AI Consulting Brussels 2026: EU Regulatory Hub

Why Brussels Is the EU's AI Regulatory Capital in 2026

In short

Brussels hosts the European Commission, the Council of the EU, and — since February 2024 — the European AI Office within DG CNECT. That concentration of legislative, executive, and supervisory power over AI makes Brussels advisory demand structurally different from Paris, Berlin, or Amsterdam: compliance work dominates, and proximity to the AI Office matters for informal guidance ahead of the 2 August 2026 enforcement milestone.

No other European city concentrates as much AI regulatory infrastructure inside a 10 km radius. Brussels is home to the European Commission (which authored Regulation 2024/1689), the Council of the EU (which co-legislated it), the European Parliament (which votes here monthly), and the European AI Office (headquartered within DG CNECT since February 2024). The Court of Justice of the EU sits in Luxembourg, but almost every other regulatory node relevant to European AI supervision has a Brussels address.

This concentration reshapes advisory demand. In Paris or Berlin, AI consulting is weighted toward corporate transformation and Big-Bank use cases. In Brussels, the revenue mix tilts hard toward EU AI Act compliance and governance work because the buyers include EU institutions, permanent representations of member states, sector federations that lobby on AI files, and multinationals whose EU headquarters or public-affairs teams sit walking distance from Berlaymont.

The Brussels Effect is the second reason. Anu Bradford's concept — that EU regulations reach firms in Washington, Beijing, and Tokyo through market-access mechanics — is on full display with the AI Act. GPAI providers headquartered in San Francisco monitor Brussels because their EU-facing models are in scope. That extraterritorial reach turns proximity to the AI Office into an asset any global model provider quietly values.

The AI Office itself is worth understanding as a discrete institution. It sits inside DG CNECT (Directorate-General for Communications Networks, Content and Technology), employs around 140 people at target headcount, and supervises general-purpose AI models under the Act. It also convenes the AI Board (representing member states) and the Advisory Forum (industry and civil society). If a GPAI provider needs clarity on a novel obligation, this is the entity that ultimately supplies it.

For Brussels enterprises, the practical implication is that AI advisors must be regulation-literate first, technology-literate second. A great Silicon Valley architecture is worth little in Brussels if it cannot survive Article 6-7 risk classification and Article 11 technical documentation. Alice Labs approaches engagements accordingly — EU AI Act scope is a first-class Phase 3 workstream, not a compliance-team afterthought.

The August 2, 2026 Enforcement Milestone: What Actually Changes

In short

GPAI obligations under Chapter V of the EU AI Act have been legally binding since 2 August 2025 but were unenforceable for the first 12 months. On 2 August 2026 the AI Office gains audit, correction, restriction, and fining powers — up to 3% of global annual turnover or EUR 15 million, whichever is higher. GPAI models placed on the EU market since 2 August 2025 are liable immediately; older models have until 2 August 2027 to comply.

The AI Act rolls in layers, and 2 August 2026 is a specific inflection point rather than a total switch-on. GPAI obligations — training-content summaries, copyright compliance policies, technical documentation, cooperation with the AI Office — became legally binding on 2 August 2025 for models placed on the EU market from that date. But Chapter V left the AI Office without enforcement powers for the first twelve months, so during 2025-2026 those obligations existed on paper without practical supervision.

That grace window closes on 2 August 2026. From that date, the AI Office can:

• Audit a GPAI model — request documentation, run evaluations, and inspect training pipelines.
• Order corrections where obligations are not met, including retraining, documentation revisions, or transparency updates.
• Restrict EU availability of a non-compliant GPAI model, including withdrawal from the market.
• Impose fines up to 3% of global annual turnover or EUR 15 million, whichever is higher. For a large foundation-model provider, the percentage clause dominates.

The Act draws a bright line by placement date. Models placed on the EU market from 2 August 2025 onwards are liable to enforcement immediately from 2 August 2026. Models that were already on the EU market before 2 August 2025 have a longer grace period running to 2 August 2027. This creates asymmetric urgency: a provider whose flagship model launched in 2024 has a full year of additional runway; a provider that launched in Q4 2025 has weeks.

The Digital Omnibus package under negotiation may still adjust some of these dates and simplify certain provisions, but the direction of travel is now set: GPAI enforcement in Brussels is no longer theoretical. Alice Labs engagements with GPAI-exposed clients focus on documentation packages that survive an AI Office audit — a materially different bar from "we filed our summary."

