The EU AI Act for startups: what it requires, when it applies and what to do now

What is the EU AI Act, in short?

The AI Act is the EU regulation that sets common rules for artificial intelligence according to the risk a system poses to health, safety and fundamental rights. It was adopted on 13 June 2024, published in the Official Journal on 12 July and entered into force on 1 August 2024. As a regulation it applies directly in every member state. In 2026 the so-called AI Omnibus amended it, moving some deadlines and simplifying several duties.

AI system

Under Article 3 of the AI Act, a machine-based system designed to operate with varying levels of autonomy, which may adapt after deployment and which infers from its input how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments.

When do the AI Act's rules apply?

The rules phase in: prohibitions from 2 February 2025, most obligations from 2 August 2026, and the high-risk regime from 2 December 2027 and 2 August 2028. Here is the current timeline.

The December 2026, December 2027 and August 2028 dates come from Regulation (EU) 2026/1744, published on 24 July 2026. The Commission's official implementation timeline already reflects them and is the page to bookmark.

Does the AI Act apply to my startup?

Yes, if you place an AI system on the EU market or use one professionally in the EU. It also reaches providers and deployers established outside the Union when their system's output is used in the EU, so a US or UK startup selling into Europe is in scope. What matters is your role for each system, and startups often hold two.

Provider

Whoever develops an AI system, or has one developed, and places it on the market or puts it into service under their own name or trademark, whether paid or free. A startup selling a product with AI features is the provider of that system.

Deployer

Whoever uses an AI system under their authority, except for purely personal, non-professional use. A startup using an AI assistant to triage support tickets is the deployer of that system.

Early-stage teams benefit from a few carve-outs. The regulation does not cover research, testing and development before a system is placed on the market, although testing in real-world conditions is not exempt. Systems built solely for scientific research are out of scope, and so are free and open-source systems, unless they are high-risk, fall under a prohibited practice or trigger the Article 50 transparency duties.

Which risk tier does my product fall into?

It depends on what the system does and to whom, not on the underlying technology. The Commission sets out four levels of risk.

What are my obligations if my product runs on GPT, Claude or Gemini?

The duties attached to general-purpose AI models such as GPT, Claude or Gemini sit with the companies that build those models. Yours relate to the system you build on top and how you use it. For a product that is not high-risk, there are usually four:

• Disclose the AI. A system that interacts with people must be designed so they know they are dealing with AI, unless that is obvious (Article 50(1)).
• Mark generated content. If your product generates synthetic text, images, audio or video, outputs must be marked in a machine-readable format, with exceptions for purely assistive editing features (Article 50(2)).
• Label deepfakes. Anyone using a system to generate or manipulate realistic images, audio or video must disclose that the content is artificial (Article 50(4)).
• Build AI literacy. Providers and deployers must take measures to support the AI literacy of staff who operate these systems (Article 4, as simplified by the Omnibus).

The transparency rules apply from 2 August 2026. Generative systems already on the market before that date have until 2 December 2026 to comply with the marking requirement.

What changed with the 2026 AI Omnibus?

The AI Omnibus pushed back the high-risk rules, simplified several duties and extended some SME relief to small mid-cap companies. According to the European Commission, the main changes are:

• Annex III high-risk rules from 2 December 2027, Annex I from 2 August 2028;
• a rewritten AI literacy duty: companies must support it, without having to guarantee a specific level for each person;
• simplified technical documentation and quality management for SMEs, startups and small mid-caps building high-risk systems;
• an EU-level regulatory sandbox run by the AI Office, with priority access for SMEs and small mid-caps;
• two new prohibitions from 2 December 2026, covering systems that generate non-consensual intimate content and child sexual abuse material.

What support does the AI Act offer startups and SMEs?

More than most founders expect. The text gives SMEs with an EU registered office or branch, startups included, priority and free access to regulatory sandboxes (Articles 58 and 62), proportionally reduced conformity-assessment fees, fines capped at the lower amount and dedicated communication channels. The Commission also runs free tools: the AI Act Service Desk, with an interactive compliance checker, and the AI Pact, a voluntary programme for preparing early.

Do individual EU countries add their own rules?

Member states designate their own supervisory authorities and set penalty rules, and some add national laws on top. Italy, where we are based, passed Law 132 of 23 September 2025, in force since 10 October 2025: it must be read in line with the EU regulation, names AgID and the National Cybersecurity Agency (ACN) as national AI authorities, and requires parental consent for children under 14 to access AI technologies. If you launch in a specific country, check its national authority's guidance as well.

Where should a startup start?

Start with an inventory: which AI systems you build or use, in what role and for what purpose. We put together the checklist below so you reach your lawyer with the groundwork done.

Still deciding where AI fits? How startups can use AI helps you pick a first use case, and the LLM application development guide covers the technical side of building on language models.