Two regulatory developments in 2026 looked like relief for AI projects in supervised industries. Neither delivered it. The European Parliament approved amendments on 16 June 2026 deferring the EU AI Act high-risk regime, pushing standalone Annex III systems to December 2027 and AI embedded in regulated products to August 2028. In the United States, SR 26-02 replaced SR 11-7 and excluded generative and agentic AI from scope. Despite both, 30 of 33 firms surveyed by SumatoSoft still expect a heavier compliance burden within 24 months.
The research, published by the Boston-headquartered software development company, examined how compliance and audit requirements affect AI projects in regulated industries. The findings suggest that the binding constraint on most projects is not model accuracy or even statutory regulation. It is evidence: the ability to show an auditor what happened, when, and who reviewed it.
Of the 33 firms analyzed, 22 redesigned an AI system to satisfy a compliance rule. Five delayed a launch before eventually delivering. Three reported no obstacle because they had excluded AI from regulated decisions from the outset. One responded from an advisory position. Only two abandoned their projects entirely. The story emerging from the data is not that AI is blocked in regulated sectors but that it is expensive to make defensible.
Nineteen of the 33 blocking constraints concerned producing evidence rather than model accuracy. The most common single barrier was audit trail and decision reconstruction, cited by 12 respondents. Confidential data boundaries followed at seven, with data lineage and provenance at four. One respondent operating a model at 99.2 percent accuracy still had to rebuild because the filings it fed required auditability, not performance averages.
“Almost none of these firms were rebuilding for accuracy,” said Katerina Merzlova, Digital Transformation Consultant at SumatoSoft and author of the study. “They were rebuilding so they could show an auditor what happened: which model version ran, on which data, reviewed by whom, on what date. The firms that designed that record in measured remediation in weeks. The firms that reconstructed it afterward measured it in months.”
The procurement finding may explain why statutory deferrals have not reduced perceived burden. Eight respondents named a buyer-side security review, specifically a customer procurement questionnaire rather than any statute, as their binding constraint. That places customer procurement above both GDPR and SOC 2, each cited by four respondents. Only the EU AI Act at 17, FDA guidance at nine, HIPAA at seven, and model risk management rules at seven ranked higher.
Regulated buyers push their own compliance requirements down to suppliers. A supervisory letter that omits generative AI does not change what a bank’s vendor questionnaire asks. Companies feel regulatory pressure without being directly regulated themselves.
The practices that survived review clustered around two approaches: recorded human sign-off as a system step, cited by 10 respondents, and evidence captured at the moment of decision, cited by nine. The dominant failure pattern was retrofitting records after the build, reported by seven respondents. Other failures included supplier certification accepted in place of internal validation at five, periodic reports where auditors wanted continuous evidence at five, and accuracy metrics offered as compliance evidence at four.
Six respondents quantified the time their remediation took, reporting a range from six weeks to more than a year. One of the six also attached a cost, roughly $140,000 in engineering spend over four months. Every quantified case describes evidence work on a system that already functioned as intended.
The study collected structured open responses from practitioners between June and August 2026 through media response platforms and direct outreach. Of 67 submissions from 65 respondents, 32 were excluded under five published screening criteria covering template submissions, duplicates, unverifiable figures, non-responses, and respondents outside regulated sectors. Twenty-three of the 33 analyzed respondents work in healthcare, Internet of Medical Things, financial technology, or supply AI to buyers in those sectors. Twenty-one companies operate AI in production. Twenty-seven name the United States among their operating jurisdictions.
None of the 33 respondents expect an overall reduction in compliance burden. The three anticipating eventual relief locate it in standardization of evidence formats, not in any relaxation of underlying rules. The sample is self-selected, and the study reports its findings as a description of these 33 firms rather than an estimate of any wider industry.
Anyone interested can download the full research, including the screening criteria, coding scheme, respondent roster, and conflict of interest statement.
SumatoSoft is a custom AI and software development company with headquarters in Boston and a development center in Warsaw. The company has delivered more than 350 projects across 25+ countries over 14 years and holds ISO 27001 and ISO 9001 certification.