EU AI Act due diligence, what investors actually check.

Investors now ask AI startups about the EU AI Act in the same breath as GDPR and IP ownership. The question usually arrives as a line in the due diligence request list: "Describe the company's position under Regulation (EU) 2024/1689." Behind it sits a narrower worry. Is there a product line that is high-risk and unbudgeted, a practice that is prohibited, or a live duty the company has ignored? This guide covers what investors look for, what to put in the data room, and the answers that turn a follow-up call into a closed point.

Investors are rarely assessing whether you are perfect. They are pricing risk. A short, dated, feature-by-feature position with Article references tells them the risk is known and owned. Silence, or "we are compliant", tells them it is not.

What investors actually check

1. Scope: does the Act reach the company at all?

Incorporation outside the EU does not settle it. Article 2 reaches providers placing AI systems on the EU market wherever they are established, and providers and deployers in third countries where the system's output is used in the Union. A US or UK startup with EU customers is normally in scope. The territorial scope guide covers the edge cases.

2. Role: provider or deployer, per product

If the company ships AI features under its own name, it is their provider under Article 3(3), even when the model underneath is licensed from someone else. Investors want to see this stated per feature, because it decides which obligations the company carries. Provider or deployer?

3. Risk tier, and whether anything is high-risk

This is the question that moves valuation. A product in an Annex III area, such as hiring, credit scoring, education or access to essential services, carries the full Chapter III set: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, a quality management system, conformity assessment and registration. After the June 2026 Omnibus, those obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI in products under Annex I. For a small team the work realistically takes twelve to eighteen months, so an investor closing in 2026 is funding it.

If the company relies on the Article 6(3) exemption to stay outside high-risk, expect to be asked for the written assessment. Article 6(4) requires providers to document it before placing the system on the market, and the exemption never applies to a system that profiles natural persons.

4. Prohibited practices

Article 5 has applied since 2 February 2025. Investors want a clean statement that no feature performs a prohibited practice, with reasoning for anything close to the line. Emotion recognition in the workplace or in education is the one AI startups most often brush against, usually through "engagement" or "sentiment" features.

5. The duties that are already live

Three sets of obligations apply today, whatever the tier:

• Article 50(1) chatbot disclosure, since 2 August 2026, and Article 50(2) machine-readable marking of synthetic content from 2 December 2026. Article 50 in full.
• Article 4 AI literacy, since 2 February 2025, for providers and deployers alike. What it requires.
• Article 53 duties for general-purpose AI model providers, since 2 August 2025. These matter only if the company trains or substantially modifies a general-purpose model. When fine-tuning crosses the line.

6. Exposure in numbers

Investors like a ceiling. Article 99 sets three tiers: up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other operator duties including Article 50, and up to €7.5 million or 1% for supplying incorrect information to authorities. For large undertakings the higher figure applies. For SMEs and start-ups, Article 99(6) applies the lower of the two. At €2 million turnover, the Article 99(4) ceiling for an SME is 3%, or €60,000. The fine calculator runs the numbers for any turnover, and the penalties guide explains the tiers.

In practice the larger commercial exposure is usually not a fine. It is an enterprise customer whose procurement team pauses a contract until the AI Act questions are answered.

7. Contracts and the customer base

Investors read what the company has promised its customers. Warranties of "full EU AI Act compliance" in customer contracts are a liability if the classification behind them has not been done. They also check whether enterprise customers have sent AI Act questionnaires and how the company answered. Which AI Act clauses are safe to sign.

The data room folder

One version of each, dated, and consistent with what you have told customers. An investor who finds two different tier answers in two places will ask about both. The vendor questionnaire guide helps keep customer answers aligned with the data room.

Answers that close the point

• "Classified, dated, per feature." "Our support assistant is limited risk under Article 50(1), with disclosure in the chat greeting since August 2026. Our scheduling feature is minimal risk. Classification dated [date], against Regulation (EU) 2024/1689 as amended in June 2026."
• "High-risk, and planned." If a product is high-risk, say so and show the workplan to December 2027. Investors fund known work. They discount unknown work.
• "Not applicable, because." Most Chapter III requirements do not apply to most SaaS. State why once, and point to the memo.
• "Self-assessed, not certified." Say what kind of document it is. A structured self-assessment is a reasonable first step for a seed or Series A company. It is not a legal opinion and should not be described as one.

If you are the investor

Five questions cover most portfolio companies: what does the product do with AI, who ships it, is any use in an Annex III area, is the chatbot disclosure live, and is there a dated document saying all this. If the answer to the last one is no, the first four are guesses. For AI built into regulated products such as medical devices, add the Annex I route and its 2 August 2028 date; the HealthTech guide explains it.

Getting ready in a week

1. List every AI feature in one table. The inventory template has the columns.
2. Run each through the free high-risk checker to see whether Annex III and Article 6(3) are engaged.
3. Check the chatbot disclosure. If it is missing, the Article 50 generator drafts the wording.
4. Write down who was trained on what, and when, for Article 4.
5. Put the result in one dated document and keep it current. What that document should contain.

A Reglynn gap report puts the role analysis, the tier with the Article 6(3) and GPAI checks, the obligations that apply to your answers, each with its post-Omnibus deadline, and a prioritised fix list into one dated document. See a sample report before you decide. It is a self-assessment, not legal advice and not a certification.

Frequently asked questions

Do investors expect an AI startup to be fully compliant with the EU AI Act?

Usually not before the deadlines. They expect the risk to be known: a dated classification per feature, the live duties handled (Article 50 disclosure, Article 4 literacy, no Article 5 practices), and a funded plan if any feature is high-risk, with Annex III obligations applying from 2 December 2027.

What is the maximum EU AI Act fine for a startup?

It depends on the breach. Article 99 sets ceilings of up to 35 million euro or 7%, 15 million euro or 3%, and 7.5 million euro or 1% of worldwide annual turnover. For SMEs and start-ups, Article 99(6) applies the lower of the fixed amount and the percentage.

Is a self-assessment enough for investor due diligence?

For many seed and Series A companies with limited-risk or minimal-risk products, a structured, dated self-assessment answers the question. It is not legal advice. Where a product is high-risk or a case is borderline, investors may expect counsel to review it.