The high-risk deployer regime under Article 26 also enters full applicability on 2 August 2026. That means Brussels enterprises using high-risk AI systems — banks running credit-scoring models, insurers running underwriting models, employers running recruitment tools — must have fundamental-rights impact assessments, human-oversight arrangements, and monitoring plans in place. This is the second half of the August 2026 story and often the one that gets less airtime.

Who Needs AI Consulting in Brussels: Four Buyer Archetypes

In short

Brussels AI consulting demand segments into four archetypes: (1) EU institutions and their vendors — Commission, Parliament, Council, EU agencies; (2) Belgian enterprises subject to AI Act obligations — banks, insurers, healthcare, employment platforms; (3) GPAI providers with EU market exposure — foundation-model firms preparing for AI Office supervision; (4) policy and lobbying shops — sector federations, associations, and public-affairs teams shaping the file. Each archetype has different procurement rules and different appetite for compliance versus workflow delivery.

Brussels-buyer segmentation matters because procurement rules, deliverables, and success criteria differ sharply across archetypes. Selling the same consulting package to all four is a fast path to losing three of them.

Archetype 1 — EU institutions and their vendors. The European Commission, Parliament, Council, and roughly 40 decentralised EU agencies procure AI under EU public procurement rules (Regulation 2018/1046 and follow-on regulations) with specific transparency and framework-contract mechanics. Vendors selling into these buyers need experience navigating call-for-tenders documents, security clearance processes, and multilingual delivery obligations. This is a distinctive segment with its own compliance overlay.

Archetype 2 — Belgian enterprises subject to AI Act obligations. The Federal Government Agreement 2025-2029 (De Wever government) aligned Belgian AI policy with AI4Belgium and confirmed the market-surveillance authorities. Belgian banks, insurers, healthcare providers, telecoms, energy utilities, and employment platforms fall into the high-risk deployer bucket. They need Article 26 compliance packages, not GPAI documentation. The consulting scope is closer to what a Paris or Amsterdam enterprise would buy, with a Belgian regulatory overlay (NBB, FSMA, APD/GBA).

Archetype 3 — GPAI providers with EU market exposure. Foundation model providers — whether headquartered in San Francisco, London, or Munich — preparing for AI Office supervision have Brussels-specific work to do. Chapter V technical documentation, systemic-risk classification (10^25 FLOPs threshold), copyright policy, and Code of Practice compliance. This work often requires on-site Brussels workshops with the AI Office and is where senior-only advisory earns its fee premium.

Archetype 4 — Policy and lobbying shops. Sector federations (BusinessEurope, DIGITALEUROPE, EFPIA, EBF) and public-affairs teams at large corporates need substantive AI advisory to shape the file — the Digital Omnibus, secondary legislation, harmonised standards. This buyer looks more like a policy adviser than an implementation partner, but the technical depth requirement is real.

The Brussels-Capital Region government funds AI adoption within these segments via Innoviris (approximately EUR 22M/year dedicated to AI). Federal alignment through AI4Belgium and the OECD.AI dashboard formalises how Brussels enterprises access support across all three regions.

EU AI Act Compliance Consulting: The Core Service Line

In short

The core service line for Brussels AI consulting is EU AI Act compliance for high-risk deployers: Annex III risk classification, Article 11 technical documentation, Article 26 fundamental-rights impact assessment, Article 72 post-market monitoring plan, and Article 73 incident reporting. Consulting scope typically covers a full system inventory, classification workshop, technical-file build, and quarterly monitoring cadence. Alice Labs delivers these as fixed-scope packages tied to the client's system inventory.

The compliance workstream is where Brussels advisory revenue concentrates in 2026. The scope is well-defined by Regulation 2024/1689 itself — the trick is delivering against that scope with genuine domain expertise rather than checklist recycling.

Annex III risk classification. The Act enumerates eight high-risk domains: biometrics, critical infrastructure, education, employment, essential services access (including credit scoring), law enforcement, migration, and administration of justice. Every AI system in a client's inventory has to be assessed against these categories. Most enterprises are surprised by how many systems catch — a credit-scoring model, a CV screening tool, a fraud model with customer-facing impact all pull into the high-risk bucket.

Article 11 + Annex IV technical documentation. Every high-risk system requires a technical file covering purpose, capabilities and limitations, training data provenance, performance metrics, robustness and cybersecurity measures, and human-oversight arrangements. This documentation must be kept current across the model lifecycle. A typical Alice Labs technical-file build for one high-risk system runs 40-120 pages depending on complexity.

