Most articles about the EU AI Act are written for corporations. Governance frameworks, conformity assessments, risk management systems. Sounds like something that keeps a 20-person compliance team busy.
But what if your company is 8 people? Or 30? Or 120 in the middle of a growth phase?
The good news: the EU AI Act mentions small and medium-sized enterprises 38 times in the legislative text. Startups are explicitly treated as part of this group. There are reduced fines, simplified documentation, sandbox access, and lower fees. The EU doesn't want to kill innovation.
The less good news: the obligations still apply. Even for a team of five that uses AI in their product. Even for an agency of 15 that runs ChatGPT and a recruiting tool.
This post explains what startups and small companies actually need to know in 2026. No legal jargon, just clear action items.
First things first: Are you a provider or a deployer?
This is the most important question, because everything else depends on it.
Provider
You develop an AI system and bring it to market. Or you integrate an AI model (e.g. an LLM like Claude or GPT) into your own product and sell it. Then you're a provider under the AI Act. The requirements are significantly heavier: technical documentation, CE marking, EU database registration for high-risk systems.
Deployer
You use AI systems built by others: ChatGPT, Copilot, a SaaS recruiting tool, a CRM with AI features. This is the situation for most startups. The obligations are lighter but real: AI inventory, risk classification, transparency, training.
Most small companies are deployers. They haven't trained their own AI model. They subscribe to services built by others. But being a deployer doesn't mean you're off the hook. Article 26 of the AI Act defines your obligations precisely.
What already applies (since February 2025)
Two obligations are already active. Regardless of your company size.
Prohibited practices (Art. 5)
Social scoring, manipulative AI, untargeted biometric mass surveillance. If you're using anything like this (unlikely, but check): stop immediately.
AI literacy (Art. 4)
All employees who work with AI must have sufficient AI competency. For most startups, a practical training session is enough. But it needs to happen and be documented.
What's coming in August 2026
August 2, 2026 is the big one. High-risk obligations, transparency requirements, and the mandate for national regulatory sandboxes all take effect. Here's what matters most for startups:
AI inventory: Know what you're using
Map every AI system in your company. Including the ones running "just in the background": AI features in your CRM, auto-generated text in your marketing tool, AI-based analytics in your accounting software. For each system: name, provider, purpose, responsible person.
Determine risk classes
Most AI tools in startups fall under minimal or limited risk. But watch out: if you use AI in recruiting, credit scoring, or automated decisions about people, you're in high-risk territory. This applies even if you didn't build the tool yourself.
Implement transparency obligations
Chatbot on your website? AI-generated content in your communications? Users need to know they're interacting with AI. Synthetic content (images, text, video) must be labeled. This applies from August 2026 across all risk classes.
Vet your vendors
As a deployer, you have the right and the responsibility to verify that the tools you use are compliant. Ask your vendors: Is your system classified as high risk? Do you have technical documentation? What training data was used? A vendor that can't answer these questions is a compliance risk for your company.
What the AI Act does to help startups
The AI Act isn't just a list of obligations. It includes concrete provisions designed to ease the burden on small companies.
The 60% gap: Why most startups aren't ready yet
According to a survey by the European Digital SME Alliance, over 60% of small and medium-sized tech companies say they are not adequately prepared for the AI Act. Nearly half haven't even conducted a risk classification of their AI systems.
The problem is rarely technical. It's cognitive. Many founders built their companies in an era when European AI regulation was theoretical. In 2024, that was still somewhat reasonable. In 2026, it isn't.
Common startup mistakes
"We just use ChatGPT" doesn't count as an analysis. Deployers have obligations too.
"This only applies to big companies." The AI Act classifies by risk, not by size.
"We'll deal with it when we have to." The AI literacy obligation has been active since February 2025.
Treating the Digital Omnibus as a free pass. The postponement is neither adopted nor guaranteed.
Better approach
Build an AI inventory. Takes an afternoon, not a month.
Classify your risk levels. Most of your tools will be limited risk. But verify it.
Question your vendors. Whoever builds your SaaS tools must be able to answer compliance questions.
Use compliance as a trust signal. Investors and customers are increasingly asking about it.
Compliance isn't an innovation killer
This might sound like a lot of red tape. But for most startups that use AI (rather than build it), it comes down to three things:
1. Know which AI systems you're using.
2. Know which risk class they fall into.
3. Document it all in a traceable way.
That's not a months-long compliance project. It's a structured inventory that also helps you internally: Who uses what? Where does data flow? Where are risks nobody has thought about yet?
And for startups building AI products: early compliance is a competitive advantage. Customers, investors, and partners increasingly care about AI governance. Those who bake it in from the start build trust. Those who retrofit later lose time and money.
The fastest path to compliance
SimpleAct is built exactly for companies like yours: small enough not to have a dedicated compliance department, but professional enough to want to get it right. Register AI systems, classify them rule-based, work through checklists, export your report. In an afternoon, not a quarter.
This article is for general information purposes only and does not constitute legal advice. EU AI Act requirements may change through the planned Digital Omnibus package. If in doubt, we recommend seeking legal counsel. Last updated: March 2026.
About SimpleAct: SimpleAct is a German compliance platform that helps companies structurally document their AI systems in accordance with the EU AI Act. From registration to risk assessment to exportable audit reports. All in one place.
Tags
Yannick | SimpleAct Team
Author · SimpleAct Team
