EU AI Act and Horizon Europe: Compliant AI Projects from Day One

Executive summary

AI is now one of the strongest themes across European research and innovation funding. Horizon Europe, Digital Europe, health, manufacturing, data spaces, public-sector innovation, climate, security and industrial transformation increasingly include AI-based methods, platforms and decision-support tools. But the strongest AI proposals in 2026-2027 will not be the ones that simply add the word “AI” to a concept note. They will be the proposals that can show how AI will be developed, trained, validated, monitored, governed and used responsibly from the beginning.

The EU AI Act changes the proposal logic. It introduces a risk-based framework for artificial intelligence and creates obligations around prohibited practices, high-risk AI systems, transparency, general-purpose AI models, risk management, data governance, technical documentation, logging, human oversight, robustness and cybersecurity. Even when a project is still in research and innovation mode, applicants must think early about whether the AI system could later become high-risk, whether personal or sensitive data is involved, whether a deployment environment is planned, and which partners are responsible for compliance-related work.

For Nexuswelt, the important message is this: AI compliance is not only a legal issue. It is a proposal strategy issue. It affects the consortium, the work package structure, the budget, the ethics self-assessment, the data management plan, the pilot design, the exploitation pathway and the credibility of the project.

Why AI compliance must start before proposal writing

Many AI-related proposals still start with the technology: a model, a platform, a chatbot, a digital twin, a decision-support system or an AI-powered analytics tool. The problem is that evaluators and future project reviewers will not only ask what the AI does. They will also ask whether the project understands the data, risk, validation, governance and deployment context.

In Horizon Europe and Digital Europe, ethics and legal compliance are already part of the proposal architecture. Applicants are expected to identify relevant ethical issues, explain mitigation measures and provide a credible approach to data, privacy, human involvement, security and societal impact. If AI is part of the project, these questions become more important.

The European Commission’s guidance on ethics self-assessment and AI ethics-by-design makes clear that applicants should not treat ethics as an afterthought. AI-related proposals need a clear explanation of how the system will be designed, tested and used in a trustworthy way. This is especially important when projects involve health data, public services, employment, education, safety-critical systems, critical infrastructure, vulnerable groups or real-world deployment.

Useful official guidance: How to complete your ethics self-assessment and Ethics by design and ethics of use for AI.

What the EU AI Act means for AI-related EU projects

The EU AI Act is based on a risk-based approach. It distinguishes between unacceptable risk, high risk, transparency risk and minimal or low risk. For EU-funded AI projects, the most important first step is therefore to understand the intended use case, the sector, the users and the future deployment context.

A research project may not immediately place an AI system on the market. However, many Horizon Europe and Digital Europe projects are designed to move from research to validation, pilots, testing environments, public-sector use, healthcare settings, manufacturing sites or market deployment. This means that the proposal should already explain how the consortium will monitor regulatory relevance and prepare for trustworthy implementation.

High-risk AI systems under the AI Act can involve areas such as critical infrastructure, education, employment, access to essential services, law enforcement, migration, justice, biometric systems or certain product safety contexts. In these cases, the project needs to think much more carefully about documentation, risk management, human oversight, data quality and cybersecurity.

Official sources: EU AI Act overview | AI Act legal text on EUR-Lex | Navigating the AI Act.

Key AI Act topics that proposal teams should translate into the work plan

Risk classification: Is the AI system prohibited, high-risk, transparency-relevant, general-purpose, or low-risk?
Data governance: What data will be used, where does it come from, who controls it, and how will quality and bias be managed?
Technical documentation: How will the system design, datasets, model versions, testing, assumptions and limitations be documented?
Human oversight: Who can understand, supervise, override or challenge the AI output?
Transparency: What information will users, deployers and stakeholders receive about the system and its limitations?
Accuracy and robustness: How will performance, failure modes and real-world reliability be tested?
Cybersecurity: How will the project protect the AI system, data pipeline and deployment environment?
Post-project operation: What happens when the system moves from prototype to real use?

Horizon Europe vs. Digital Europe: why the programme matters

Horizon Europe and Digital Europe both support AI, but their logic is different. Horizon Europe is the EU’s research and innovation programme. It often supports new methods, technologies, scientific validation, pilots and collaborative R&I. Digital Europe is more deployment-oriented. It focuses on bringing digital technology to businesses, citizens and public administrations, including AI, cybersecurity, supercomputing, advanced digital skills, data and the digital transformation of industry and public services.

