EU AI Act · cost & profitability models

If your finance team uses AI to cost or price, the clock is already running.

From 2 August 2027 the general purpose AI obligations of the EU AI Act apply. Cost and profitability models built with foundation models sit inside the perimeter, even when the AI is only writing the commentary. The fines start at 15M EUR or 3% of global revenue. The fix is straightforward, but it does not happen by itself.

Book an exposure assessment See the four requirements

2 to 3 weeks · Fixed fee · Signed by a senior partner

01The deadline

2 August 2027. 55 days from today.

The Act is staged. The general purpose AI obligations apply from 2 August 2027. The high-risk Annex III regime was postponed by the Digital Omnibus agreement of 7 May 2026, from 2 August 2026 to 2 December 2027. Cost models built on top of foundation models are touched by both.

Days remaining

Until GPAI obligations apply.

Target date

02 Aug
2026

General purpose AI rules in force.

Maximum fine

15M EUR

Or 3% of global annual revenue.

Our assessment

2 to 3 weeks

Readiness report, gap matrix, plan.

Today

8 Jun 2026

Feb 2025

Prohibited use cases in force.

Aug 2025

GPAI providers' duties begin.

02 Aug 2026

Your obligations apply.

02 Dec 2027

High-risk (Annex III) regime in force, deferred by the Digital Omnibus.

02Four requirements

Four obligations, mapped to the cost model on your CFO's desk.

The Act is broad. For finance teams running profitability models on top of AI, it comes down to four practical controls. Each maps directly to something already in our framework.

REQ 01

Risk and governance

A risk management process for the AI system, with owners, controls and a documented review cadence. Decisions affecting margin or pricing are documented.

In the cost model, this means A governance matrix naming the owner of every cost pool, driver and AI-assisted commentary, plus a quarterly review log. We build this as part of step 05 of the framework.

REQ 02

Data governance

Training, validation and operational data is relevant, representative and bias-checked. Provenance is recorded. Data quality is measured, not assumed.

In the cost model, this means A profile of every dataset that feeds the model, tied back to the general ledger, with a bias slice by segment, channel and geography. This is dimensions 01 and 05 of the Trust Score.

REQ 03

Traceability and logs

Automatic logging of model inputs, outputs and decisions. Any number that lands on a finance report can be walked back to a source and a rule.

In the cost model, this means End-to-end lineage from the SKU line on the whale curve to the GL line, the activity, the equation and the AI commentary. Dimension 02 of the Trust Score, hard-wired.

REQ 04

Human oversight

A named person can interpret, override and stop the AI when needed. The system's limitations are documented and made visible to the user.

In the cost model, this means A controller signs off the monthly close. The AI commentary is reviewed, not auto-published. Override and approval steps are baked into CostCtrl workflow.

What is at risk

The fine is the headline. The exposure is wider than that.

For a finance team running pricing, mix and margin on top of AI, non-compliance bites in four places. We see one or two in every conversation we have.

15M €

Maximum administrative fine for breach of the GPAI obligations. 3% of global annual turnover if higher.

A buyer in due diligence asks for the risk file. If it does not exist, the deal slips, the multiple compresses, or both.

SOX

Auditors will not sign off on a margin number derived from a model they cannot trace. The qualified opinion is the operational fine.

Board

Directors carry personal liability under EU corporate governance for the use of AI in material reporting. They will ask for the file.

03The service

EU AI Act Exposure Assessment.

Two to three weeks. A senior partner. One fixed fee. At the end you have what you need to walk into a board meeting, an audit committee or a PE process with the file in your hand.

DELIVERABLE 01

Readiness report

A report on where your cost intelligence sits versus the four obligations. Per system, per process, per dataset. Plain language for the board, technical annex for the team.

PDF · CostCtrl workspace · Signed

DELIVERABLE 02

Gap matrix

A single page mapping every gap to a requirement, a severity, an owner and a fix. The thing your CFO pins to the wall and your risk officer reads first.

Excel · A3 print-ready · Live in CostCtrl

DELIVERABLE 03

Remediation plan

A quarter by quarter plan to be ready, with effort, dependencies and the cost of doing nothing. Costed against the fine and the audit-qualification risk.

12 month roadmap · Quarterly checkpoints

04Scoping

What it takes from your side.

Duration

2 to 3 weeks

From first call to signed report.

Your time

2 to 4 hours

A controller and an IT contact. Two short interviews.

Access

NDA · read
only

A list of AI tools in use, a model card if it exists.

First step

30 min, free

A senior partner. We tell you, on the call, whether you need this.

05Questions a CFO asks first

The honest answers, before the call.

Are my AI cost models covered by the EU AI Act?

If they are used in credit decisions, regulated pricing or other Annex III high-risk areas, yes. Even outside those cases, the governance and evidence the Act requires are good practice for any model that drives financial decisions.

What is the deadline?

The general purpose AI obligations apply from 2 August 2027. Fines can reach EUR 15 million or 3% of global annual turnover.

What does the Exposure Assessment deliver?

A readiness report, a gap matrix and a prioritised remediation plan, in 2 to 3 weeks, at a fixed fee, signed by a senior partner.

How do you help us comply?

Our Plan and Audit services build and maintain the evidence: readiness assessment, governance matrix, model traceability, drift detection and ongoing documentation for regulators and boards.

What fines can I face if my AI model is not compliant?

For general purpose AI obligations, fines can reach EUR 15 million or 3% of global annual turnover, whichever is higher. Prohibited practices carry an even higher regime. Our Exposure Assessment shows where the real risk sits.

What do I need to prove by 2 August 2027?

That you govern your AI models: technical documentation, traceability of data and decisions, human oversight and auditable evidence that the model does what it claims. We build and maintain that evidence with the Plan and Audit steps.

●Profitability Lab

This thinking comes out of our Profitability Lab.

The Lab is the research unit where we build the framework and the field notes on AI, cost and profitability.

Visit the Profitability Lab

Reviewed by

Miguel Guimarães

Founder, Cost and Profitability Consulting

More than 150 Time-Driven ABC engagements across 11 sectors since 2010, working within the Kaplan and Anderson framework.

About the author →