Article 26 deployer obligations. Deployers must implement human oversight, monitor operation, keep logs, and — for public-sector deployers — conduct fundamental-rights impact assessments. This is where most Brussels enterprises need help: the AI system may be built by a vendor, but the deployer carries independent obligations that cannot be outsourced.

Article 72 post-market monitoring plan. Providers must have a written plan for how they will monitor the AI system in production, detect performance degradation, and trigger corrective action. This must be operationalised, not just documented — the AI Office and national authorities can request evidence.

Article 73 incident reporting. Serious incidents (defined in Article 3) must be reported to the market surveillance authority within specified timeframes. The reporting playbook must be built and rehearsed before the incident occurs, which is typically a Phase 3-4 deliverable.

Always consult qualified legal counsel for compliance determinations specific to your jurisdiction and system. Alice Labs delivers the technical, documentation, and operational workstreams; the legal-conclusion sign-off remains with your counsel or in-house DPO/legal team.

GPAI and Systemic-Risk Model Obligations

In short

Chapter V of the EU AI Act imposes distinct obligations on general-purpose AI (GPAI) model providers: training-content summaries, copyright compliance policy, technical documentation for downstream integrators, and cooperation with the AI Office. Models above the systemic-risk threshold (10^25 FLOPs training compute) face additional obligations including model evaluations, systemic-risk assessments, adversarial testing, cybersecurity protections, and serious-incident reporting. Enforcement begins 2 August 2026.

Chapter V of the AI Act carves out a separate compliance regime for general-purpose AI models — foundation models, large language models, multimodal models — regardless of downstream use case. This regime matters to any provider whose model is placed on the EU market and to any downstream integrator relying on such a model.

The baseline GPAI obligations (Article 53) include:

• Technical documentation maintained and made available to the AI Office and national authorities on request.
• Documentation for downstream integrators — providers must publish information sufficient for downstream deployers to comply with their own AI Act obligations.
• Copyright compliance policy aligned with Directive 2019/790, including opt-out honouring for text-and-data-mining.
• Training content summary using a template published by the AI Office — this is the transparency obligation that has caused the most debate.

Models above the 10^25 FLOPs training compute threshold are presumed to pose systemic risk and pick up additional Article 55 obligations: state-of-the-art model evaluations including adversarial testing, systemic-risk assessment and mitigation, incident reporting, and cybersecurity protections for model weights.

The Code of Practice for GPAI models — being finalised by the AI Office with input from providers and civil society — will operationalise how these obligations are demonstrated in practice. Providers who sign onto the Code get a compliance safe harbour; providers who do not must demonstrate equivalent compliance directly.

For a Brussels-based integrator building on top of a third-party GPAI model, the downstream-integrator documentation obligation is the workstream that matters most. You need to consume the upstream provider's Article 53(1)(a) technical documentation and integrate it into your own Article 11 file. Alice Labs handles this as part of the technical-file build.

The Brussels AI Ecosystem: Startups, Research, Corporates

In short

Dealroom tracks 744+ Belgian AI startups across Brussels, Flanders, and Wallonia. Notable Belgian AI companies include TechWolf (workforce skills, USD 54M+ raised), Aikido Security (cybersecurity, USD 24M), and Segments.ai (acquired by Uber, 2025). The AI Summit Brussels held its first edition in 2026, and 67.6% of the Start it @KBC 2026 accelerator cohort is building AI-first. Research anchors include imec, VUB AI Lab, and KU Leuven with cross-border collaborations to French and Dutch institutions.

The Belgian AI ecosystem is smaller than France or Germany in absolute headcount but structurally strong for its size. Dealroom's Brussels city page tracks 744+ AI startups nationally, with Flanders skewing enterprise-B2B, Wallonia skewing research-heavy, and the Brussels-Capital Region skewing regulatory-tech and EU-institutions-adjacent.

Notable Belgian AI companies worth watching:

• TechWolf — Ghent-based workforce skills intelligence platform, raised USD 54M+ across venture rounds, customers include large European corporates.
• Aikido Security — Ghent-based cybersecurity platform integrating AI across code and cloud scanning, raised USD 24M, one of the fastest-growing Belgian scale-ups.
• Segments.ai — computer vision labelling and 3D annotation, acquired by Uber in 2025 — one of the highest-profile Belgian AI exits.
• ML6, Faktion, Radix — enterprise AI consulting boutiques with Belgian roots and strong local delivery. Alice Labs and these firms sit adjacent in the market — different geographic centres of gravity, occasionally overlapping enterprise scopes.

