In 90 days a startup can list every AI system it builds or uses, place each in one of the EU AI Act's four risk levels, fix transparency duties that already apply, and start the records that high risk rules will need. The Act has been applicable since 2 August 2026, with exceptions.
Where does the timeline stand today?
The European Commission's AI Act page gives these dates. The Act entered into force on 1 August 2024. Prohibited practices and AI literacy applied from 2 February 2025, with one further prohibition, on non consensual sexual deepfakes and generation of child abuse material, taking effect in December 2026. Obligations for general purpose AI models and governance rules applied from 2 August 2025. The Act became applicable on 2 August 2026 with some exceptions, and transparency rules take effect in August 2026.
High risk dates moved. The Commission says they were extended through the AI Omnibus simplification package, which entered into force on 27 July 2026. High risk use cases under Annex III, such as biometrics, education and employment, now apply from 2 December 2027, and products embedded in regulated goods under Annex I from 2 August 2028. Dates in this area have changed before, so check the page before you plan.
What are the four risk levels?
Per the Commission:
- Unacceptable risk: banned. The Act prohibits nine practices, including social scoring and untargeted scraping for facial recognition databases.
- High risk: use cases that can pose serious risks to health, safety or fundamental rights, with strict obligations.
- Transparency risk: disclosure duties, such as telling people they are interacting with a chatbot and labelling deepfakes.
- Minimal or no risk: no new rules.
Most startups land in transparency or minimal risk. A few land in high risk, for example in hiring or education tools. Classification is a legal judgement, so confirm yours with counsel.
Days 1 to 30: inventory and classify
- List every AI system you build, and every third party AI service your product or staff use.
- For each, record purpose, who is affected, where it runs and which model it uses.
- Mark your role: do you build it, or just use it?
- Check each system against the prohibited practices list. Stop anything that fits.
- Place the rest in a risk level and record the reasoning.
Keep the register in a spreadsheet at first. It will be your core evidence.
Days 31 to 60: fix what already applies
- AI literacy. The page lists AI literacy among the obligations applying from February 2025. Record what training staff who work with AI have received.
- Transparency. If a customer talks to a chatbot you provide, tell them. If you generate synthetic media, label it. These duties take effect in August 2026, so treat them as current.
- General purpose models. If you use a model provided by someone else, ask the provider what documentation they supply and keep it.
Days 61 to 90: prepare for high risk
If anything you build may be high risk, the Act's articles on data and cybersecurity give you a to do list for 2027.
- Article 10, data governance: training, validation and testing data sets must follow governance practices covering design choices, data collection and origin, and examination for biases likely to affect health, safety or fundamental rights, with measures to mitigate them.
- Article 15, accuracy, robustness and cybersecurity: measures should address attacks that manipulate training data or pre trained components, and inputs designed to make the model err. It applies from 2 December 2027 for Annex III systems.
Start recording where your data comes from, who changed it, and how you test the model. A bill of materials for the code and components around your model, which Safeguard can generate for code, is part of that record. It does not cover the whole Act, and using it does not make anyone compliant or certified.
What should you not do?
Do not assume you are exempt because you are small or because you merely use someone else's model. Do not copy a risk classification from a blog, including this one. And do not wait for 2027, because the evidence takes months to build.
What to do
- Open a spreadsheet and list every AI system by name and purpose this week.
- Screen for prohibited practices and stop any match.
- Classify the rest and write down why.
- Add chatbot disclosure and synthetic media labels where they apply.
- Record staff AI training.
- Request documentation from every model provider you rely on.
- For any possible high risk system, begin data provenance and test records, and book a session with counsel.
Quick check
Does the Act apply if my company is outside the EU?
We did not retrieve the scope rules for this post. Ask counsel, because the Act's reach depends on where systems are placed or used.
Are high risk rules in force now?
According to the Commission's page, Annex III high risk use cases apply from 2 December 2027 and Annex I products from 2 August 2028, after the AI Omnibus changes.
Sources
- European Commission: AI Act regulatory framework, fetched 18 October 2026
- EU AI Act, Article 10, fetched 18 October 2026
- EU AI Act, Article 15, fetched 18 October 2026
This is general information, not legal advice.
Last reviewed: 18 October 2026.
