AI Act high-risk AI compliance challenge and industry impact: A multiple case study

The AI Act marks a new chapter in AI governance, affecting companies around the world seeking to offer their services within the European Union. This study focuses on the comprehensive AI Act requirements set out for high-risk AI systems. We explored the perceived compliance challenge for the AI Act’s high-risk requirements and associated contributing factors; the AI Act’s impact on industry in terms of positive and negative side effects; and the sentiment of industry practitioners towards the AI Act’s Codes of Conduct for the voluntary application of the act’s high-risk AI requirements. A multiple case study encompassing six case companies supplemented by three independent experts with a total of 16 respondents was conducted. A ranking represents the different perceived levels of challenge for each AI Act high-risk requirement. The ranking is led by the following requirements, starting with the most challenging one: (1) data quality and governance (Art 10), (2) accuracy, robustness, and cybersecurity (Art 15), (3) risk and quality management system (Art 9, 17), and (4) transparency (Art 13). Moreover, four contributing factors emerged that impact the perceived compliance challenge: (1) industry and brand values, (2) existing regulatory environment, (3) AI maturity level and proficiency, and (4) company size. We identified several general key factors for the AI Act’s impact on industry and outlined strong arguments both for and against the AI Act voiced by practitioners. The sentiment towards the AI Act’s Codes of Conduct turned out very positive. This study offers a valuable primary research contribution to software engineering, where the state-of-the-art remains short of compliance-oriented studies with a focus on the operationalization of certain AI Act aspects. Future work is advised to develop artifacts facilitating AI Act operationalization and to validate them with industry partners. • Different perceived levels of challenge for each AI Act high-risk requirement. • Four contributing factors identified for the perceived AI Act compliance challenge. • Key factors of the AI Act’s impact on industry identified. • Strong arguments both for and against the AI Act voiced by practitioners. • Very positive sentiment towards the AI Act Codes of Conduct.