Work

Master's thesis · UC3M · June 2026

Compliance.AI

A business plan for EU AI Act compliance in SMEs

Prove your AI is legal, without hiring a lawyer.

Programme
Master in Management, Universidad Carlos III de Madrid
Supervisor
Professor Samira Reis
Defended
June 2026
Grade
8.5 / 10

01/Abstract

Compliance.AI is a B2B SaaS platform designed to help European SMEs comply with the EU AI Act (Regulation EU 2024/1689). On 7 May 2026 the Council and the Parliament reached a provisional agreement under the Digital Omnibus to defer stand-alone Annex III high-risk obligations to 2 December 2027. The plan is built around that window.

It sets out the strategic positioning, market opportunity, competitive structure, product architecture and financial projections for a specialist compliance solution aimed at the gap left open by enterprise-focused competitors. The analysis draws on Porter's Five Forces, the resource-based view and organisational ecology, and positions Compliance.AI as a focused competitor in the SME compliance-technology market.

02/The plan in numbers

  • EUR 199

    Per month for the Essentials tier, against a EUR 50k to 250k consulting bill

  • 434,000

    SMEs with 10 to 249 employees in the Year 1 markets: Spain, Italy, Portugal

  • 700–1,200

    Addressable firms after scope and reach filters

  • EUR 400k

    Seed required, of which EUR 80k founder equity, no second raise

  • Month 33

    EBITDA break-even from inception; net income positive from Year 3

  • 60% → 82%

    Gross margin, Year 1 to Year 5, as human review automates

03/Five-year financials

Base case. Revenue follows the customer count: 24 at the end of Year 1, 301 by Year 3, 843 by Year 5. Losses in the first two years, profit from Year 3, and the bank balance never goes below EUR 30,000.

Revenue and net income by year, base case: revenue grows from EUR 49,276 in Year 1 to EUR 3.7 million in Year 5; net income is negative in Years 1 and 2 and reaches EUR 1.4 million in Year 5.
Base case, EUR
Y1Y2Y3Y4Y5
Revenue49,276308,772989,9632,134,7873,708,519
EBITDA(181,049)(189,228)88,963606,7871,453,519
Net income(185,549)(199,228)77,963594,7871,435,519
Cash, end of year219,85730,216125,885735,4752,177,571

Year 1 starts at the August 2027 platform launch. No tax until Year 4: losses from Years 1 and 2 offset later profit, then Spain's 15% rate for new companies applies.

04/What the plan argues

  1. 01

    The gap is structural, not temporary

    Enterprise governance vendors price at USD 30,000 to 150,000 a year and cannot repay an enterprise sales team on a EUR 199 contract. Resource partitioning explains why they do not follow a specialist downmarket.

  2. 02

    Four modules mapped to the Act

    A risk-classification engine (Article 6, Annex III), an Annex IV documentation generator, a conformity workflow (Annex VI) and post-market monitoring (Article 72). Monitoring is where the switching costs build.

  3. 03

    Three people, not ten

    A founder on zero salary until EUR 240k ARR, a Head of AI Act Compliance and an Italy lead. European seed benchmarks run ten people on EUR 1 million; this plan runs three on EUR 400k.

  4. 04

    Churn is the number to watch

    The base case assumes 3.5% monthly churn. At 5% the lifetime value of an Essentials customer falls from EUR 3,411 to EUR 2,388 and the 3:1 LTV-to-CAC floor breaks once fully loaded acquisition cost passes EUR 800.

  5. 05

    Exit and pivot triggers are written down

    A sustained 25% fall in monthly customer additions, or a further six-month delay to the deadline, activates a focused exit to a GRC platform. Growth at 1.5 to 2 times base case pulls a Series A forward.

05/Structure

  1. 01Business idea and strategic positioning
  2. 02External analysis: PESTEL and Porter's Five Forces
  3. 03Internal analysis: VRIO, capability stack and SWOT
  4. 04Marketing plan: market sizing, pricing, four channels
  5. 05HR plan: the three-person team
  6. 06Operations
  7. 07Financial plan: five years, unit economics, scenarios
  8. 08Implementation plan
  9. 09Critical risks and contingency plan

Frameworks

  • PESTEL
  • Porter's Five Forces
  • Resource-based view
  • VRIO
  • Organisational ecology
  • Resource partitioning
  • SWOT
  • Unit economics
  • Scenario and sensitivity analysis

Sole author. The views are mine and were written as academic work, not as advice.