AI Compliance for Startups: The Minimum Viable Compliance Guide
You are a startup. You use AI. You cannot afford a compliance team or $50K in consulting fees. Here is what you genuinely need to do — and what you can safely defer — before August 2026.
The honest reality for startups
EU AI Act compliance is not equally complex for all companies. A startup using ChatGPT for customer support emails has completely different obligations than a company selling a hiring algorithm to European banks. Most of the scary headlines about €35M fines are aimed at the second type — not the first.
That said, "we are small" is not a legal defense. The EU AI Act applies based on what your AI system does, not how big your company is. This guide helps you figure out where you actually stand.
Step 1: Classify your AI use cases (takes 30 minutes)
Write down every AI system you use or sell. For each one, answer: Does it make decisions about individual people in these areas?
- Hiring, promotion, or performance evaluation
- Credit scoring or financial decisions
- Healthcare diagnosis or treatment recommendations
- Law enforcement, immigration, or court decisions
- Biometric identification in public spaces
- Critical infrastructure (power, water, transport)
- Education scoring and credentialing
If the answer is yes to any of these, your AI system is "high-risk" under the EU AI Act. High-risk means significant compliance obligations. If the answer is no to all of them, you likely have minimal or limited risk obligations — much simpler to address.
What minimal risk startups must do (most of you)
Most startups fall into minimal or limited risk. If you use AI to write emails, generate images, summarize documents, power a customer chatbot, or recommend content — you are not high-risk. Your obligations are:
1. Chatbot disclosure (required from August 2026)
If users can interact with your AI in real-time — a support chatbot, an AI assistant — you must disclose clearly that they are talking to an AI. This is a transparency requirement under Article 50. How to implement: add "You are talking to an AI assistant" at the start of every chat session. Cost: $0. Time: 1 hour.
2. AI-generated content labeling
If your product generates images, video, or audio that could be mistaken as real (deepfakes, synthetic media), you must label it as AI-generated. Most startups generating product images or email copy are not affected by this — it primarily targets synthetic media that could mislead.
3. Update your privacy policy for GDPR
This is GDPR, not the AI Act, but it is urgent and often missed. If you use Claude, ChatGPT, or any AI API and send user data to it, you need a legal basis for that transfer. Update your privacy policy to disclose that you use AI services and what data is sent to them.
What high-risk AI startups must do
If you build or sell AI systems in hiring, credit, or healthcare to EU users, you have more work to do. The EU AI Act's requirements for high-risk AI include:
Technical documentation (Article 11)
You need to maintain documentation describing your AI system's purpose, training data, accuracy metrics, known limitations, and how humans can oversee it. This does not need to be submitted to anyone initially — it needs to exist so you can show it if investigated. A 10-page document covering these points is sufficient for a startup.
Risk management system (Article 9)
You need a documented process for identifying and mitigating risks from your AI system. For a startup, a quarterly review document noting what risks you identified and what you did about them is a reasonable starting point.
Human oversight (Article 14)
High-risk AI systems must include mechanisms for humans to monitor, intervene, and override the AI. For a hiring tool, this means every candidate screened by AI must be reviewable by a human recruiter who can override the AI's ranking. For a loan scoring tool, every AI-generated score must be overridable by a human officer. Build this into your product now — not as an afterthought after enforcement begins.
Accuracy and bias testing (Article 15)
Your AI system must achieve consistent accuracy across different demographic groups. Run your system against test datasets that include diverse gender, age, and ethnicity representations. Document the results. If there is significant variance in accuracy across groups, you must address it before deployment.
What can wait (safely)
For startups specifically, these items can be deferred without significant regulatory risk:
- Registering in the EU AI database: Required for high-risk AI, but the database is not fully operational. Watch for announcements in late 2025/early 2026.
- CE marking: Required only for high-risk AI placed on the EU market. Startups still in development have time.
- Third-party conformity assessment: Required for certain high-risk categories only (biometrics, critical infrastructure). Many high-risk AI systems are self-assessed.
The cost of getting this wrong
Here is the practical risk: EU AI Act enforcement starts August 2026. Authorities will not immediately fine every small company. They will focus on clear violations — especially companies that denied they were doing high-risk AI when they clearly were.
The bigger immediate risk is customers. If you are a B2B startup selling AI tools to European companies, your customers' procurement teams will start asking for your AI Act compliance documentation before signing contracts. "We do not have any" could cost you deals.
Minimum viable compliance for a pre-Series A startup
Get your startup's compliance checklist in 2 minutes
ComplianceIQ scans your AI tools and generates a checklist specific to your startup — what you must do now, what can wait, and what to ignore. Free for small teams.
Get your startup's checklist free →