EU AI Act Guides for Startups: Deadlines, Risk, Duties

Every Reglynn guide in one place. They are written for founders, product managers and compliance leads who need a defensible position on the EU AI Act - not a law-review article. Each one states what the Act requires, what is enforceable today versus deferred, and what you actually have to write down.

New here? Start with the free 2-minute checker to get your likely risk tier, then read the guide for whatever it flags.

Start here

Free EU AI Act checker Answer eight questions, get your likely risk tier and the obligations that attach to it. No account, no card. Compliance checklist The six-step sequence, in order: scope, role, GPAI, risk tier, the Article 6(3) exemption, and what bites now. See a sample gap report A complete report for a fictional AI recruitment startup, so you know exactly what €59 buys. Free tools An Article 50 disclosure generator, a high-risk checker and a fine calculator. They run in your browser.

Deals, investors and procurement

The documents and answers that come up when someone else needs your position in writing.

Answer a vendor questionnaire The EU AI Act questions enterprise procurement asks AI vendors, how to answer each one, and what evidence to attach. Contract clauses for AI vendors The AI Act clauses buyers add to contracts and addenda, and which ones to sign, narrow or push back on. AI inventory template One row per AI feature, dated. The columns every questionnaire and data room starts from, with a worked example. Procurement checklist for buyers Buying an AI tool? What to confirm with the vendor, the deployer duties that stay with you, and contract clauses to ask for. Investor due diligence What investors check about the AI Act, the data room folder, and answers that close the point without overclaiming. The compliance report Most AI products have no certificate. What a dated written position should contain, and three ways to produce one. Article 50 disclosure templates Wording for chatbot greetings, voice agents, AI-generated media and deepfakes, with the placement rules behind it.

Deadlines and what changed

Every deadline, post-Omnibus What is enforceable now, what moved to December 2027, what moved to 2028 - and the SME fine rule most articles get backwards. The June 2026 Omnibus What the amendment actually moved, what it left untouched, and why 16 extra months is tighter than it sounds. Regulatory changelog Every change that affects classification, newest first, with what each one meant in practice. Penalties and fines The three Article 99 tiers - and the SME rule that most published guidance states backwards.

Work out where you stand

These four decide your classification. Most misclassifications happen in the first two.

Does it apply outside the EU? Incorporation isn't the test. Article 2 follows the market, the deployer and - the limb most people miss - where the output is used. The four risk tiers Unacceptable, high, limited and minimal: what each tier means, everyday examples, what you must do and when. Provider or deployer? The question founders answer wrong most often - and how substantial modification makes you a provider without you choosing to be. The Annex III list All eight high-risk categories, what each actually covers, and the two questions that decide most classifications. Article 4 - AI literacy No risk threshold, no size exemption, enforceable now. The obligation everyone has and nobody knows about. Article 50 transparency The part of the Act that is already enforceable. Four disclosure duties, and where teams fail them. Is my chatbot high-risk? Usually no - but Article 50 transparency has been enforceable since 2 August 2026, and that one does apply to you. AI agents The Act classifies agents by what they decide, not by autonomy. What applies today, and when an agent is high-risk. The Article 6(3) exemption How a system inside an Annex III area can still fall outside high-risk - unless it profiles natural persons. GPAI and Article 53 Does fine-tuning make you a model provider? The four factors that decide it, and the four duties if you cross the line.

Building on someone else's model

ChatGPT & the OpenAI API Staff using ChatGPT is a small problem. Building on the API is a real one. The two questions teams keep merging. Anthropic Claude Article 53 stays with Anthropic. You still own the system you built - including long-context analysis and agents.

By industry

HR & recruitment AI Hiring, screening and workforce management are presumptively high-risk under Annex III. Vendor duties vs employer duties. SaaS with AI features Classification is feature-level, not company-level - and calling someone else's API removes less than teams assume. Fintech, credit & insurance Credit scoring and insurance pricing are named in Annex III. Fraud detection is explicitly carved out. For startups The smallest defensible position, and how fast you can get there. Written for teams doing this between sprints. HealthTech & medical devices Medical device AI attaches through Annex I, not Annex III - a different route and a later deadline than everyone else is reading. EdTech & education Admissions, grading, placement and proctoring are named in Annex III. Emotion inference on students is banned outright. E-commerce & retail Recommenders are fine. BNPL credit decisioning and in-store cameras are where the exposure actually is. Manufacturing & industrial Safety components attach via Annex I - August 2028. The real risk in most plants is workforce monitoring. Marketing & agencies Almost nothing here is high-risk - but deepfake disclosure is live law already, and content marking follows on 2 December 2026.

By profession

For DPOs & privacy teams What your GDPR programme already evidences, what genuinely needs new work, and the four places privacy teams get caught. For legal tech & law firms Annex III point 8 is narrower than vendors assume - plus what firms owe as deployers of their own tooling.

How Reglynn works

Classification methodology The published, versioned four-step method behind every report - and what the engine will not do. Our own AI Act status We sell self-assessments and are ourselves an AI system. This is our own classification, including the boundary case we flag against ourselves. About Reglynn What this is, who built it, and how your assessment answers are handled.

Frequently asked questions

Where should I start with the EU AI Act?

Start by establishing two things: whether the Act applies to you at all, and whether you are a provider or a deployer. Almost every misclassification traces back to getting the role wrong. Reglynn's free 2-minute checker settles both, then points you at the relevant guide.

Is the EU AI Act delayed?

Partly. The June 2026 Omnibus deferred most Chapter III high-risk obligations to 2 December 2027, and some to 2028. It did not defer everything: Article 5 prohibitions, Article 4 AI literacy and Article 50 transparency duties are enforceable now, the last of these since 2 August 2026.

Do these guides count as legal advice?

No. They are a structured self-assessment framework based on Regulation (EU) 2024/1689 as amended by the June 2026 Omnibus. They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.

Which guide applies if I only use AI through an API?

Start with GPAI and Article 53, which explains when building on someone else's model makes you a model provider. Then read the SaaS guide: calling an API keeps Article 53 duties with the model provider, but it does not remove your own system-level duties such as Article 50 chatbot disclosure.

Which AI model does Reglynn use?

Reglynn reports are generated by an AI system built on Anthropic's Claude, running Reglynn's own question set and risk logic, and delivered automatically. Reglynn classifies itself as a Limited Risk AI system under Article 50 of the EU AI Act and discloses AI involvement wherever it occurs, including in its chat assistant. Our own self-assessment is published at reglynn.eu/our-ai-act-status.

Does the EU AI Act apply to companies outside the EU?

Often, yes. Article 2 reaches providers irrespective of where they are established, and reaches providers and deployers in third countries where the output produced by the AI system is used in the Union. A US or UK company with EU users is normally in scope - though being in scope is not the same as being high-risk.

Not sure which guide you need?

The free checker asks eight questions and tells you your likely risk tier - then points you at the guides that actually apply to you.

Start the free scan

No card, no account. Full gap report from €59. See a sample report first. Prices exclude VAT, added at checkout where applicable. 14-day refund.

Self-assessment, not legal advice. This page and the Reglynn report are a structured self-assessment based on the EU AI Act (Regulation 2024/1689, as amended by the June 2026 Omnibus). They indicate where you likely stand and what to verify with a qualified advisor. Reglynn is not a notified body and issues no certification.

How this was made. Reglynn reports are generated by an AI system built on Anthropic's Claude and delivered automatically. Reglynn is a Limited Risk AI system under Article 50; we disclose AI involvement wherever it occurs, including in our chat assistant. Our own self-assessment.