This distinction matters for AI compliance. In a Horizon Europe proposal, AI compliance should be visible through the methodology, ethics, data governance, risk mitigation, validation plan and exploitation route. In a Digital Europe proposal, the project is often closer to practical uptake, testing, deployment, operational use and support structures such as European Digital Innovation Hubs, Testing and Experimentation Facilities or AI Factories. The compliance logic therefore needs to be even more operational.

Useful official links: Horizon Europe work programmes | Digital Europe Programme | Digital Europe Work Programme 2025-2027 | AI Factories | Testing and Experimentation Facilities.

How to build AI compliance into the proposal work packages

A strong AI proposal should not hide compliance in a short ethics paragraph. Compliance thinking should be visible across the project structure. This does not mean every project needs a heavy legal work package. It means that the work plan should show how the consortium will manage risk, data, validation, documentation, human oversight and deployment from the beginning.

Example work package structure for an AI-related EU proposal

Work package / task area	What it should cover	Typical partner roles
Project management and AI governance	AI risk classification, ethics board, legal monitoring, standards watch, internal decision process, quality control and risk register.	Coordinator, legal/regulatory partner, ethics lead, quality manager.
Data governance and privacy	Data sources, data ownership, data quality, bias analysis, anonymisation/pseudonymisation, GDPR and DPIA planning.	Data owners, DPO, data scientists, domain partners.
AI development and documentation	Model design, system architecture, documentation, versioning, intended use, limitations and traceability.	AI developers, software partners, research organisations.
Validation and assurance	Testing strategy, performance metrics, robustness, explainability, cybersecurity testing, pilot readiness and user acceptance.	Testing facility, cybersecurity partner, domain experts, end users.
Pilot deployment and human oversight	Real-world testing, user training, human oversight procedures, incident workflows, feedback loops and monitoring.	Pilot sites, deployers, public bodies, hospitals, industry partners.
Exploitation, communication and uptake	Regulatory pathway, adoption strategy, stakeholder communication, market or policy uptake, sustainability and post-project use.	Exploitation partner, CDE partner, clusters, industry, policy actors.

What evaluators may notice in AI-related proposals

Evaluators are not only looking for technological ambition. They also look for credibility. A proposal that promises an AI-based solution but does not explain data access, validation, risk, human oversight or exploitation can look immature. This is particularly risky when the proposal targets health, public administration, manufacturing, climate services, cities, mobility, cybersecurity or critical infrastructure.

A strong proposal makes the AI logic understandable. It explains what the system will do, what it will not do, which data will be used, how the model will be tested, who supervises it, how users will interact with it, how cybersecurity will be handled and what will happen after the project.

For AI-related projects, the consortium itself becomes part of the evidence. If the project includes AI development but no data owner, no domain validation partner, no cybersecurity expertise, no ethics or regulatory role, and no real end users, the proposal may look incomplete even if the technical concept is strong.

Practical examples: how compliance changes the consortium

Example 1: AI in healthcare

A project using AI for cancer prediction, triage support, diagnosis assistance or clinical decision support should not be built only around an AI developer. It may need hospitals, clinicians, health data experts, patient representatives, ethics and data protection expertise, cybersecurity, health economics, clinical validation and exploitation partners. The proposal should explain data governance, representativeness, bias, human oversight, patient relevance, clinical workflow integration and regulatory pathway.

Example 2: AI in manufacturing

A project using AI for predictive maintenance, quality inspection, human-centric manufacturing or industrial process optimisation needs access to real industrial data and a realistic validation environment. It should include industrial partners, pilot sites, AI developers, automation or edge AI experts, cybersecurity, human factors expertise and exploitation partners. The work plan should explain model performance, robustness, data ownership, worker interaction, safety, cyber risks and deployment requirements.

Example 3: AI for cities and public services

A project using AI for public-sector decision support, mobility optimisation, energy planning or city services must show transparency, accountability and trust. It may need municipalities, data providers, citizens or user representatives, ethics expertise, legal and procurement knowledge, cybersecurity and communication partners. The proposal should explain how AI outputs will be used, who remains responsible for decisions and how public trust will be managed.

