5 Things North American Firms Must Know About The EU AI Act

In August 2024, the European Union officially brought the EU AI Act into effect.

Although it’s a European regulation, its reach extends far beyond Brussels — and many North American tech firms are already feeling the consequences.

Here’s what business leaders should know — and how to act.

---

Why It Matters (Even Outside the EU)

• The EU AI Act has extraterritorial scope: any company that markets, deploys, or uses AI systems whose outputs are used within the EU can fall under its rules. [1]

• Canadian firms exporting AI-enabled products or embedding AI modules in tools used by European clients must assess compliance now. [2]

• The “Brussels Effect” suggests that many non-EU firms will end up aligning with EU standards to simplify compliance across multiple jurisdictions. [3]

---

What the Regulation Says

• AI systems are classified by risk levels — from “minimal” to “high risk” and “unacceptable.” The higher the risk, the stricter the obligations. [1]

• Penalties for non-compliance are severe: up to €35 million or 7% of global turnover, whichever is higher. [4]

• Implementation is phased:
  • Basic obligations begin in February 2025
  • Rules for general-purpose AI models start in August 2025
  • High-risk system requirements apply from August 2026 [5]

• Despite industry pressure, the EU refused to delay enforcement, signaling regulatory confidence. [6]

---

The Cost — Real or Theoretical?

• The Computer & Communications Industry Association (CCIA) estimates compliance with the AI Act could cost as much as USD $430 million annually for large U.S. service providers. [7]

• A KPMG / CIO Dive survey found that over 50% of business leaders expect AI compliance and security requirements to raise costs. [8]

• Data breaches in 2024 averaged $4.88 million per incident, with weak AI governance amplifying that risk. [9]

• An EY survey (2025) of nearly 1,000 executives found that almost every large company deploying AI reported initial financial losses totaling $4.4 billion globally, largely due to compliance failures and flawed outputs. [10]

---

Strategic Questions for Tech Leaders

Challenge	Key Question
Triggering jurisdiction	Will our product or AI output be used within the EU?
Risk classification	Does it fall under “general purpose” or “high risk”?
Compliance burden	What documentation, audit, and reporting obligations apply?
Cost vs ROI	Will compliance erode profitability or delay innovation?
Competitive positioning	Should we adopt EU compliance globally as a “trust signal”?

---

Actionable Steps

1. Map your AI exposure — identify all models or features that touch EU markets.

2. Classify risk levels — apply the Act’s definitions early.

3. Build compliance infrastructure — documentation, audits, bias checks, risk logs.

4. Adopt “trustworthy by design” principles — human oversight and transparency.

5. Monitor evolving guidance — the EU will release codes of practice and model risk templates further.

6. Plan market entry — consider delaying EU launches until compliance processes are mature.

---

Bottom Line

Europe’s AI regulation is no longer a local matter — it’s becoming the global baseline.

For North American firms, waiting is riskier than preparing early. 

---

References

[1] Skadden — “The EU AI Act: What Businesses Need to Know”
https://www.skadden.com/insights/publications/2024/06/quarterly-insights/the-eu-ai-act-what-businesses-need-to-know

[2] Miller Thomson — “Impact of the EU Artificial Intelligence Act on Canadian Companies”
https://www.millerthomson.com/en/insights/cybersecurity/eu-artificial-intelligence-act-implementation-timeline-impact-canadian-companies

[3] McCarthy Tétrault — “Navigating the Future of AI Law: The EU AI Act and Canada’s AIDA”
https://www.mccarthy.ca/en/insights/blogs/techlex/10-key-takeaways-navigating-future-ai-law-understanding-eu-ai-act-and-aida

[4] EY — “The EU AI Act: What It Means for Your Business”
https://www.ey.com/en_ch/insights/forensic-integrity-services/the-eu-ai-act-what-it-means-for-your-business

[5] TechRepublic — “Companies Request EU AI Act Delay, But Implementation Moves Forward”
https://www.techrepublic.com/article/news-companies-request-eu-ai-act-delay

[6] Techzine — “EU Sticks to AI Act Timeline Despite Pressure”
https://www.techzine.eu/news/privacy-compliance/132765/eu-sticks-to-ai-act-timeline-despite-pressure-from-companies

[7] CCIA Report — “EU Digital Regulation Factsheet” (2025)
https://ccianet.org/wp-content/uploads/2025/03/CCIA_EU-Digital-Regulation-Factsheet_reportfinal.pdf

[8] CIO Dive — “AI Regulation and Security Expected to Raise Enterprise Costs”
https://www.ciodive.com/news/enterprise-cost-increase-ai-regulation-security-data/724345

[9] DataRobot — “The Cost of Misbehaving AI”
https://www.datarobot.com/blog/misbehaving-ai-cost

[10] Reuters — “Most Companies Suffer Some Risk-Related Financial Loss Deploying AI — EY Survey (2025)”
https://www.reuters.com/business/most-companies-suffer-some-risk-related-financial-loss-deploying-ai-ey-survey-2025-10-08

Deloitte's $440K AI-Generated Report: A Cautionary Tale for Business

[30 days, 30 Problems - In this series of one posting a day, I will investigate the economic impacts that unfold when policy meets technology.]