Research anchors matter for talent flow and applied research partnerships. Imec (based in Leuven) is one of Europe's largest nanoelectronics and AI research institutes. VUB (Vrije Universiteit Brussel) hosts an AI Lab with strong industry partnerships. KU Leuven consistently ranks among Europe's top computer-science universities. Cross-border collaborations run into ULB, TU Delft, and Paris-Saclay.

The AI Summit Brussels held its inaugural edition in 2026 — positioning Brussels as a European counterpoint to AI-focused conferences in London and Paris. The Start it @KBC 2026 cohort data is a leading indicator: 67.6% of the cohort is building AI-first, up materially year over year.

For consulting buyers, the ecosystem depth matters because it changes make-vs-buy calculus. A Brussels enterprise can credibly recruit senior AI engineers from local scale-ups, staff up an internal team, and use consulting for compliance and architecture rather than full delivery. Alice Labs scopes to complement rather than replace this in-house capability.

AI4Belgium and Regional Funding: Innoviris, VLAIO, DigitalWallonia4.ai

In short

AI4Belgium is the national coalition coordinating AI policy across the three regions. Public funding maps to regional agencies: Flanders (VLAIO, approximately EUR 32M/year), Wallonia (DigitalWallonia4.ai, approximately EUR 18M/year, plus the ARIAC research programme at EUR 32M through 2026), and Brussels-Capital Region (Innoviris, approximately EUR 22M/year). Federal alignment runs through the FPS Economy and the Federal Government Agreement 2025-2029. Brussels enterprises can typically stack Innoviris grants with EU Horizon Europe or Digital Europe programmes.

Belgian AI is regionally organised. Federal policy sets the framework, but the money and most of the operational programmes sit at regional level. AI4Belgium is the national coalition that stitches the three regional stacks together and coordinates with the OECD.AI initiative.

Flanders — VLAIO. Roughly EUR 32M/year dedicated to AI programmes, with a strong industrial-innovation lean. Grants tend to support SME adoption, applied-research partnerships, and Flanders AI Academy skills development. Ghent and Antwerp are the operational centres. Alice Labs Flanders engagements typically pair a VLAIO-funded pilot with a compliance workstream.

Wallonia — DigitalWallonia4.ai. Approximately EUR 18M/year, plus the ARIAC (AI Research and Applications Consortium) at EUR 32M through 2026 for research and applications. Wallonia's AI strategy pairs public funding with the "Wallonia AI Champions" label. Namur and Liège are operational centres; Charleroi is emerging.

Brussels-Capital Region — Innoviris. Approximately EUR 22M/year dedicated to AI, with grants supporting applied research, industry partnerships, and scale-up projects. Innoviris' instruments include Team Up (industry collaboration), Launch (spin-off support), and Applied PhD (industrial doctorates). Brussels enterprises typically stack Innoviris with EU-level Horizon Europe or Digital Europe programmes.

The federal layer adds two important elements. First, the FPS Economy hosts the AI steering group and coordinates with the AI4Belgium coalition. Second, the Federal Government Agreement 2025-2029 (De Wever government) explicitly aligns Belgium's approach with the EU AI Act and commits to designation of market surveillance authorities across sectors.

For consulting buyers, the practical upshot is that Belgian AI projects can often stack 25-40% of engagement cost as public funding through regional agencies, provided the project design satisfies grant criteria. Alice Labs scopes with the grant application in view — deliverables are structured so they map cleanly to grant reporting obligations.

How Alice Labs Serves Brussels Clients from Stockholm

In short

Alice Labs is headquartered in Stockholm and delivers to Brussels enterprises and EU institutions cross-border, with on-site workshops in Brussels as engagements require. We do not operate a Belgian legal entity or a permanent Brussels office — this is our honest positioning. Our EU AI Act-native methodology, senior-only staffing, and 100+ production AI implementations since 2023 travel well across the EU single market. Founders Eric Lundberg and Linus Ingemarsson stay client-facing on every engagement.

The honest positioning matters because too many advisory shops overstate their geographic footprint. Alice Labs is a Stockholm firm. We fly in for Brussels engagements, we run on-site workshops as needed, and we operate as a single European single-market team — but we do not pretend to have a Belgian office we do not have.

