EU AI Act Compliance for Startups: 2026 Guide and Checklist

Reviewed September 28, 2026. The EU AI Act now applies in stages. For most startups, the first job is not to buy a certification package. It is to identify each AI system, determine the company's role, document the intended purpose, and test the system against the rules that already apply.

The current timetable is different from the one many 2024 and 2025 guides still describe. Prohibited practices and the original AI literacy provision started applying on February 2, 2025. Rules for providers of general purpose AI models started applying on August 2, 2025. Most of the Act, including Article 50 transparency duties, started applying on August 2, 2026. Following the Digital Omnibus on AI, Annex III high risk rules apply from December 2, 2027, while rules for high risk AI embedded in regulated products apply from August 2, 2028.

This guide gives founders and product teams a practical EU AI Act compliance workflow. It does not assume that every startup or every AI feature is high risk. It also does not treat a policy, questionnaire, or software report as certification. For a shorter introduction to the framework, start with What is the EU AI Act?

EU AI Act compliance checklist for startups

If you need a short starting point, complete these steps for every AI enabled feature or product:

1. Create an AI system inventory. Record what the system does, who uses it, who is affected, what data it receives, and what output it produces.
2. Map your role. Decide whether the company is a provider, deployer, importer, distributor, product manufacturer, authorised representative, or provider of a general purpose AI model.
3. Write the intended purpose. Classification turns on the system's actual purpose and context, not just the model name or vendor label.
4. Check territorial scope. Include systems placed on the EU market, put into service in the EU, or operated outside the EU when their output is used in the EU.
5. Screen prohibited practices. Do this before testing whether the system is high risk or subject to transparency duties.
6. Test high risk categories. Review both regulated product uses under Annex I and the sensitive use cases in Annex III.
7. Check Article 50. Determine whether people must be told they are interacting with AI or exposed to emotion recognition, biometric categorisation, deepfakes, or specified AI generated content.
8. Separate model and system duties. A startup using an API is not automatically the provider of the underlying general purpose model, but it may be the provider of the finished AI system.
9. Collect evidence. Keep decisions, source links, vendor documents, tests, notices, approval records, and change logs together.
10. Reassess on change. A new use case, customer group, model, geography, or substantial modification can change the analysis.

PolicyForge's EU AI Act compliance workflow can help organize the inventory, screening questions, notices, and supporting evidence. It is a preparation tool, not a notified body and not a substitute for legal advice.

What applies as of September 2026

The European Commission's AI Act overview gives the current application timetable. Use the EUR-Lex AI Act record to reach the current consolidated text and amendment history. The milestones most relevant to startups are:

Date	What the date means	Typical startup action
February 2, 2025	Prohibited practice rules started applying. The original AI literacy provision also started applying and was later simplified by the 2026 amendment.	Screen prohibited uses and maintain role appropriate staff guidance and training.
August 2, 2025	Governance rules and obligations for providers of general purpose AI models started applying.	Confirm whether the startup provides a model or merely integrates one. Model providers should review documentation, copyright, training summary, and representative duties.
August 2, 2026	Most of the Act became applicable. Article 50 transparency duties now apply, and the Commission can enforce general purpose AI model obligations.	Ship required interaction notices, synthetic content marking, and deployer labels. Verify that notices are accessible and connected to the relevant workflow.
December 2, 2027	Rules for Annex III high risk systems start applying under the amended timetable.	Use the remaining preparation period to build the required risk, data, documentation, logging, oversight, quality, and monitoring controls.
August 2, 2028	Rules for high risk AI embedded in regulated products under Annex I start applying.	Coordinate the AI assessment with the product's existing conformity assessment and sector rules.

The Commission's AI Act enforcement timeline is the best concise reference for these dates. Do not rely on an older checklist that says every high risk duty began in August 2026.

Step 1: decide whether the Act reaches the startup

The Act can apply to an organization established in or outside the EU. A non EU provider can fall within scope when it places an AI system or general purpose AI model on the EU market. Providers and deployers outside the EU can also be in scope when the output produced by the system is used in the EU.

This does not mean that any website visit from Europe automatically proves the entire company is subject to every provision. Scope depends on the operator, the system or model, the market activity, where the output is used, and any exclusion or exception. Record the facts supporting the decision rather than relying on a one sentence geographic rule.

For a US startup selling an AI recruiting product to an EU employer, the EU market connection is direct and the employment use may raise an Annex III high risk issue. A US company using an AI writing assistant only for internal work by a US team presents a different analysis. A consumer app deliberately offered across the EU may trigger transparency duties even if the company has no EU office.

Step 2: map the startup's role

Role mapping determines which obligations belong to the startup. The same company can hold different roles for different systems.

• Provider: Develops an AI system or general purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark.
• Deployer: Uses an AI system under its authority in a professional context. Personal, non professional use is excluded from this definition.
• Importer: An EU based entity that places a system bearing the name or trademark of a non EU provider on the market.
• Distributor: Makes an AI system available in the EU supply chain without being the provider or importer.
• Product manufacturer: Places a product on the market or into service with an AI system under its own name or trademark.
• Authorised representative: An EU based person appointed in writing to perform specified obligations for a non EU provider.

A startup that calls a third party language model through an API is usually not the provider of that underlying model merely because it uses the API. It may still be the provider of the customer facing AI system it designs and sells. Fine tuning, rebranding, or making a substantial modification can affect the role analysis. Keep the model provider's documentation, terms, model card, known limitations, and change notices in the system record.

Step 3: classify the system by intended purpose

A practical classification review should follow this order:

Is the practice prohibited?

Article 5 prohibits specified practices, including certain manipulative or exploitative techniques, some social scoring, certain biometric categorisation and identification uses, and individual criminal risk assessment based solely on profiling or personality traits. The details and exceptions matter. Review the legal text and the Commission's guidance before concluding that a similar sounding feature is permitted or prohibited.

Is it high risk?

There are two main routes. The first concerns AI used as a safety component of, or itself constituting, a product covered by specified EU product safety legislation in Annex I when a third party conformity assessment is required. The second covers Annex III use cases in areas such as biometrics, critical infrastructure, education, employment, essential private and public services, law enforcement, migration, and justice.

A category name alone is not enough. Intended purpose and the exact decision supported by the system matter. The Act also contains exceptions for some Annex III systems that do not pose a significant risk to health, safety, or fundamental rights, subject to the conditions in the law. The Commission's high risk classification guidance explains the current timetable and examples. Final guidance was still in development during 2026, so record the version reviewed.

Does Article 50 impose a transparency duty?

Article 50 does not create one universal AI disclaimer. It applies to specified systems and content. The Commission's Article 50 guidelines explain duties that apply from August 2, 2026.

• Providers of systems intended to interact directly with people generally must ensure that people are informed that they are interacting with AI, unless that fact is obvious to a reasonably well informed, observant, and circumspect person in the circumstances.
• Providers of systems that generate synthetic audio, image, video, or text content must ensure outputs are marked in a machine readable format and detectable as artificially generated or manipulated, subject to the rules and exceptions.
• Deployers of emotion recognition or biometric categorisation systems must inform exposed people, subject to the applicable scope and exceptions.
• Deployers must disclose deepfakes and specified AI generated or manipulated text published to inform the public on matters of public interest, with exceptions for human review, editorial control, and certain protected activities.

For implementation examples, see our AI disclaimer decision guide, AI disclosure requirements by platform, and AI disclaimer examples.

Is the startup a general purpose AI model provider?

Building an application with a third party foundation model is different from developing and placing the model itself on the EU market. Providers of general purpose AI models have documentation, downstream information, copyright policy, and public training content summary duties. Providers of models with systemic risk have additional evaluation, risk, incident, and cybersecurity duties.

The Commission's general purpose AI provider guidance explains these obligations and the treatment of open source models. Providers of models placed on the market before August 2, 2025 generally have until August 2, 2027 for the relevant obligations. Do not describe every startup that uses a model API as a general purpose AI model provider.

If none of those categories applies

The system may have no mandatory requirement under the specific AI Act categories above, but that is not the same as having no legal duties. GDPR, consumer protection, equality, employment, intellectual property, product safety, cybersecurity, and sector rules can still apply. Voluntary codes of conduct may also be useful for systems that are not high risk.

Step 4: build a reviewable evidence pack

A small team does not need to start with a huge governance program. It does need evidence that matches the system and its role. Create one record per system with:

• System name, owner, version, status, and business purpose.
• Provider, deployer, importer, distributor, and representative decisions.
• Intended purpose, prohibited practice screen, high risk screen, Article 50 screen, and general purpose model analysis.
• Users, affected people, markets, data categories, inputs, outputs, and human decision points.
• Model and vendor documentation, contracts, evaluation results, limitations, and update notices.
• Transparency notices, machine readable marking method, user interface screenshots, and accessibility checks.
• Risk decisions, test results, approvals, incidents, complaints, and corrective actions.
• Review triggers and the next review date.

Connect this record to the product's privacy work. If personal data is involved, the AI Act does not replace GDPR analysis. The team may still need a lawful basis, transparency, data minimisation, security, rights handling, processor terms, transfer safeguards, and a data protection impact assessment. Use the privacy policy guide for AI companies and the AI use disclosure guide to align public statements with the actual data flow.

Step 5: prepare early if a high risk use is plausible

The later 2027 or 2028 date is preparation time, not a reason to ignore a system. A high risk provider may need risk management, data governance, technical documentation, logging, instructions for deployers, human oversight design, accuracy, robustness, cybersecurity, quality management, conformity assessment, registration, post market monitoring, and incident reporting.

Start with the controls that are expensive to reconstruct later:

1. Freeze a clear intended purpose and versioning scheme.
2. Trace training, validation, test, and production data where relevant.
3. Define performance limits and foreseeable misuse.
4. Design logs and retention before launch.
5. Specify who can override, stop, or challenge the system.
6. Test accuracy, robustness, cybersecurity, bias, and accessibility against the real use case.
7. Contract for the vendor information needed to support your own obligations.
8. Determine the applicable conformity route and whether another EU product regime is involved.

