AI Act high-risk AI compliance challenge and industry impact: A multiple case study
Open accessAbstract
Context: The AI Act marks a new chapter in AI governance, affecting companies around the world seeking to offer their services within the European Union. This study focuses on the comprehensive AI Act requirements set out for high-risk AI systems. Objectives: We explored the perceived compliance challenge for the AI Act’s high-risk requirements and associated contributing factors; the AI Act’s impact on industry in terms of positive and negative side effects; and the sentiment of industry practitioners towards the AI Act’s Codes of Conduct for the voluntary application of the act’s high-risk AI requirements. Method: A multiple case study encompassing six case companies supplemented by three independent experts with a total of 16 respondents was conducted. Results: A ranking represents the different perceived levels of challenge for each AI Act high-risk requirement. The ranking is led by the following requirements, starting with the most challenging one: (1) data quality and governance (Art 10), (2) accuracy, robustness, and cybersecurity (Art 15), (3) risk and quality management system (Art 9, 17), and (4) transparency (Art 13). Moreover, four contributing factors emerged that impact the perceived compliance challenge: (1) industry and brand values, (2) existing regulatory environment, (3) AI maturity level and proficiency, and (4) company size. We identified several general key factors for the AI Act’s impact on industry and outlined strong arguments both for and against th…
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The participating companies in that study did not identify human oversight as a particularly difficult requirement to operationalize.
“The participating companies in that study did not identify human oversight as a particularly difficult requirement to operationalize.”
From ARTIFICIAL INTELLIGENCE IN ADMINISTRATIVE PROCEEDINGS: RISK CLASSIFICATION, HUMAN OVERSIGHT, AND PROSPECTS FOR IMPLEMENTATION IN UKRAINE (2026) · cites this paper as [10]
The study attributes the lack of difficulty with human oversight to the fact that the human-machine interface tools used by respondent companies were highly product-dependent, and interviewees generally expressed confidence in the interfaces already implemented within their organizations.
“The study attributes this to the fact that the human-machine interface tools used by respondent companies were highly product-dependent, and interviewees generally expressed confidence in the interfaces already implemented within their organizations.”
From ARTIFICIAL INTELLIGENCE IN ADMINISTRATIVE PROCEEDINGS: RISK CLASSIFICATION, HUMAN OVERSIGHT, AND PROSPECTS FOR IMPLEMENTATION IN UKRAINE (2026) · cites this paper as [10]
Cites
Saturation in qualitative research: exploring its conceptualization and operationalization
Saunders, B., Sim, J., Kingstone, T., Baker, S., Waterfield, J., Bartlam, B., Burroughs, H., & Jinks, C. (2018) · Quality & Quantity · doi:10.1007/s11135-017-0574-8 · Cited by 12,033 · see citing works
Kallio, H., Pietilä, A., Johnson, M., & Kangasniemi, M. (2016) · Journal of Advanced Nursing · doi:10.1111/jan.13031 · Cited by 4,295 · see citing works
Guiding AI in radiology: ESR’s recommendations for effective implementation of the European AI Act
Kotter, E., D’Antonoli, T. A., Cuocolo, R., Hierath, M., Huisman, M., Klontzas, M. E., Martí‐Bonmatí, L., May, M. S., Neri, E., Nikolaou, K., et al. (2025) · Insights into Imaging · doi:10.1186/s13244-025-01905-x · Cited by 103 · see citing works
Threats to validity in software engineering research: A critical reflection
Verdecchia, R., Engström, E., Lago, P., Runeson, P., & Song, Q. (2023) · Information and Software Technology · doi:10.1016/j.infsof.2023.107329 · Cited by 70 · see citing works
Self-citationKalodanis, K., Feretzakis, G., Αναστασίου, Α., Rizomiliotis, P., Anagnostopoulos, D., & Koumpouros, Y. (2025) · Electronics · doi:10.3390/electronics14071385 · Cited by 27 · see citing works
Myklebust, T., Stålhane, T., & Vatn, D. M. K. (2025) · SpringerBriefs in computer science · doi:10.1007/978-3-031-80504-2_2 · Cited by 5 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Ethical challenges and software test automation
Strandberg, P. E., Enoiu, E. P., & Frasheri, M. (2025) · AI and Ethics · doi:10.1007/s43681-025-00804-7 · Cited by 4 · see citing works
Jôrgensen, B. N., & Ma, Z. G. (2026) · Electronics · doi:10.3390/electronics15102184 · Cited by 4 · see citing works
Judijanto, L. (2025) · Science of law. · doi:10.55284/4r3qs710 · Cited by 1 · see citing works
Zabolotna, H. (2026) · Visnyk of the Lviv University. Series Law · doi:10.30970/vla.2026.82.182
Uporaba umetne inteligence za izboljšanje upravljanja prometa v podjetju Intermatic, d. o. o.
Gorta, T., Živković, S., & Vukovič, G. (2026) · doi:10.18690/um.fov.7.2026.6
Kurek, M. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7329378
Software Engineering Meets the EU AI Act: Artifacts, Patterns, and Future Directions
Chimalakonda, S., & Karimi, U. (2026) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3832783.3834559
Mapping the research landscape of regulatory compliance in software engineering
Abualhaija, S., Unterkalmsteiner, M., & Méndez, D. (2026) · Information and Software Technology · doi:10.1016/j.infsof.2026.108369
- Authors
- Wagner, M., Song, Q., Borg, M., Engström, E., & Lysek, M.
- Affiliations
- Lund University (SE)
- Corresponding author
- Wagner, Matthias
- Venue
- Information and Software Technology
- Publisher
- Elsevier BV
- Published
- 2026-06
- Volume
- 194
- Pages
- 108067
- ISSN
- 0950-5849 (ISSN-L)
- OpenAlex
- W7128032166
- Cited by
- 6
- References
- 6
- Citations by year
- 2026: 4 · 2025: 2
- FWCI
- 136.94
- Type
- journal article
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- Information and Software Technology (publishedVersion, cc-by)
- SSRN Electronic Journal (acceptedVersion)
- Lund University Publications (Lund University) (submittedVersion)
- Funders
- Knut och Alice Wallenbergs Stiftelse
- VINNOVA
- Lund University Faculty of Engineering
- Topics
- Social Sciences › Law › Digitalization, Law, and Regulation
- Social Sciences › Safety Research › Ethics and Social Impacts of AI
- Physical Sciences › Engineering › Safety, Risk, Reliability and Quality › Safety Systems Engineering in Autonomy
- Keywords
- EU AI Act, high-risk AI systems, AI compliance, AI governance, codes of conduct, cybersecurity, risk management system, transparency, firm size
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