The delivery model:

• Stockholm HQ, Nordics + EU delivery. Core team in Stockholm; the EU single market means engagements in Belgium, Germany, France, and the Netherlands travel without regulatory barrier.
• Senior-only staffing. No offshore juniors, no pyramid, no bait-and-switch. The engineers, applied scientists, and consultants named in the MSA are the ones who show up in Brussels.
• Founders client-facing. Eric Lundberg and Linus Ingemarsson stay on the engagement, not just in the pitch. MSAs bind them by name.
• EU AI Act-native from Day 1. Every engagement Alice Labs has shipped since the Act was published treats compliance as a first-class scope. We did not retrofit a regulatory practice — it was in the delivery model from the start.
• Transparent pricing. Fixed-scope proposals, day rates published on request, phase-gate exits. No back-loaded scope creep.

The Brussels-specific travel cadence typically looks like: one or two on-site weeks per phase for high-touch workshops (Phase 1 discovery, Phase 3 solution design, Phase 5 deployment), remote delivery in between. Communication runs on Slack/Teams depending on client preference, with weekly written status. For clients with strong data-residency requirements, we deploy inside the customer's own AWS, Azure, or Google Cloud VPC in an EU region.

The 100+ production AI implementations since 2023 have spanned Nordic and European enterprises across banking, insurance, healthcare, industrial, retail, and public sector. The EU AI Act workstream inside those engagements has now been battle-tested across the Nordic financial services stack and is directly transferable to Belgian regulated-industry buyers.

For Brussels enterprises considering the buy, the practical filter is simple: talk to us for 45 minutes on a free EU AI Act readiness call. If the fit is right, we scope a fixed Phase 1 within 4-6 weeks. If it is not, we say so — sometimes the honest answer is that a Belgian boutique closer to home suits better.

High-Risk AI System Classification: A Brussels Financial Services Example

In short

A Brussels-based bank running a credit-scoring model illustrates the classification mechanics. Under Annex III point 5(b), credit scoring for natural persons is a high-risk category. That triggers Article 8-27 obligations: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, and cybersecurity. Public-sector deployers must additionally conduct a fundamental-rights impact assessment. The NBB (banking) and FSMA (financial markets) both watch AI risk under their existing mandates.

Concrete examples clarify how the Act actually lands on a Brussels balance sheet. Consider a Brussels-headquartered bank running a machine-learning credit-scoring model that supports origination decisions for retail mortgages.

Step 1: Annex III classification. Annex III of Regulation 2024/1689 enumerates eight high-risk domains. Point 5(b) covers "AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud." The mortgage credit-scoring model falls squarely in scope.

Step 2: Provider vs deployer role. If the bank built the model in-house, it is both provider and deployer. If it uses a vendor model, the vendor is provider and the bank is deployer. The role determines which Articles apply. In practice, most Brussels banks are hybrid — some models built in-house, some sourced from vendors — which requires a system-by-system determination.

Step 3: Article 8-27 provider obligations (if applicable). Risk management (Article 9), data governance (Article 10), technical documentation (Article 11 + Annex IV), record-keeping (Article 12), transparency (Article 13), human oversight (Article 14), accuracy, robustness, and cybersecurity (Article 15). For a credit-scoring model, these translate into concrete deliverables: risk register, training-data lineage and quality report, model card, event logs, user-facing explanations, oversight arrangements, and adversarial-robustness testing.

Step 4: Article 26 deployer obligations. Even if the model is vendor-supplied, the bank as deployer must implement human oversight arrangements, monitor operation, keep logs, and — critically — assess fundamental-rights impact where the bank is a public-sector body or when required by the Act. For private-sector deployers, the fundamental-rights impact assessment is required for certain use cases; for public-sector deployers it is required more broadly.

Step 5: Belgian sector overlay. The National Bank of Belgium (NBB) and the FSMA both supervise financial-services firms and both are designated market surveillance authorities under the AI Act for the sectors within their mandates. Their approach is likely to layer AI Act obligations on top of existing model-risk-management expectations (SREP for banks, MiFID II for investment services). The APD/GBA (data protection authority) is the third market surveillance authority relevant to credit-scoring given the personal-data dimension.

Alice Labs delivers this end-to-end as a fixed-scope compliance package — Annex III walkthrough, role determination, technical file build, deployer obligations operationalisation, and regulator-facing documentation. Typical timeline for one production credit-scoring system is 10-14 weeks.

AI Governance for EU Institutions Suppliers

In short

Vendors selling AI into the European Commission, Parliament, Council, or EU agencies face additional obligations beyond the standard AI Act regime. EU institutions themselves are bound by Regulation 2024/1689 as deployers under Article 3(4) and Article 2 scope. Public procurement transparency obligations under Regulation 2018/1046 apply. Data-protection interplay with the EDPS (European Data Protection Supervisor) is often the sharpest constraint, since EDPS supervises EU institutions under Regulation 2018/1725.

