An EU AI Act checklist for startups has six steps: confirm whether the Act applies, classify each AI system by risk, avoid prohibited practices, meet AI literacy and transparency duties, check whether you fall under Annex III high-risk use cases, and track the dates. This is general information, not legal advice.
Key takeaways
- Prohibited practices and AI literacy duties already apply, since 2 February 2025.
- Transparency duties under Article 50 apply from 2 August 2026.
- High-risk obligations for Annex III systems apply from 2 December 2027, and for Annex I systems from 2 August 2028, per the timeline page as fetched on 19 October 2026.
- Fines for SMEs, including startups, are capped at the lower of the fixed amount or the turnover percentage.
Does the EU AI Act apply to a startup?
It applies if you provide or deploy AI systems in the EU market, or your system's output is used in the EU. Check where your customers are, not where your company is incorporated. If you only use off the shelf AI tools internally, you are likely a deployer with lighter duties.
What are the key dates?
| Date | What applies |
|---|---|
| 1 August 2024 | Entry into force |
| 2 February 2025 | Prohibited practices and AI literacy |
| 2 August 2025 | GPAI model rules, governance, certain penalties |
| 2 August 2026 | General application, including Article 50 transparency |
| 2 December 2026 | Added prohibitions on non-consensual intimate imagery and CSAM generation |
| 2 December 2027 | Annex III high-risk systems |
| 2 August 2028 | Annex I high-risk systems |
Dates are from the artificialintelligenceact.eu timeline, as of 19 October 2026. The page did not mention other delay proposals, so confirm current dates before you plan.
The checklist
- Inventory your AI systems. List what you build and what you buy. See how to start an AI governance framework.
- Check prohibited practices. Article 5 bans, among others, social scoring, untargeted scraping to build facial recognition databases, and emotion inference in workplaces and education except for medical or safety reasons.
- Train your people. Article 4 requires measures to build AI literacy among staff who operate AI systems, fitted to their background and the context.
- Add transparency. Under Article 50, chatbots must let users know they interact with AI unless obvious, and providers of generative systems must mark synthetic audio, image, video or text in a machine-readable format. Deployers must disclose deepfakes.
- Check Annex III. High-risk areas are biometrics, critical infrastructure, education, employment, essential services such as credit scoring, law enforcement, migration and border control, and administration of justice and democratic processes. A hiring screener falls under employment.
- Keep records. Decisions, model sources and risk reviews. An AI bill of materials helps, see the AI BOM demo.
What are the fines?
Article 99 sets up to EUR 35 million or 7 percent of worldwide turnover for prohibited practices, up to EUR 15 million or 3 percent for most other obligations, and up to EUR 7.5 million or 1 percent for misleading information to authorities. For SMEs, including startups, the lower of each pair applies.
Click through it at your own pace, or open it full screen.
Frequently asked questions
Is a chatbot high risk under the EU AI Act?
Not by itself. A chatbot mainly triggers the Article 50 duty to tell users it is AI, unless it is used in an Annex III area such as employment screening.
Do startups get exemptions?
The Act caps fines at the lower amount for SMEs and start-ups. The obligations themselves still apply.
When do high-risk rules start?
Per the timeline page, 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems.
What is AI literacy?
It is the duty in Article 4 to build a sufficient level of understanding among staff who operate AI systems, fitted to their role.
Is this legal advice?
No. Ask counsel about your specific systems.
Sources
- EU AI Act implementation timeline
- Article 4: AI literacy
- Article 5: Prohibited practices
- Article 50: Transparency obligations
- Article 99: Penalties
- Annex III: High-risk areas
Last reviewed: 19 October 2026.