A self assessment tool can help organize questions and documents, but it cannot perform technical testing, implement controls, conduct a notified body assessment, issue an EU declaration of conformity, or guarantee classification.

Startup scenarios

A support chatbot

A customer support chatbot will often raise Article 50 interaction transparency questions. Tell users they are interacting with AI unless the AI nature is obvious under the legal test. Also review escalation to a human, privacy disclosures, model vendor terms, security, and retention. It is not automatically high risk merely because it uses generative AI.

An AI recruiting tool

A tool intended to recruit, select, rank, or evaluate candidates can fall within the Annex III employment category. Document the exact decision supported, exceptions considered, provider and deployer roles, data sources, bias testing, human oversight, and candidate information. The high risk rules are scheduled to apply from December 2, 2027, but GDPR, equality, and employment rules can apply sooner.

A writing assistant built on a model API

The model company may be the provider of the general purpose model, while the startup can be the provider of the finished assistant. Review Article 50 interaction and content marking duties, the vendor's downstream documentation, privacy and copyright issues, and any material changes made by the startup. Do not copy the model provider's classification without assessing the application.

AI inside a medical device or other regulated product

The Annex I route and the product's sector legislation can govern classification and conformity assessment. The amended high risk timetable points to August 2, 2028 for these systems. Engage product regulatory expertise early because a blog checklist cannot determine the correct conformity route.

What startups should ask vendors

• What model and version powers the feature?
• What is the documented intended purpose and what uses are restricted?
• What training, evaluation, limitation, security, and incident information is available?
• How are model changes communicated and how much notice is provided?
• Can the startup obtain logs, output marking information, and documentation needed for downstream duties?
• Where are prompts, outputs, and telemetry processed and retained?
• Are customer inputs used for training, and what controls apply?
• How can the startup report an incident or suspend the integration?

Do not let a contract label decide the legal role when the product facts point elsewhere. Revisit the analysis when the vendor changes a model or the startup expands the intended purpose.

Regulatory sandboxes and support for smaller companies

The Act provides for regulatory sandboxes and measures intended to support smaller businesses. The 2026 Digital Omnibus expanded access to testing and experimentation and introduced an EU level sandbox. Participation can help a company test under regulatory supervision, but it is not a blanket exemption and does not guarantee market approval.

Look for the responsible national authority or relevant EU program and confirm eligibility, scope, confidentiality, testing conditions, and exit requirements. Prepare a concise system description, risk hypothesis, testing plan, data governance summary, and the questions that require regulator input before applying.

Frequently asked questions

Does the EU AI Act apply to a US startup?

It can. A non EU provider can be in scope when it places an AI system or general purpose AI model on the EU market. Providers and deployers outside the EU can also be covered when system output is used in the EU. The answer depends on the system, role, market activity, output use, and exceptions.

Does using OpenAI, Anthropic, Google, or another model API make us a model provider?

Not automatically. The upstream company may be the general purpose model provider, while your startup may be a deployer or the provider of a downstream AI system. Fine tuning, rebranding, substantial modification, and how the product is placed on the market can affect the analysis.

Does every AI startup need conformity assessment?

No. Conformity assessment is associated with high risk systems and the applicable route depends on the system and related product law. Many AI features are not high risk, although they may still have transparency or other legal duties.

Do we need an AI disclaimer?

There is no single disclaimer required for all AI use. Article 50 applies to specified interactions, systems, and content. Design the notice around the applicable duty and place it where the person encounters the AI or content. A footer statement alone may be insufficient.

Is a privacy policy enough for AI Act compliance?

No. A privacy policy addresses personal data practices. It does not replace system classification, prohibited practice screening, content marking, technical documentation, human oversight, testing, quality management, or conformity work. Keep the privacy policy accurate, but treat it as one part of a larger evidence set.

What penalties can apply?

The Act provides different maximum administrative fine tiers for prohibited practices, other obligations, and supplying incorrect information, with turnover based calculations for undertakings and proportionality rules. The applicable amount depends on the breached provision and facts. Use the current consolidated regulation and obtain legal advice for a specific exposure analysis rather than quoting one maximum as the likely fine.

How often should we review an AI Act assessment?

Review it when the intended purpose, model, data, users, affected people, geography, vendor, interface, or decision process changes. Also schedule a periodic review and monitor Commission guidance, standards, codes, and national enforcement developments.

Start with facts, then create the documentation

The most useful first week is simple: list the systems, assign an owner, map roles, write the intended purposes, screen prohibited and high risk uses, and implement any Article 50 notice that already applies. Then gather vendor evidence and plan deeper controls according to the result.

Use PolicyForge's EU AI Act compliance workflow to organize a sourced screening record and draft transparency documentation. If you also need a public facing AI use statement, the AI policy generator can help structure a draft. Review every output against the current law, official guidance, the live product, and qualified professional advice before relying on it.