ISO/IEC 42001 certification and AI Act conformity are two different signatures.
Who writes our Article 27 fundamental rights impact assessment?
Somebody in the building, on current evidence. Article 27 requires the assessment from certain deployers, and the AI Office's own Article 27(5) template has not been published, so every version in the market was built from the article by whoever wrote it. The assessment is not mentioned on the live product pages read for this page at Credo AI, Holistic AI, Trustible or Drata. The question to put to your vendor is who drafted the one you hold.
What records prove AI literacy training under Article 4?
The Article 4 duty has applied since 2 February 2025, and Regulation (EU) 2026/1744 reworded it to taking measures to support staff AI literacy. It is one of the few duties already live and enforceable, and a slide deck is not a record. What answers an inspection is a dated register of who was trained, on what, and against which systems they operate.
What does ComplianceSME not do for the EU AI Act?
We do not monitor your models at runtime for drift, bias or hallucination, we do not discover shadow AI or agents across your laptops and code, we do not enforce anything inside your estate, and we are not an independent assessor: a notified body's certificate is a signature from outside the business, and no documentation tool stands in for it. What we produce is the written record the Act names, cited to its articles and kept current as the Regulation moves.
Figures read 13 October 2026 from each vendor's own published pages: IBM's watsonx.governance pricing page, Microsoft Learn's compliance manager templates list, the product pages of Credo AI, Holistic AI, Trustible, Monitaur, OneTrust, VerifyWise, Vanta, Drata, Scytale and Sprinto, the Dataiku knowledge base, annexops.com, openempower.com, owlandgoats.com and ey.com. The Regulation and the amending Regulation (EU) 2026/1744 from EUR-Lex, OJ L 2024/1689 and CELEX 32026R1744. Vendor coverage from the IAPP's AI Governance Vendor Report 2026; enterprise AI use from Eurostat's use of artificial intelligence in enterprises, 2025; the 16 guides from Spain's AESIA, 10 December 2025; the Service Desk and Single Information Platform launch and the standardisation position from the European Commission; the acceleration measures from CEN-CENELEC, October 2025. Statements that something is absent describe the product pages read on the date above, not an exhaustive sweep of every vendor site. All trademarks belong to their owners. Corrections on evidence to toolkit@compliancesme.com.