The EU AI Act for Startups: What a 20-Person Company Actually Has to Do
The EU AI Act for startups: classify by use, lean on the SME supports, and build the high-risk stack only if an Annex III use actually applies.
Most EU AI Act coverage is written for enterprises with a compliance department. A 20-person startup does not have one — and usually does not need the full programme it fears. Under Regulation (EU) 2024/1689 your obligations scale with what your AI actually does, and the Act carries explicit supports for small companies. This is the lean playbook: classify honestly, lean on the SME provisions, and only build the heavy stack if you genuinely fall into it.
Start by classifying, not by panicking
The first move is not a policy binder; it is a one-page register of what you use AI to do. Under Article 6, a system is only high-risk if its intended purpose sits in Annex III — recruitment, credit scoring, biometric ID, education evaluation, essential-service eligibility, and a short list more. Most startup AI — a coding assistant, a support chatbot, analytics, marketing copy — is minimal or limited risk, not high-risk. Establish that, with a recorded reason, before spending a euro on conformity work.
Are you a provider or a deployer?
This is the question that decides your obligations. If you use third-party AI as offered, you are a deployer (Article 26) with light duties. If you build and ship an AI feature under your own name — including by building on a general-purpose model API — you are likely the provider (Article 16) of that system, and Article 25 confirms the flip when you brand or substantially modify it. The GPAI obligations for the underlying model stay with the model vendor; your responsibility is the system you put on top, classified by its use. See provider versus deployer roles.
What is live for every startup today
Two duties apply now, regardless of risk tier. Article 4 AI literacy has applied since 2 February 2025 to all AI — your team needs basic competence in the tools they use; a short policy and a briefing discharge it. And the Article 5 prohibitions are live: do not build manipulative or vulnerability-exploiting features, and never infer employees' emotions in the workplace. If you ship anything customer-facing or generative, Article 50 transparency (from 2 August 2026, content-marking from 2 December 2026) requires disclosure.
The SME supports — use them
The Act is not indifferent to size. Build your plan around four provisions:
- Regulatory sandboxes (Articles 57–59): each member state runs one by 2 August 2026, with priority and free access for SMEs and start-ups (Article 58) — supervised testing before launch.
- Proportionate conformity-assessment fees (Article 62) for SMEs.
- Simplified technical-documentation form (Article 11(3)) for SMEs.
- The fine cap (Article 99(6)): for SMEs and start-ups, the fine is the lower of the percentage or the fixed amount, not the higher.
These exist precisely so a small team can comply without enterprise overhead.
If you ARE high-risk: the stack, staged
If your product genuinely sits in Annex III — an AI hiring tool, a credit-scoring feature — you owe the provider stack: risk management (Article 9), data governance (Article 10), technical documentation (Article 11, Annex IV), logging (Article 12), human oversight (Article 14), accuracy and robustness (Article 15), conformity assessment (Article 43), the Declaration of Conformity (Article 47) and registration (Article 49). The runway helps: stand-alone high-risk Annex III now applies from 2 December 2027 under the Digital Omnibus, deferred from the statutory 2 August 2026 and now formally adopted (European Parliament, 16 June 2026; Council, 29 June 2026), pending only Official Journal publication expected before 2 August 2026. Start the slow items — data governance especially — now.
Worked example: a seed-stage SaaS startup
Nimbus Labs, a 14-person seed-stage startup in Tallinn, ships a customer-support assistant built on a general-purpose model API and uses AI internally for coding and analytics. Its classification: the support assistant is limited risk (Article 50 disclosure that customers are talking to an AI), and the internal tools are minimal. Nimbus is a deployer of the model — until it considers an "AI candidate-ranking" feature for its own hiring, which would be Annex III point 4 high-risk and make it a provider. It parks that feature, registers its three uses, runs Article 4 literacy, and notes the SME sandbox as the route it will use if it ever builds the hiring tool. Total effort: a register, a chatbot label, and a one-page policy — not a compliance department.
How Confir helps
Confir gives a startup the classification and the register without a consultant: answer plain-English questions about each AI use, and the deterministic, rule-based engine returns the tier, your role, and the obligations — with the SME supports (Articles 58, 62, 11(3), 99(6)) surfaced where they apply. If a use is high-risk it routes you to the staged stack and the Annex IV documentation; if it is minimal it tells you so, with a recorded reason you can show an investor or an auditor.
Frequently asked questions
Does the EU AI Act apply to startups?
Yes, but proportionately. The Act applies based on what your AI does and where it is placed on the market or used, not on company size. Most startup AI is minimal or limited risk and carries light duties; only genuinely Annex III uses trigger the high-risk stack. The Act also includes specific SME and start-up supports.
Is my startup a provider or a deployer?
If you use third-party AI as offered, you are a deployer (Article 26). If you build and ship an AI feature under your own name — including on a general-purpose model API — you are likely the provider (Article 16) of that system, with Article 25 confirming the flip when you brand or substantially modify it. The model vendor keeps the GPAI duties.
What does a startup have to do right now?
Article 4 AI literacy (live since 2 February 2025) for your team, and compliance with the Article 5 prohibitions. If you ship customer-facing or generative AI, Article 50 transparency applies from 2 August 2026 (content-marking from 2 December 2026). Beyond that, classify your uses so you know whether anything is high-risk.
What supports does the Act give small companies?
Regulatory sandboxes with priority, free SME access (Articles 57–59), proportionate conformity-assessment fees (Article 62), a simplified technical-documentation form (Article 11(3)), and a fine cap (Article 99(6)) that sets an SME or start-up fine at the lower of the percentage or the fixed amount.
When do high-risk obligations apply to startups?
Stand-alone high-risk Annex III obligations now apply from 2 December 2027 under the Digital Omnibus, deferred from the statutory 2 August 2026 and now formally adopted by the European Parliament and Council, pending only Official Journal publication. Start the slow items like data governance early.
Related guides
- Provider versus deployer roles
- EU AI Act regulatory sandboxes
- EU AI Act compliance software for SMEs
- How AI risk classification works
- The SME relief in the AI Act
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →