The EU AI Act is the world’s first comprehensive law on artificial intelligence, and its earliest obligations are now in force. For startups building or deploying AI, the question is no longer whether the rules apply, but how — and what to do about it.
A risk-based rulebook
The Act does not regulate “AI” as a single thing. Instead it sorts systems into four tiers: a small set of banned practices, a tightly governed “high-risk” category, limited-risk uses that carry transparency duties, and everything else, which is largely unregulated. Most early-stage products fall into the lower tiers — but assuming so without checking is where companies get caught out.
What counts as high-risk
High-risk uses include AI in areas such as recruitment, credit scoring, education, and critical infrastructure. If your product makes or materially influences decisions about people in these contexts, you should expect obligations around data quality, human oversight, technical documentation, and post-market monitoring.
Three things to do this quarter
- Map your AI. List every model and feature, where it sits in the risk tiers, and whether you are a provider or a deployer — the duties differ.
- Start the paper trail. Documentation is the backbone of compliance. Begin recording training data sources, intended purpose, and known limitations now, while the system is small.
- Assign an owner. Give one person responsibility for AI governance so it does not fall between product and legal.
Most startups overestimate the burden and underestimate the timeline. Both are manageable with early groundwork — and getting ahead of the Act is fast becoming a commercial advantage, not just a legal one.