When policy meets technology without oversight, the consequences can be both reputational and financial. Deloitte’s partial refund to the Australian government after it was revealed that parts of a $440,000 report were generated by AI serves as a cautionary case for organizations using generative tools in high-stakes policy analysis.

When in July 2025, Deloitte delivered a report evaluating a welfare compliance IT system was for the Australian Department of Employment and Workplace Relations (DEWR), it was found to include AI-generated text containing fabricated citations and factual inaccuracies.

After an internal investigation, Deloitte agreed to refund a portion of the $440,000 contract value, acknowledging the inappropriate and undisclosed use of OpenAI’s GPT-4 model through Microsoft’s Azure platform.

The Guardian reported on October 6, 2025, that Deloitte’s leadership had voluntarily disclosed the use of AI and cooperated with the government to correct the record.

---

Financial and Reputational Cost to Deloitte (Estimated)

Category	Estimated Cost (AUD)	Notes
Refund to Australian Government	220,000	Partial refund of contract value
Internal Audit and Review Costs	80,000	Compliance, legal review, and corrective reporting
Loss of Future Government Contract Bids	500,000+ (projected)	Conservative estimate of short-term contract exclusion
Reputational Management and PR Costs	50,000	Crisis communication, public apology, stakeholder management
Total Estimated Financial Impact	850,000+	Including direct and opportunity costs

Note: The above costs are estimated based on public reporting (The Guardian, ABC News) and some comparable case precedents for reputational losses in consulting contracts.

---

Broader Policy Implications

This case highlights a critical intersection between technology governance and public accountability:

• Transparency Gap: The report did not disclose that portions were generated using AI tools. This omission breached expectations under Australian Public Service guidelines for contractor disclosure.

• Verification Deficit: Automated text generation was not independently reviewed by a domain expert before submission, leading to factual errors.

• Accountability Challenge: The lack of clear policy on AI-assisted consulting led to confusion about responsibility for quality control.

These points align with emerging global standards such as the EU AI Act (2024) and Canada’s Artificial Intelligence and Data Act (AIDA), both of which require explicit disclosure and traceability of AI-generated materials in government and high-risk contexts.

---

AI Risk vs. Compliance Cost (Global Consulting Benchmarks)

Risk Category	Average AI-Related Incident Cost (USD)	Likelihood in 2025 (%)
Undisclosed AI use in deliverables	500,000–1.2M	18%
Data leakage or IP risk	1.8M	12%
Hallucination or misinformation in reports	300,000–800,000	25%
Loss of client trust/reputation	>2M	30%

Source: PwC Global AI Risk Survey (2025), Deloitte Insights (2024), and Stanford HAI AI Index (2025).

---

Lessons Learned: Responsible AI Use in Consulting and Policy Work

For Consulting Firms:

• Establish AI governance frameworks requiring disclosure, peer review, and validation of outputs.

• Adopt AI Ethics Committees to review use cases in government or public-interest projects.

• Track model provenance and maintain human-in-the-loop workflows.

For Governments:

• Require AI disclosure in all deliverables.

• Maintain audit logs of contractor-generated materials.

• Implement clear penalties for undisclosed AI use that compromises factual accuracy.

---

Deloitte’s AI controversy underscores a fundamental truth: efficiency cannot replace accountability.

Generative AI can accelerate analysis and drafting, but when deployed in policy-sensitive environments without guardrails, it risks undermining institutional trust and causing tangible financial loss.

As governments worldwide integrate AI into decision-making, this case serves as both a warning and a roadmap — demonstrating that responsible AI isn’t just an ethical imperative; it’s an economic necessity.

Microsoft Introduces Copilot - The Future of Workspace Applications

This will change the way we work  forever!

Microsoft has introduced Copilot which will be embedded in the Microsoft 365 apps and is more than OpenAI’s ChatGPT embedded into Microsoft 365. With the following capabilities already, and continual improvement, it can TRANSFORM workspaces:

Create powerful presentations with a simple prompt with Copilot in PowerPoint by adding relevant content from an old document. 

Analyze trends and create meaningful data visualizations in seconds with Copilot in Excel.

Summarize key discussion points and suggest action items real-time with Copilot in Teams.

Moreover, Business Chat can be fed with natural language prompts like “Tell my team how we updated the project strategy,” and it will generate a status update based on the morning’s meetings, emails and chat threads.

Amazed at the power of #artificialintelligence.

“Today marks the next major step in the evolution of how we interact with computing”, said Satya Nadella, Chairman and CEO, Microsoft, while introducing Copilot yesterday.