Example 4: Generative AI and data spaces

Projects involving generative AI, foundation models, data spaces or AI-based content generation should check whether general-purpose AI rules, copyright, training data transparency, personal data protection, security and downstream use need to be addressed. A strong consortium may need model developers, data space operators, legal expertise, domain users, cybersecurity and exploitation partners.

Common mistakes in AI-related EU proposals

Using “AI” as a buzzword without explaining the use case, data and validation environment.
Treating compliance as a legal annex instead of integrating it into the methodology and work plan.
Not checking whether the AI system could be high-risk under the AI Act.
Mentioning data but not explaining ownership, access rights, quality, representativeness or bias mitigation.
Promising deployment without explaining human oversight, user training, monitoring or incident handling.
Forgetting cybersecurity and robustness testing for AI systems.
Including end users too late, after the technical concept is already fixed.
Not budgeting enough time or person-months for validation, documentation, ethics and compliance-related tasks.
Ignoring post-project operation, exploitation and regulatory pathway.
Building a consortium without legal, ethics, domain, cybersecurity or real-world validation capacity.

AI proposal readiness checklist

Before submitting an AI-related Horizon Europe or Digital Europe proposal, applicants should check the following points:

Have we described the exact AI use case and intended purpose?
Have we checked whether the system could be prohibited, high-risk, transparency-relevant or general-purpose?
Do we know who is the AI provider, deployer, data owner and end user?
Have we explained data sources, access rights, quality, representativeness and bias mitigation?
Have we included privacy and data protection logic, including DPIA where relevant?
Have we planned technical documentation, logging, versioning and traceability?
Is human oversight concrete, with responsible roles, procedures and training?
Is cybersecurity included as a technical task, not only as a sentence?
Do we have a validation environment with real users, pilots or testbeds?
Have we included ethical, legal and societal risk mitigation in the work plan?
Does the budget reflect compliance, validation, testing and documentation work?
Does the exploitation plan explain how the AI system can be used after the project?
Have we included partners who can handle regulatory, data, technical, domain and communication responsibilities?
Have we checked official EU guidance and the latest AI Act implementation timeline?
Can we explain why the consortium is credible for trustworthy AI implementation?

What partner profiles are needed in compliant AI consortia?

AI compliance is not the responsibility of one lawyer at the end of the proposal. It requires a multidisciplinary consortium. Depending on the topic, a strong AI consortium may need:

AI and software developers who understand technical architecture, documentation and testing.
Data owners and data governance experts who can provide lawful, high-quality and representative datasets.
Domain partners such as hospitals, manufacturers, cities, public bodies, energy actors or climate experts.
Pilot sites and deployers who can test the system in a real environment.
Cybersecurity partners who can test robustness, threats, logging, secure deployment and incident response.
Ethics, legal and regulatory experts who can support AI Act, GDPR, DPIA/FRIA and standards monitoring.
User and stakeholder organisations who can validate needs, usability, trust and adoption pathways.
Communication, dissemination and exploitation partners who can translate technical results into stakeholder engagement, market uptake and policy relevance.

How Nexuswelt positions this topic

For Nexuswelt, the topic “EU AI Act and Horizon Europe” should not be presented as legal advice. The strongest positioning is proposal strategy: how to design AI-related EU projects so that compliance, ethics, data governance, validation and exploitation are visible from the beginning.

This is especially relevant for AI projects in health, manufacturing, digital platforms, public sector, climate, cities, data spaces, cybersecurity, dual-use innovation and industrial transformation. In all these areas, a good proposal needs more than technical excellence. It needs a credible route from concept to responsible use.

Nexuswelt is currently mapping strategic partners for upcoming AI-related EU funding directions, including Horizon Europe, Digital Europe and mission-driven or industry-oriented projects. Organisations interested in future proposal discussions can introduce their expertise, country, EU project experience, possible role and available pilot, data or stakeholder access.

Join the closed Nexuswelt group for selected topics, partner needs and collaboration opportunities

Related Nexuswelt support:
For AI-related EU project ideas, Nexuswelt supports organisations with Digital Europe proposal writing and application support, Horizon Europe proposal strategy and practical AI and applied innovation support for EU-funded projects.