We call OpenAI or Claude through an API. Are we a provider?

Yes, when a system built on that model reaches EU users under your company's name. That makes your company the provider of that system. The model maker carries the general-purpose model duties. Your company carries the system duties, which depend on what the system does, not on which model it uses.

Our product is a support chatbot. Which tier?

Almost always the transparency tier. That means a notice that it's AI and marks on generated content. It becomes high-risk only if it decides something on the Annex III list, such as whether a person gets a loan, a job, or a benefit. I recommend keeping that decision with a human and documenting it.

Do we need to keep data and inference in the EU?

The AI Act doesn't say so. The GDPR, customer contracts, and sometimes DORA do. In the designs I ship, EU hosting is a deployment choice. That keeps the question separate from the choice of model.

What would you build first?

An evaluation suite and logging. High-risk systems require both, every tier benefits from them, and they're the only way to know whether a model change made things worse. Everything else in the Act is easier to document once those two exist. Which of the two does your AI feature have today?

All guides

Guide

The EU AI Act for startups building with models

How the EU AI Act sorts AI systems into risk tiers, which tier your product is likely in, when the rules apply, and what they mean for the way a team builds.

The AI Act is an EU regulation that applies directly in every member state. It sorts AI systems by risk. The Act bans a few uses outright and lists a defined set as high-risk, with real obligations. Some systems only owe transparency, and the rest owe nothing beyond general law. A separate chapter covers general-purpose models, and it binds the model makers rather than the teams who build on them.

For a lot of the startups I talk to, the practical question is simple. Is the company a provider or deployer of a high-risk system, or not? If not, the work is transparency and AI literacy, and both are small. If yes, the Act shapes the data pipeline, the documentation, the logging, and the release process. It's better to know that before building than after.

This is an engineer's reading of the rules. I wrote it to help teams decide whether the rules touch their platform. It isn't legal advice. I recommend checking the current text with your own counsel before planning around a date or a threshold.

Does it apply to you?

If one of these lines describes your company, the rest of this guide applies. If none does, the rule probably sits outside your company. A thirty-minute call confirms that faster than the text can.

We place an AI system on the EU market or put it into use in the EU under our own name, even on someone else's model. That makes us a provider.
We use an AI system in our own operations in the EU for anything other than personal use. That makes us a deployer, with lighter duties.
Our product makes or shapes decisions in a listed area: hiring and worker management, credit scoring or insurance pricing, education and exams, access to essential public or private services, biometrics, critical infrastructure, law enforcement, migration, or justice. That's the high-risk list in Annex III.
Our product talks to people, generates text, images, audio, or video, or detects emotions. Transparency duties apply: a notice that it's AI, and marks on synthetic content.
We train a general-purpose model ourselves. The model chapter applies, with extra duties above a compute threshold. A lot of startups fine-tune or call models instead, and they sit outside this group.

What it asks of your platform

The timeline after the AI Omnibus

The Act entered into force on 1 August 2024. The bans and the AI literacy duty have applied since 2 February 2025, and the general-purpose model rules since 2 August 2025. The AI Omnibus, in force since 27 July 2026, moved the high-risk dates. The Annex III uses now apply from 2 December 2027, and AI inside regulated products such as lifts or toys from 2 August 2028.

Transparency didn't move. Those duties have applied since 2 August 2026, though systems that generate synthetic content and were already on the market have until 2 December 2026 to mark it. A new ban on nudification apps and child sexual abuse material also applies from 2 December 2026. My source is the European Commission's AI Act page, checked on 3 November 2026. I recommend checking it again before planning around a date.

What high-risk asks of the build

High-risk systems need a risk management system, data governance for training and test sets, technical documentation, and automatic logging. They also need instructions and human oversight for the deployer, accuracy, robustness, and cybersecurity, a quality management system, a conformity assessment, CE marking, and registration in the EU database. Most of that is engineering discipline: versioned data, evaluation suites, logs that answer why the system decided what it did, and a release gate. The paperwork follows once the engineering exists.

Transparency for the other tiers

A product that talks to people has to say it's AI, unless that's obvious. Generated text, images, audio, and video need machine-readable marks. People need to know when emotion recognition or biometric categorisation touches them, and deepfakes need labels. These are small to build in from the start and awkward to bolt on later.

Deployers and AI literacy

A company that only uses AI systems still has duties. It has to follow the provider's instructions, keep human oversight, and keep the logs of a high-risk system for at least six months. It has to inform workers when a system affects them and support AI literacy among staff, though the Act sets no specific level. Fines scale from 1% to 7% of turnover depending on the breach, with lower caps for small and medium-sized companies.

How I help

The engineering behind the guide. Each one starts with a map of the platform as it runs today.

Book a call

Cloud security hardening

I find the gaps in your cloud accounts, identity, network, and data, rank them by what an attacker reaches first, and close them with your team.

AI integration

I put language models to work on the problems that matter in your product and back office, and I ship them to production.

NIS2

What the NIS2 directive asks of a startup's cloud platform, how to tell whether a company is in scope or a supplier to one that is, and what to fix first.

DORA

What the Digital Operational Resilience Act asks of a fintech's cloud platform, and what its contract rules mean for suppliers to banks and insurers.

GDPR

What the GDPR asks of a startup's cloud platform in engineering terms: controller or processor, the records to keep, and the controls that prove it.

EU data residency on AWS, Azure, and Google Cloud

How to keep customer data in EU regions on AWS, Azure, and Google Cloud, what still leaves, and the controls that prove it to a customer or auditor.

We call OpenAI or Claude through an API. Are we a provider?: Yes, when a system built on that model reaches EU users under your company's name. That makes your company the provider of that system. The model maker carries the general-purpose model duties. Your company carries the system duties, which depend on what the system does, not on which model it uses.
Our product is a support chatbot. Which tier?: Almost always the transparency tier. That means a notice that it's AI and marks on generated content. It becomes high-risk only if it decides something on the Annex III list, such as whether a person gets a loan, a job, or a benefit. I recommend keeping that decision with a human and documenting it.
Do we need to keep data and inference in the EU?: The AI Act doesn't say so. The GDPR, customer contracts, and sometimes DORA do. In the designs I ship, EU hosting is a deployment choice. That keeps the question separate from the choice of model.
What would you build first?: An evaluation suite and logging. High-risk systems require both, every tier benefits from them, and they're the only way to know whether a model change made things worse. Everything else in the Act is easier to document once those two exist. Which of the two does your AI feature have today?

Let's talk.

A 30-minute call, no pitch. We look at your current setup, your stage, and the thing that's bothering you about it. I give a straight opinion on what to change, what to leave alone, and whether the problem is the one it looks like. What's the one thing in your stack you'd fix tomorrow?

Book a call See pricing

Prefer email or phone? hello@netninjas.eu or +31 6 45984313