How the EU’s AI Act Actually Affects Founders in 2026

How the EU’s AI Act Actually Affects Founders in 2026

by | Sep 21, 2026 | AI, Business, Company, Economy, Technology, Worldwide

Most founders are still bracing for an August 2026 high-risk compliance deadline that quietly no longer exists in its original form. The EU pushed it back over a year — and most of the content circulating hasn’t caught up.

A genuine, recent regulatory shift has quietly changed the AI Act’s practical timeline for founders, and much of the compliance content still circulating hasn’t been updated to reflect it. The Digital Omnibus on AI — Regulation 2026/1744 — is now in force, and it specifically deferred the Act’s heaviest obligations, the high-risk system regime, from its originally planned August 2026 date out to December 2, 2027 for most high-risk categories, with product-embedded high-risk systems pushed further still to August 2, 2028. Anyone still operating on the original 2026 deadline is planning around a date that no longer applies.

What’s actually already in force right now

It’s worth being precise about what’s binding today versus what’s still ahead, because the two get conflated constantly. Prohibited AI practices have been illegal since February 2, 2025 — this includes things like emotion recognition in the workplace and certain forms of social scoring, and any organization still running a system that falls into this category needs to stop immediately regardless of size or headquarters location. General-purpose AI obligations, national authority designation, and the Act’s overall penalty framework became applicable August 2, 2025. And as of August 2, 2026, the Act’s general application and its Article 50 transparency duties are now live — this is the provision that catches essentially every chatbot and every piece of AI-generated synthetic content, requiring clear disclosure that a person is interacting with AI or viewing AI-generated material.

What’s genuinely been pushed back is the far heavier high-risk regime — the conformity assessments, registration requirements, risk management systems, and detailed logging obligations that apply to Annex III high-risk systems. That’s the piece now landing December 2027 instead of August 2026, and it’s the deferral most founders planning a 2026 compliance sprint haven’t fully absorbed yet.

The narrow category that actually carries the weight

Here’s the detail that should genuinely reassure most founders: the vast majority of AI systems — spam filters, recommendation engines, general productivity tools — face zero new obligations under the Act at all. The regulation’s real weight falls on a narrow, specifically enumerated set of high-risk applications where a wrong decision has serious consequences for someone’s life: hiring and recruitment screening, credit scoring, insurance pricing, medical diagnostic support, and criminal justice-adjacent tools fall under Annex III’s high-risk classification. If a founder’s product doesn’t touch one of these specific categories, the Act’s heaviest machinery simply doesn’t apply to it, regardless of how sophisticated the underlying AI actually is.

The classification mistake worth avoiding is treating a product as automatically low-risk just because it doesn’t look like a stereotypical “AI product.” Recruitment screening tools, automated credit decisions, and diagnostic support software all qualify as high-risk under Annex III even when they’re marketed and sold as ordinary SaaS products rather than explicitly AI-branded ones — a genuine classification trap that catches founders who assume the Act only applies to companies building foundation models.

Provider versus deployer: the distinction that determines your actual workload

For founders building on top of existing foundation models rather than training their own, the practical obligations are considerably lighter than headlines about the Act tend to suggest. If a company is a deployer — building an application on top of an API from an existing model provider like OpenAI or Anthropic — the main obligations are transparency toward users, human oversight of the system’s outputs, and confirming the underlying model provider has actually completed its own documentation requirements. If a company is a provider — releasing its own foundation model, or substantially modifying an existing one — the obligations are genuinely heavier, though the GPAI Code of Practice offers a reasonably clear compliance roadmap for exactly this category of company.

Most startups building products, rather than foundational models themselves, sit in the lighter deployer category by default — a distinction worth confirming explicitly with counsel rather than assuming, since it changes the entire practical compliance workload.

The extraterritorial reach American founders specifically need to know about

The Act applies regardless of where a company is actually headquartered. Any organization that places an AI system on the EU market, or whose AI system’s output affects people physically located within the EU, falls under the Act’s scope — a US-headquartered founder selling a product to European customers is bound by the same obligations as a company incorporated inside the EU itself. This connects directly to the broader pattern I’ve covered elsewhere regarding EU compliance obligations that apply to American founders the moment EU customers enter the picture, regardless of physical presence in Europe — VAT registration works the same way, with no meaningful grace period simply because the company itself sits outside EU borders.

