The EU AI Act sorts AI systems into four risk levels: unacceptable, high, transparency and minimal. It applies from 2 August 2026 with exceptions, and high-risk rules have later dates. A startup founder needs to decide two things first: which tier each product falls in, and whether the company is a provider or a deployer.
What are the four tiers?
The European Commission describes them as follows. Unacceptable risk covers banned practices, such as social scoring and untargeted scraping to build facial recognition databases. High risk covers uses in areas like employment, education, critical infrastructure, credit access, biometrics and law enforcement. Transparency risk covers systems like chatbots, where people must be told they are talking to a machine, and certain AI-generated content that must be identifiable or labelled. Minimal risk, such as spam filters or video game AI, has no new rules.
Most startups sit in minimal or transparency. A startup building CV screening, exam scoring or credit decisions is in high-risk territory.
What are the dates?
Per the Commission's page we fetched: the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions. Prohibited practices and AI literacy obligations applied from 2 February 2025. Governance rules and general-purpose AI model obligations applied from 2 August 2025. Following the AI Omnibus, which entered into force on 27 July 2026, high-risk rules for certain sensitive areas apply from 2 December 2027, and rules for high-risk AI embedded in regulated products have until 2 August 2028. Transparency rules are listed for August 2026, and prohibition 9 for December 2026.
Dates have moved before, so check the Commission page before you commit a roadmap to them.
Which role are you?
A provider builds a system or has it built and puts it on the market under its name. A deployer uses one in a professional setting. Obligations differ. If you build on a third-party model and ship a product, you are probably a provider of your system, while the model maker has separate obligations for the general-purpose model. Take legal advice on borderline cases.
What does high risk require?
For high-risk systems, the Commission lists: risk assessment and mitigation, high-quality datasets to limit discriminatory outcomes, activity logging for traceability, detailed documentation, clear information to deployers, human oversight, and a high level of robustness, cybersecurity and accuracy. Providers also run post-market monitoring and report serious incidents.
What should a founder decide now?
- Classify each feature. Write down the tier and the reasoning.
- Ask whether any feature touches hiring, education, credit or biometrics. If so, decide whether to proceed, redesign, or budget for conformity work.
- Add disclosure to any chatbot and label generated content where relevant.
- Check that no feature resembles a banned practice, including emotion recognition at work or school.
- Record your role per product.
What not to do
Do not assume you are exempt because you are small or outside the EU; the Act reaches systems placed on the EU market. Do not market a product as "AI Act compliant" unless you can state which obligations you met and how. Do not rely on a vendor's claim that its model covers your duties as a provider.
How to check or apply this
- List AI features with their intended use.
- Classify each by tier and role.
- Open the Commission's timeline page and mark the date that applies to each.
- For high-risk features, start logging and documentation now, since they are slow to retrofit.
- Assign an owner to review the classification at each release.
Quick check
Does a customer support chatbot count as high risk?
Usually no. It falls under transparency rules, meaning users should know it is a machine, unless it is used in a listed high-risk context.
When do high-risk rules apply?
The Commission lists 2 December 2027 for certain sensitive areas and 2 August 2028 for products with embedded AI. Confirm on its page.
Sources
Last reviewed: 18 October 2026.