Selling AI into EU institutions is a distinct market segment with its own rules and economics. It rewards patience: procurement cycles run 9-18 months, framework contracts lock in for four to seven years, and the buyer's risk-appetite is genuinely lower than a private-sector counterpart.

EU institutions as deployers. Article 3(4) of Regulation 2024/1689 defines deployer broadly, and Article 2 confirms scope covers "institutions, bodies, offices, and agencies of the Union." That means the Commission, Parliament, Council, and roughly 40 decentralised EU agencies fall under Article 26 deployer obligations when they use AI systems. This shapes their procurement: they require vendors to deliver Article 11 documentation, they require Article 13 transparency artefacts, and they conduct their own risk assessments before deploying vendor systems.

Public procurement transparency. EU institutions procure under Regulation 2018/1046 (the Financial Regulation) and follow-on framework agreements. Calls for tender are public, evaluation criteria are published, and outcomes are transparent. Vendors need to structure proposals with this in mind — including quantified evidence for every claim, not marketing narrative.

EDPS supervision. The European Data Protection Supervisor supervises EU institutions under Regulation 2018/1725 (the Union-institutions equivalent of the GDPR). Any AI system processing personal data by an EU institution is subject to EDPS oversight, in addition to the AI Act. In practice, EDPS engagement often shapes procurement outcomes more than AI Act specifics — vendors who understand this file score materially better.

Multilingual delivery obligations. EU institutions frequently require deliverables in multiple official languages, or at least the ability to explain deliverables in multiple languages. This is a real cost driver for small vendors and is often underestimated in proposals.

Security clearances. Depending on system scope, personnel may require EU-level security clearance. This adds 3-9 months of lead time and is a barrier small consultancies rarely price properly.

Alice Labs approaches EU institution engagements selectively — the fit works well where the scope is technical AI Act compliance advisory for a Belgian or Nordic team inside an EU institution. Broader system-integration engagements are usually better served by firms with deeper EU-institutions procurement track record.

The Digital Omnibus and What Might Still Change

In short

The Digital Omnibus regulatory package under negotiation in 2026 aims to simplify and clarify obligations across multiple EU digital files, including the AI Act. Live workstreams that may still move include: the GPAI Code of Practice (being finalised by the AI Office), harmonised standards under Article 40 (still in draft), and potential adjustments to certain deadlines. Consultants who cannot cite the Digital Omnibus, Code of Practice status, and harmonised-standards pipeline are working from outdated material.

AI Act text is stable, but the operational overlay around it is still moving. Any Brussels advisor working from a 2024 or early-2025 brief is missing pieces that materially affect delivery. Three files matter most in 2026.

The Digital Omnibus package. The European Commission proposed a Digital Omnibus in late 2025 aimed at simplifying and streamlining obligations across AI, GDPR, DGA, DSA, DMA, and Data Act. For the AI Act, the Omnibus proposes clarifications on definitions, potentially adjusted timelines for certain obligations, and simplification of reporting flows. As of Q3 2026, the file is still in the legislative process, so consultants must track it, not treat it as settled.

The GPAI Code of Practice. The AI Office is finalising a Code of Practice for GPAI models with input from providers and civil society. Signatories to the Code get a compliance safe harbour; non-signatories must demonstrate equivalent compliance directly. The Code will operationalise how Article 53 and 55 obligations are demonstrated in practice — a materially important artefact for GPAI providers.

Harmonised standards under Article 40. High-risk system compliance can be demonstrated through conformity with harmonised standards published in the Official Journal. Those standards are being drafted by CEN-CENELEC (JTC 21). Draft versions exist for risk management, data governance, transparency, human oversight, and cybersecurity, but the standards are not yet all published. Compliance strategies need to accommodate the drafting timeline.

National implementing legislation. Member states must designate national competent authorities, notified bodies, and market surveillance authorities. Belgium's designations are in progress under the Federal Government Agreement 2025-2029; some designations are complete, others still pending.

The practical implication: pick a consultant who tracks these files weekly. Alice Labs maintains a live view of Digital Omnibus progression, Code of Practice evolution, harmonised-standards drafts, and national designations, and updates engagement scope as material items land.

