David Restrepo Amariles ,Pablo Marcello Baquero, Compliance under the EU AI Act: How Firms Navigate Regulatory Complexity in the Digital Landscape, Computer Law & Security Review, Volume 62, 2026.
Abstract
As organizations across the European Union increasingly adopt artificial intelligence, navigating the growing complexity of the EU’s digital regulatory landscape—particularly the interaction of multiple legal instruments and governance layers—has become a central challenge. Beyond direct compliance costs, firms also face significant opportunity costs, as regulatory constraints may limit the development of AI-driven business models. This article undertakes exploratory research to examine how firms navigate this complexity and whether it is reshaping their approaches regarding organizational roles, compliance processes and technological tools. Drawing on qualitative data derived from semi-structured questionnaires and in-depth interviews with professionals from 14 European firms, this exploratory study generates hypotheses indicating that there is a tendency for compliance to evolve from fragmented, monitoring-based approaches toward more coordinated and strategically embedded models. However, this transformation remains partial and uneven. In particular, the analysis identifies indications of an emerging pattern of selective integration in compliance processes, whereby firms seek to align regulatory requirements across instruments where possible, while maintaining separation where legal specificity demands it. The findings further suggest that organizational roles may be becoming more hybrid and strategically embedded, and that technological tools, when adopted, tend to evolve in a path-dependent and only partially integrated manner. Taken together, these dynamics reflect the structural constraints of the EU AI regulatory ecosystem. By conceptualizing compliance as an adaptive governance process shaped by legal complexity, the article contributes to scholarship on AI governance and provides empirical insight into how firms operationalize compliance under the EU AI regulatory framework.