Context: The AI Act marks a new chapter in AI governance, affecting companies around the world seeking to offer their services within the European Union. This study focuses on the comprehensive AI Act requirements set out for high-risk AI systems. Objectives: We explored the perceived compliance challenge for the AI Act’s high-risk requirements and associated contributing factors; the AI Act’s impact on industry in terms of positive and negative side effects; and the sentiment of industry practitioners towards the AI Act’s Codes of Conduct for the voluntary application of the act’s high-risk AI requirements. Method: A multiple case study encompassing six case companies supplemented by three independent experts with a total of 16 respondents was conducted. Results: A ranking represents the different perceived levels of challenge for each AI Act high-risk requirement. The ranking is led by the following requirements, starting with the most challenging one: (1) data quality and governance (Art 10), (2) accuracy, robustness, and cybersecurity (Art 15), (3) risk and quality management system (Art 9, 17), and (4) transparency (Art 13). Moreover, four contributing factors emerged that impact the perceived compliance challenge: (1) industry and brand values, (2) existing regulatory environment, (3) AI maturity level and proficiency, and (4) company size. We identified several general key factors for the AI Act’s impact on industry and outlined strong arguments both for and against the AI Act voiced by practitioners. The sentiment towards the AI Act’s Codes of Conduct turned out very positive. Conclusion: This study offers a valuable primary research contribution to software engineering, where the state-of-the-art remains short of compliance-oriented studies with a focus on the operationalization of certain AI Act aspects. Future work is advised to develop artifacts facilitating AI Act operationalization and to validate them with industry partners.

More than ever, Machine Learning (ML) as a subfield of Artificial Intelligence (AI) is on the rise and is finding its way into safety-critical software applications. However, when it comes to quality assurance (QA) and trustworthiness, integrating ML models into software comes with challenges that may not be apparent at first glance. The European Union (EU) aims to tackle this problem with new regulatory requirements in the form of harmonized rules on AI (AI Act). It is a risk-based approach with extensive requirements for high-risk systems as well as for foundation models that can be used in various downstream AI systems. Reliable software engineering processes in the form of ML-enabled automated pipelines are likely to become a discerning factor for legally compliant ML systems. Our research project aims to contribute to the field by establishing an empirically grounded foundation on how to achieve trustworthy AI Act compliant ML systems. Both a literature review and an interview study are ongoing. At a later stage, concrete tools shall be developed, ideally in cooperation with an industry partner, possibly by utilizing the concept of regulatory sandboxes.