Governing by Proxy: How Regulatory Intermediaries Shape EU AI Act Compliance in Practice

Abstract

The EU AI Act assigns compliance obligations to defined actor roles along the AI supply chain, but how these obligations are enacted in practice remains understudied. This paper investigates the ecosystem of regulatory intermediaries (consultants, auditors, ethics advisors, certification bodies) through which an AI system provider translates regulatory requirements into organisational practice. Drawing on participant observation and document analysis from an embedded case study at an AI startup, the analysis applies the Regulator-Intermediary-Target (RIT) model to map sixteen intermediaries and trace the compliance pressures that drive pre-enforcement intermediary engagement. Compliance artefacts across risk management, impact assessment, and technical documentation show a consistent pattern: intermediary interpretive choices construct what AI Act compliance means for the regulated organisation. Using Edelman's legal endogeneity framework, which theorizes how organisations' private compliance constructions can feed back into the meaning of law itself, we discuss how legal requirements are managerialised into procedural deliverables and how compliance forms diffuse without evidence of governance efficacy. The paper contributes on two levels: it extends the RIT model to organisational-level AI governance, demonstrating that compliance intermediaries perform constitutive rather than facilitative functions, and it provides an early empirical signal for legal endogeneity in AI Act compliance. We encourage more guidance from the EU and argue that the compliance ecosystem deserves the same analytical and regulatory attention currently directed at the AI supply chain.