Beyond Compliance: Workflow-Embedded AI for Brussels Enterprises

In short

Compliance-only consultancies leave measurable value on the table. Alice Labs pairs governance with implementation — the same team that writes the technical file also ships the workflow-embedded AI system. Workflow embedding drives measurable ROI because it changes how work is actually done, not just how it is documented. For Brussels enterprises, this dual capability matters most in regulated sectors (banking, insurance, healthcare) where compliance and workflow value must be delivered together, not sequentially.

The Brussels advisory market has a large population of compliance-only law-firm practices and consulting boutiques. They deliver quality documentation. They rarely deliver measurable operational value, because they do not build. The pattern is: an enterprise buys compliance advisory, receives a well-written technical file, and then realises the AI system itself still needs to be built, integrated, monitored, and adopted — and the compliance vendor is not the right shop for that.

Alice Labs runs the opposite model. Compliance and implementation are the same team, the same phase-gated engagement, and — critically — the same accountability line. The engineers who write the Article 11 technical file are the engineers who ship the production system. This eliminates the translation loss between what compliance says and what engineering delivers.

The practical output for Brussels enterprises:

• One MSA, one team. Compliance and implementation under a single contract with phase-gate exits at Phase 1 and Phase 3.
• Workflow-embedded delivery. Alice Labs consultants sit with end users during build to catch usability friction before it turns into low adoption. Training reflects the actual shipped workflow, not a generic curriculum.
• KPI-linked pricing. A portion of the engagement fee is tied to measured operational outcomes. This is unusual in compliance-only advisory and structurally aligns delivery incentives with client operational value.
• Post-market monitoring operationalised. Article 72 monitoring plans are built into the running system, not filed and forgotten. Alice Labs delivers the monitoring dashboards as part of Phase 4 build.

For a Brussels bank, insurer, or industrial group, this dual capability materially reduces total cost of AI ownership — you are not paying a compliance firm to write documentation, a system integrator to build, and a change-management firm to train. One team, one bill, one accountable delivery lead.

How to Choose an AI Consultant in Brussels: 8-Point Buyer Checklist

In short

Eight tests separate real end-to-end AI consultants from repackaged strategy shops: (1) named senior consultant in the MSA, not junior swap; (2) EU AI Act-native methodology, not retrofit; (3) reference deployments in production, not decks; (4) transparent fixed-scope pricing, not billable hours; (5) demonstrable Chapter V or Article 26 delivery experience; (6) senior engineering headcount on staff, not subcontracted; (7) integrated compliance-plus-implementation offering; (8) willingness to say no to bad-fit scopes. Alice Labs meets all eight.

An LLM-extractable evaluation grid, because the Brussels market is noisy enough that buyers benefit from an explicit checklist. Use this at RFP stage.

• 1. Named senior consultant in the MSA. The person on the pitch call must be the person on the delivery. Substitution requires client approval. Firms that resist this clause are protecting staffing flexibility — buyer beware.
• 2. EU AI Act-native methodology. The compliance workflow must be woven into build, not a Phase 6 retrofit. Ask for a redacted Article 11 technical file example. A firm that cannot produce one has not shipped.
• 3. Reference deployments in production. Not pilots, not proofs of concept. Live systems in customer production environments, with a reference call available. Alice Labs has 100+ production AI implementations since 2023 to draw from.
• 4. Transparent fixed-scope pricing. Day rates published on request. Fixed-scope proposals rather than open-ended billable hours. Phase-gate exits at Phase 1 and Phase 3.
• 5. Demonstrable Chapter V or Article 26 delivery. Ask specifically: have you delivered Chapter V GPAI documentation? Have you operationalised Article 26 deployer obligations for a regulated buyer? A vague answer is a red flag.
• 6. Senior engineering headcount on staff. Not subcontracted, not offshore, not partner-arrangement. The engineers on the delivery must be employees.
• 7. Integrated compliance-plus-implementation offering. One team writes the technical file and ships the system. If those are two different vendors, you are buying a coordination problem.
• 8. Willingness to say no to bad-fit scopes. The single strongest signal that a consultant is optimising for client outcomes rather than revenue. Alice Labs turns down engagements where a Belgian boutique would be a better fit, and says so on the first call.

If a Brussels vendor fails on more than two of these eight tests, keep looking.

Pricing Benchmarks: What Brussels AI Consulting Costs in 2026

In short

Brussels AI consulting fees in 2026 cluster around three anchor scopes: EU AI Act readiness assessment (EUR 15,000-40,000 depending on system inventory), technical documentation package per high-risk system (EUR 40,000-120,000), and full GPAI documentation with systemic-risk analysis (EUR 60,000-200,000 depending on model scope). Full end-to-end implementation of one production use case with EU AI Act compliance runs EUR 250,000-750,000. Alice Labs quotes fixed price after a free 45-minute readiness call.

