The risk pyramid
The Act sorts AI systems into four buckets. Prohibited practices, such as social scoring and manipulative systems, are banned outright. High-risk systems, those used in hiring, credit, education, medical devices and critical infrastructure, carry the heavy obligations: risk management, data governance, logging, human oversight and conformity assessment. Limited-risk systems mainly owe transparency, telling users they are interacting with AI. Everything else is minimal risk and unregulated.
The timeline after the omnibus
Prohibitions and AI-literacy duties have applied since 2025. General-purpose model rules are in force. The high-risk obligations, originally due August 2, 2026, were deferred by sixteen months in the Digital Omnibus agreed this spring, with new prohibitions landing in December 2026. If you are high-risk, you now have runway into 2027, and enterprise customers will still ask for readiness earlier.
What a startup should do now
Classify every AI feature you ship against Annex III. Document your training data story. Assign one owner for AI compliance, even part-time. And put your conformity plan in your sales data room: buyers increasingly treat AI Act readiness as a procurement gate, which makes compliance a revenue tool rather than a tax.
FAQ
We are a US startup selling into Europe. Does it apply?
Yes. The Act follows the user, not the vendor. Selling into the EU brings you in scope.
Does using OpenAI or Anthropic APIs make me a provider?
Usually you are a deployer, with lighter duties, unless you substantially modify the model or market it under your own brand for a high-risk purpose.
What are the penalties?
Up to 7 percent of global turnover for prohibited practices; less for other violations. For startups the practical penalty arrives earlier: failed enterprise procurement.