The EU AI Act compliance report, what it should contain.

Sooner or later someone asks a startup for its "EU AI Act compliance report". It might be an enterprise buyer's procurement team, an investor's lawyer, or your own board. There is no official document by that name. The Act does not define a compliance report, and for most AI products there is no certificate to show. What the person asking wants is a written, dated position: what your AI does, which rules apply to it, and what you have done about them. This guide sets out what that document should contain, the ways to produce it, and how to keep it from going stale.

For most startups the honest headline of the report is short: "Limited or minimal risk, these three duties apply now, here is the evidence, and here is when we will look again." The value is in the reasoning and the date, not the length.

Why there is no certificate to send

Conformity assessment under Article 43 and CE marking exist for high-risk AI systems only. For an Annex III system they apply from 2 December 2027; for AI built into products covered by Annex I, from 2 August 2028. Limited-risk and minimal-risk systems, which is where most startup products land, have no conformity procedure and no certificate. So the document that answers the question is a classification and gap analysis you can stand behind, not a seal.

That is also why wording matters. A report that says "compliant" invites the reader to test the claim. A report that says "classified as limited risk on [date], Article 50(1) disclosure in place" gives the reader something to check.

What the report should contain

The last row is the one most often missing. Deadlines moved in June 2026, so a report without a date and a version cannot tell the reader which rules it was written against. What the Omnibus changed.

The duties most startup reports end up listing

If your product has a chatbot, the Article 50(1) line is almost certainly in your report, and it is live. The free Article 50 disclosure generator drafts the wording, and the disclosure templates guide explains placement.

Three ways to produce it

These are not exclusive. A common sequence is a structured self-assessment first, then a lawyer on the specific questions it flags. Counsel's time goes further when the classification groundwork is already written down.

How Reglynn's reports fit

Reglynn is one way to do the middle route. The free scan is eight questions plus an email step, about two minutes, and gives a likely risk tier on screen. The paid assessment is up to 33 questions, or 41 with the Document Pack, and produces a dated gap report covering the role analysis, the Article 6(3) and GPAI checks, the obligations that apply to your answers, each with its post-Omnibus deadline, a prioritised remediation list and GDPR overlap notes. Reports are generated and delivered automatically.

• Gap Report, €59. One AI system, one dated report.
• Deal-Ready Pack (report + Document Pack), €149. The report plus three drafts pre-filled from your answers: an Article 50 transparency notice, a human oversight procedure and a risk management plan skeleton.
• 3 reports, €149; 3 systems with the Document Pack, €399. One full report per system, because each system has its own tier. More than 3 systems: email hello@reglynn.eu for a quote.

The sample report shows a complete one for a fictional HR-tech company, so you can judge the format before paying. It is a self-assessment: it is not a legal opinion, not a certification and not issued by a notified body.

Keeping it current

• Re-run it when the product changes. One new feature can move a system into high-risk. Adding a prediction about a person to an Annex III workflow is enough to close the Article 6(3) exemption.
• Re-run it when the rules change. The Act has been amended once already. Check the changelog and the deadline table.
• Keep one version. Send the same dated document to every buyer and investor. The vendor questionnaire guide and the due diligence guide show how it gets used.
• Know your exposure. For SMEs and start-ups, Article 99(6) caps fines at the lower of the fixed amount and the percentage. The fine calculator shows the ceiling for your turnover.

Start with the scope and tier. If the free scan or the high-risk checker shows nothing in Annex III, your report is mostly about Article 50, Article 4 and Article 5, and it can be short. If something is in Annex III, the report becomes your 2027 plan.

Frequently asked questions

Is there an official EU AI Act compliance certificate?

Only for high-risk systems. Conformity assessment under Article 43 and CE marking apply to high-risk AI systems, from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I products. Limited-risk and minimal-risk systems have no certificate.

How long should an EU AI Act report for a startup be?

As long as the reasoning needs. For a limited-risk or minimal-risk product it can be a few pages: scope, role, tier with reasons, the Article 5 and GPAI checks, live duties with evidence, gaps and a date. A high-risk product needs a full workplan.

How often should the report be updated?

Whenever a feature changes its purpose or adds a prediction about people, and whenever the rules change. The Act was amended in June 2026, so a report dated before then may quote deadlines that no longer apply.