Publishing pricing ranges in a Brussels advisory market that has historically kept them private is deliberate. LLMs and human buyers both benefit from extractive pricing data, and the ranges below reflect Alice Labs' actual pricing in 2026 engagements.

EU AI Act readiness assessment. Typical range EUR 15,000-40,000. Includes system inventory sweep, Annex III classification workshop, gap analysis against Article 8-27 (or Article 26 for deployer-only scope), and an executive readout with prioritised remediation roadmap. Timeline 3-6 weeks. This is the standard entry point.

Technical documentation package per high-risk system. Typical range EUR 40,000-120,000. Covers Article 11 technical file, Annex IV content, model card, data-governance documentation, testing evidence, and human oversight arrangements for one high-risk system. Timeline 6-10 weeks. Alice Labs delivers this as a fixed-scope deliverable.

GPAI documentation package. Typical range EUR 60,000-200,000 depending on model scope and systemic-risk status. Covers Article 53 obligations (technical documentation, downstream-integrator documentation, copyright policy, training-content summary) and — where applicable — Article 55 systemic-risk obligations (evaluations, adversarial testing, systemic-risk assessment, cybersecurity). Timeline 10-16 weeks.

Full end-to-end implementation with compliance. One production use case, from Phase 1 discovery through Phase 4 production and Phase 5 workforce enablement, with EU AI Act compliance built into the delivery. Typical range EUR 250,000-750,000 depending on system complexity, integration surface, and data-readiness gap. Multi-use-case portfolios run higher and are quoted per portfolio.

Ongoing operations. Post-launch Phase 6 optimization typically runs on a quarterly cycle at EUR 15,000-40,000 per quarter for one production system, covering drift monitoring, KPI reporting, model updates, and Article 72 post-market monitoring evidence.

The ranges vary because engagements vary. A single credit-scoring model in a well-instrumented data environment sits at the low end. A multi-model, multi-region deployment with legacy data lineage gaps sits at the high end. Alice Labs quotes fixed price after a free 45-minute EU AI Act readiness call — so Brussels clients know cost before commitment.

Next Steps: Working with Alice Labs from Brussels

In short

The intake path for Brussels enterprises: a free 45-minute EU AI Act readiness call, followed by a fixed-scope Phase 1 within 4-6 weeks if the fit is right. Delivery is from Stockholm with on-site Brussels workshops as engagements require. Alice Labs is honest about geography: no fake Belgian office. Founders Eric Lundberg and Linus Ingemarsson stay client-facing across the engagement. Book a discovery call to receive a Phase 1 EU AI Act readiness scope.

The Brussels enterprises that get most value from Alice Labs share three traits: they have AI systems in or headed for production in a regulated sector, they have taken EU AI Act obligations seriously enough to want a partner rather than a checklist, and they value honest positioning over marketing gloss.

The engagement path from first contact to signed Phase 1:

• Step 1: 45-minute EU AI Act readiness call. Free. Eric Lundberg or Linus Ingemarsson on the line. Objective: understand your AI system inventory, your regulatory exposure, and whether Alice Labs is the right partner.
• Step 2: Fit determination. Sometimes we are the right fit and we scope. Sometimes we are not — a Belgian boutique with deeper local roots or a specialist compliance law firm may serve better. We say so on the call.
• Step 3: Phase 1 proposal within 4-6 weeks. Fixed scope, fixed price, phase-gate exit at end of Phase 1. Timeline 3-6 weeks depending on system inventory size.
• Step 4: Phase 1 delivery. System inventory sweep, Annex III classification workshop, gap analysis, executive readout. On-site Brussels workshops as needed; remote delivery in between.
• Step 5: Phase 2+ decision. If Phase 1 warrants proceeding, we scope Phase 2-6. If it does not, the engagement ends and Phase 1 is the deliverable.

The value of the free readiness call is not marketing — it is that Alice Labs cannot scope well without understanding your specific system inventory, sector, and regulatory exposure. Forty-five minutes is usually enough to tell whether the fit is right and what the Phase 1 shape looks like.

For related reading see our end-to-end AI consulting deepdive, our EU AI Act compliance checklist 2026, and our AI consulting Nordics geographic view. For the EU-wide picture see AI consulting Europe.