Practical guidance for AI startups navigating EU AI Act compliance.
Life and health underwriting and pricing AI is high-risk under Annex III point 5(c). Motor and home pricing, claims triage and fraud detection mostly aren't. What insurers and insurtechs owe, with dates as of November 2026, a table and a checklist.
Face login, selfie ID checks, age estimation, emotion detection: which biometric AI is banned, which is high-risk and which falls outside Annex III? The verification exemption explained, with dates as of November 2026, a table and a checklist.
Reselling or importing someone else's high-risk AI? Articles 23 and 24 make you check CE marking, the declaration of conformity and instructions before it ships. Who counts as importer or distributor, when you become the provider, dates as of November 2026, and a checklist.
The Commission's final Article 50 guidelines (20 July 2026) say which AI outputs need a machine-readable mark and which don't: summaries yes, grammar fixes, code and alt-text no. A feature-by-feature table and checklist before the 2 December 2026 retrofit deadline.
The Commission's draft Article 6 guidelines show which Annex III AI features can escape high-risk status under Article 6(3), and which can't. Worked examples, the profiling test, the split-architecture trap and the four-part memo, ahead of final guidelines due by the end of 2026.
Two new Article 5 bans apply from 2 December 2026, and they reach general image, video and voice tools without adequate safeguards. The provider test.
Admissions, grading, placement and proctoring AI is high-risk under Annex III point 3 from 2 December 2027. Emotion recognition in schools has been banned since February 2025. A feature-by-feature map for EdTech teams.
Article 86 lets people ask a deployer to explain an AI-assisted decision. It formally applies from 2 August 2026, but after the Digital Omnibus its Annex III trigger only arrives on 2 December 2027. Here is what to prepare.
Article 10 tells high-risk AI providers how to govern training, validation and test data. The Digital Omnibus deleted Article 10(5) and moved the bias-data rule into a new Article 4a. Here is what the data file needs now.
On 14 October 2026 the EU cited EN 18286 in the Official Journal. It gives high-risk AI providers a presumption of conformity for Article 17 QMS duties, and nothing else. Here is what that means.
A customer-service voice agent must say it is AI at the start of the call. Empathy is a script, not Article 50. Here is when you must offer a person.
AI Act documentation is Article 11 plus Annex IV for high-risk systems — not a 90-page dump for every chatbot. What to keep, who keeps it, and what 'document 11' means.
In-house teams use AI for NDAs, DPAs, research, and e-discovery. That is usually not Annex III point 8. Courts using the same tools is a different story.
Hiring AI is Annex III point 4. Vendors work with regulators through sandboxes, the AI Pact, national market surveillance, and — already — the EDPS job-matching pilot.
If the tool has no report button, use your employer's designated channel — not the vendor's support inbox. Then Articles 85 and 87 if the AI Act itself is in play.
Regulation (EU) 2026/1744, in force 27 July 2026, moved Annex III high-risk rules to 2 Dec 2027 and Annex I to 2 Aug 2028. What did not move.
High-risk Annex III rules slipped to December 2027. Chatbots, GPAI models, and banned practices did not. A practical list of what you must ship before 2 August 2026.
You bought the model. You still have duties. Article 26 covers instructions, human oversight, logs, worker notice, and when you must switch the system off.
The GPAI Code of Practice is voluntary. Articles 53–55 are not. Here is who should sign, what systemic-risk models owe, and what changes on 2 August 2026.
The AI Office owns GPAI and some integrated systems. Member-state authorities own most other AI. Here is who emails you, and who can fine you.
Article 16 is the index of high-risk provider duties. Here is each item in plain English, when it applies after the Omnibus, and what to collect first.
Article 17 is a QMS for high-risk AI, not ISO theatre. What must be in it, who needs it, and why copying your ISO 9001 manual will not pass.
Article 13 is the manual your deployers will be judged against. What it must say, who writes it, and why a help-centre article is not enough.
Article 15 is the performance rule for high-risk AI. What accuracy you must declare, what robustness means, and the AI-specific attacks you have to plan for.
Article 3 splits first sale from first use. The difference decides who is the provider, when duties start, and whether your internal tool is in scope.
A seven-step classification you can finish in an afternoon: prohibited, Annex I, Annex III, the Article 6(3) exit, and what to file if you claim you are not high-risk.
An internal ChatGPT seat is usually limited-risk, not high-risk. Here is when it stays that way, when HR use flips the tier, and what to do by 2 August 2026.
The vendor's CE mark does not finish your job. Ten questions to ask before you sign, and the Article 26 duties that stay with you after go-live.
Creditworthiness AI is high-risk. Fraud detection is not. How Annex III point 5(b) and 5(c) treat scoring, BNPL, and life or health insurance pricing.
Most medical AI is high-risk twice: once under the MDR or IVDR, once under Article 6(1). What doubles, what can share a notified body, and the 2028 date.
Most support bots are limited-risk and need Article 50 by 2 August 2026. Here is when a refund, claims, or eligibility bot quietly becomes Annex III.
Article 26(7) is a pre-use notice, not a Slack rumour. Who you must tell, when, what to put in the note, and how it sits next to works-council law.
Systems already shipping synthetic audio, image, video or text must be machine-readable marked by 2 December 2026. What Article 111(4) actually added.
There is no 'agent' chapter. An agent is an AI system classified by intended purpose. When a tool-using loop becomes high-risk, GPAI, or just Article 50.
The Digital Omnibus extends several SME easements to small mid-caps. The thresholds, what actually gets lighter, and what a 400-person company still owes.
