AI Act Compliance Roadmap for Startups

Compliance Checklist (8 items)

1. Phase 1 (Now): Classify your AI system — is it Minimal, Limited, High Risk, or Prohibited? Most B2C AI tools are Minimal or Limited risk
2. Phase 1 (Now): Add a transparency disclosure if users interact with AI — required for Limited Risk systems (chatbots, generative AI)
3. Phase 2 (Pre-EU launch): If High Risk, begin technical documentation — start an Annex IV template early; retrofitting is much harder
4. Phase 2 (Pre-EU launch): Implement logging and audit trail for AI outputs — required for High Risk, good practice for all
5. Phase 3 (Scale): Conduct conformity assessment for High Risk — self-assessment is sufficient for most systems; Notified Body only required for biometrics and critical infrastructure
6. Phase 3 (Scale): Register in the EU database for high-risk AI systems before deploying to EU users
7. Ongoing: Set up an incident reporting workflow — serious incidents involving High Risk AI must be reported to market surveillance authorities
8. Ongoing: Maintain a human oversight capability even if automated — your ability to disable or override the AI is a compliance requirement