EU AI Act for startups and SMEs
There is more relief here than most founders realise and one risk that most miss entirely. The penalty caps invert in your favour, technical documentation can be simplified, and sandboxes give priority access, but Article 25 can make a five-person company the provider of a high-risk AI system without anyone noticing.
What is in scope, and what is not
| Detail | |
|---|---|
| Relief that exists | Art. 99(6): for SMEs including start-ups, each penalty cap is the lower of the fixed amount and the percentage, not the higher. Art. 11(1): simplified technical documentation. Art. 62: priority sandbox access and reduced fees. Reg. (EU) 2026/1744 added further SME and small mid-cap relief, reported to include reduced fine caps and proportionate quality management requirements |
| Relief that does not exist | Exemption from classification. Exemption from Article 5, Article 50 or Article 4. A grace period |
| Deferred | National regulatory sandboxes moved to 2 August 2027 under Reg. (EU) 2026/1744 |
Expert analysis. Classification turns on the intended purpose of each system. This is our reading of common deployments, not an authoritative classification.
Where this usually goes next
Three situations account for most people reading this page. Each has a different answer.
A deal is blocked on an AI questionnaire
Legal will not sign until you can evidence how AI is governed. HumanAudit’s AI Trust Package is a fixed $3,500 over five business days: a public trust page, a pre-filled SIG Lite / CAIQ / SSPA Section K questionnaire bank, and your AI inventory and classification.
You need ISO/IEC 42001 documentation
23 clause-mapped AIMS documents with all 38 Annex A controls pre-populated, editable and yours to keep, from $199. Or score your gaps first: 18 questions, free, no signup to begin.
You are not sure what reaches you
Twenty minutes with the founder. No prep, no deck, straight to the person accountable for the work. If none of this applies to you, you get told that on the call.
This reference is published by HumanAudit Inc. Not a law firm, not an accredited certification body, not a registered auditor. We build documentation, your counsel interprets it, and an accredited body of your choosing certifies you. How this is funded →
Article 25 is the startup trap
The common startup architecture is a thin application layer on a foundation model. If that application serves an Annex III purpose, screening candidates, scoring credit, assessing students, then under Article 25 you have modified the intended purpose of a general-purpose AI system so that it becomes high-risk, and you are the provider.
Provider means the full Chapter III set: risk management, Annex IV technical documentation, conformity assessment, CE marking, registration, post-market monitoring, ten-year retention. The model vendor’s documentation is an input to yours, not a substitute, and no term in their contract changes that.
The corollary is a genuine design lever: staying out is cheaper than complying, and for an early-stage company the Article 6(3) analysis is worth doing before the product is built rather than after. A tool that parses and structures is in a different world from one that scores and ranks. The derogation →
Do the cheap things now
- Article 50 disclosure is a UI change and it is live. It costs an afternoon and it is penalty-bearing today.
- Article 4 AI literacy is a short training record. Live since February 2025 and the most commonly undocumented obligation in the Regulation.
- An AI inventory at ten systems is a spreadsheet. At a hundred it is a project. Start while it is cheap.
- Enterprise procurement will ask before the regulator does. For most startups the first real AI governance deadline arrives in a customer security questionnaire, not from an authority.
What applies before December 2027
Article 50 and Article 4 apply now, at every size and every risk tier. There is no SME exemption from either.
The deferral in Regulation (EU) 2026/1744 covers Chapter III Sections 1 to 3. It does not cover Article 5, Article 4, Chapter V general-purpose AI, Article 49 registration or Article 50 transparency. Full timeline →
Status labels on this page
Verified fact: The Annex III points, article references and dates cited above, checked against the consolidated Regulation and the Commission's AI Act Service Desk.
Expert analysis: The in-scope/out-of-scope allocation, the sector edge case, and the parallel-regulation reading.
Unsettled: Harmonised standards remain in development and the Commission's Annex III guidelines are in draft. Sector supervisory practice has not yet formed.
Procurement arrives before the regulator
For most startups selling into enterprise, the binding constraint is a customer questionnaire asking how AI is governed. That is answered with an inventory, a policy and a management system, not with a conformity assessment.
Classify before you build
Twelve questions mapping your system against Articles 5, 6, 50 and Annex III. No email required.
Frequently asked
Are startups exempt from the EU AI Act?
No. There is no size-based exemption from classification, from the Article 5 prohibitions, from Article 50 transparency or from Article 4 AI literacy. What exists is proportionality: under Article 99(6) the penalty cap for SMEs including start-ups is the lower of the fixed amount and the percentage rather than the higher, Article 11(1) permits simplified technical documentation, and Article 62 provides priority sandbox access and reduced fees. Regulation (EU) 2026/1744 added further relief for SMEs and small mid-caps.
Does building on a foundation model make us a provider?
It can. Article 25 makes a party a provider of a high-risk AI system where it modifies the intended purpose of a system, including a general-purpose AI system, so that the system becomes high-risk. An application layer that serves an Annex III purpose is the common pattern that triggers this.
When do EU AI Act regulatory sandboxes open?
National regulatory sandboxes were deferred to 2 August 2027 by Regulation (EU) 2026/1744, from the original 2 August 2026 date. Article 62 provides SMEs including start-ups with priority access and reduced fees.