A practical, no-fluff plan to get a SaaS startup from 'we have no idea where we stand' to a defensible EU AI Act position in 90 days — without hiring a consultancy. Three phases: map, fix, prove.
The EU AI Act is the world's first comprehensive AI law. It sorts AI into four risk tiers and regulates each differently. Here's the whole thing explained without the legalese — what it covers, who it applies to, and the dates that matter.
ISO/IEC 42001 is the new AI management system standard everyone's certifying for. But it doesn't make you EU AI Act compliant. Here's how the binding law and the voluntary standard fit together — and where 42001 actually helps.
High-risk isn't about how advanced your model is — it's about what decision it touches. Here's the full Annex III list, the Article 6 classification logic, and the one exemption that can take you back out of high-risk.
The headline number is €35M or 7% of global turnover — but that's only for the worst category. Here's the full three-tier penalty structure under Article 99, who decides the amount, and the SME discount most founders miss.
Article 14 says high-risk AI must be built so a human can effectively oversee it — but 'a human in the loop' isn't enough on its own. Here's what real oversight means, the automation-bias trap, and the four-eyes rule for biometrics.
The GDPR protects personal data. The EU AI Act regulates AI systems and their risks. They overlap constantly — and complying with one does not get you compliance with the other. Here's how they fit together for a real product.
Article 50 requires two different things: tell people when content is a deepfake, and embed machine-readable marking so detectors can spot AI output. Here's what counts, the C2PA standard, the art exception, and the two deadlines.
Article 4 applies to every company that builds or uses AI — not just high-risk ones — and it's been in force since February 2025. Here's what 'sufficient AI literacy' actually requires and how to satisfy it without overthinking it.
Before a high-risk AI system goes on the market, it usually has to be registered in a public EU database. Here's what Article 49 requires, what becomes public, who registers, and why it's the step founders forget until launch day.
Eight AI practices are outright illegal in the EU as of February 2025 — no compliance path, no documentation, just banned. Here's the full Article 5 list and where the edges are blurrier than they look.
Yes — and the trigger isn't where you're based, it's whether your AI's output reaches people in the EU. Here's exactly when Article 2 pulls a US, UK, or other non-EU company into scope, and what it means for your product.
The FRIA is a deployer obligation most providers have never heard of. It applies to public bodies and certain high-risk deployers — and you can build it on top of your existing DPIA. Here's who needs one and what goes in it.
If your AI system is high-risk, yes — you must run a conformity assessment, draw up an EU declaration of conformity, and affix the CE marking before you can sell it. Here's which assessment route applies to software AI, and why most can self-assess.
If your high-risk AI system causes serious harm, you have as little as two days to report it. Here's what counts as a 'serious incident', the exact deadlines, who you report to, and how this differs from post-market monitoring.
The EU AI Act doesn't switch on all at once — it phases in across four key dates from February 2025 to August 2027. Here's exactly what applies when, so you know which deadline is actually yours.
Using GPT or Claude through an API doesn't make you a GPAI model provider — but it can still make you a provider or deployer of a high-risk AI system. Here's where the obligations actually land when you build on someone else's model.
The EU AI Act gives open-source AI a real exemption — but it's full of holes. Bans, high-risk uses, and transparency rules still apply. Here's exactly where the open-source carve-out helps and where it does nothing for you.
The scary five- and six-figure estimates floating around assume you're high-risk. Most companies aren't. Here's an honest breakdown of what compliance costs by risk tier — and why classification is the single biggest cost lever.
Before you worry about risk tiers, check whether your product even meets the EU AI Act's definition of an 'AI system'. Plenty of 'AI-powered' software doesn't — and some that doesn't market itself as AI does. Here's the Article 3 test.
Article 22 requires every non-EU high-risk AI provider to designate an EU-established authorised representative before market placement. Here's what that actually means in practice.
Article 50's chatbot transparency obligation applies to ALL AI systems with conversational interfaces — not just high-risk ones. August 2026 is the deadline. Here's what your product needs to change.
Article 3(23) defines 'substantial modification' — and crossing that line means restarting your conformity assessment under Article 43. Here's where the line is in practice.
Article 25 of the EU AI Act describes when a deployer becomes a provider — inheriting full compliance obligations. If you sell API access to AI capabilities, this affects your customers and your contracts.
Annex III category 4 covers AI in employment and recruitment — but the trigger is 'appreciable impact on career prospects,' not 'makes the final hiring decision.' Here's how to apply the test.
Article 9(8) of the EU AI Act requires systematic bias testing — not just fairness consideration. And the May 2026 Omnibus added a GDPR exemption that makes this testing easier to do legally.
A practical high-risk compliance checklist. After Regulation (EU) 2026/1744, Annex III duties start 2 December 2027 and Annex I duties 2 August 2028. What to prepare, and what still starts 2 August 2026.
Article 6(2) of the EU AI Act makes a deployer's intended use case the trigger for high-risk classification of GPAI systems. Here's where liability sits and what model providers must do.
Articles 57-63 give sandbox participants real protections — regulatory guidance, a GDPR lawful basis for testing data, and limited liability. Here's what's operational and how to apply.
Article 11(3) gives SMEs the right to use simplified technical documentation — but the Commission hasn't published that form yet. Here's what you should do in the meantime, and what the simplified form is likely to contain.
A plain-English breakdown of all 9 categories of technical documentation required by Article 11 and Annex IV of the EU AI Act — what each section contains and what reviewers look for.
Article 72 (post-market monitoring) and Article 12 (automatic logging) are distinct obligations that most compliance guides conflate. Confusing them leaves you exposed. Here's how they actually work.