The penalties, and the relief built in for smaller companies

The Act’s penalty structure is genuinely more severe than GDPR’s — prohibited-practice violations carry fines up to €35 million or 7% of global annual turnover, whichever is higher, and high-risk system non-compliance carries penalties up to €15 million or 3% of turnover. There’s a real, specific mitigation built in for smaller companies worth knowing about directly: for SMEs, including startups, the Act applies the lower of the applicable fixed amount or percentage ceiling, rather than the higher figure used for larger undertakings — a genuine, if partial, acknowledgment that a flat percentage-of-turnover penalty structure would be disproportionately punishing for an early-stage company relative to an established enterprise.

What this means for actually planning compliance in 2026

The practical framework starts with an honest inventory rather than an assumption. Many founders assume “we don’t really use AI” when their own HR tools, marketing platforms, or customer support systems already embed AI features that could bring them into scope if those tools touch EU customers or EU employees. From there, classification matters more than almost anything else — confirming whether a specific product genuinely falls into one of the narrow Annex III high-risk categories, rather than assuming a product is exempt simply because it doesn’t resemble a stereotypical AI company’s output. The February 2025 prohibited practices list deserves immediate attention regardless of company size or stage, since that provision is already fully enforceable today, unlike the deferred high-risk regime. And the newly extended timeline for high-risk compliance — now genuinely running to December 2027 for most categories — is worth treating as real, additional planning time rather than a reason for complacency, since building proper technical documentation as a system is developed costs meaningfully less than reconstructing it retroactively once a 2027 deadline is suddenly close.

None of this should read as a reason to ignore the Act entirely. It should read as a reason to plan against the deadlines that are actually still in force, rather than the ones a founder half-remembers from a headline eighteen months ago that’s since been superseded by a regulation most compliance content hasn’t caught up to yet.

Stay Connected for More Travel and Lifestyle Inspiration

For more insights into travel, culture, and lifestyle tips, follow me on Instagram @salvadorordorica.

If you’re seeking professional translation and localization services to enhance your global ventures, visit The Spanish Group — your trusted partner in bridging cultures worldwide.

 

The Rise of European Deep Tech: Where the Smart Money Is Going

The Rise of European Deep Tech: Where the Smart Money Is Going

by | Sep 21, 2026 | AI, Countries, Europe, Experiences, Technology

Defense and security went from a fifth to nearly half of all European deep tech venture funding in three years. That single shift explains where 2026’s capital is actually flowing better than any other number in the data.

The single most consequential data point in Europe’s 2026 deep tech reporting isn’t a funding total — it’s a share shift. Defense, security, and resilience now account for 43% of all European deep tech venture capital, up from just 20% in 2022. That’s not gradual drift; it’s a fundamental reallocation of where sophisticated capital believes the next generation of category-defining companies will actually emerge, driven by geopolitics rather than pure technology enthusiasm.

A sector proving genuinely resilient while the rest of tech corrects

The broader context makes the defense shift even more notable. European deep tech funding reached $20.3 billion in 2025, an all-time high representing 32% of all European venture capital — more than double the 15% share it held in 2015. While the broader tech market remains roughly 53% below its 2021 peak, deep tech funding sits just 4% below its own all-time high — a genuine divergence, and evidence that sophisticated investors have made a durable, structural bet on deep tech specifically, not a temporary rotation likely to reverse with the next funding cycle.

Why defense specifically, and what’s actually driving it

The reallocation toward defense and dual-use technology reflects a fairly direct chain of geopolitical cause and effect. Macroeconomic shocks — the pandemic, the Russian invasion of Ukraine, US tariff policy, and China’s accelerating industrial capability — have made the cost of strategic dependency on foreign technology and supply chains impossible for European governments to ignore, and the response has been enormous public commitment: the EU Chips Act directing €43 billion toward semiconductor production by 2030, Germany’s €35 billion space investment commitment, France’s €109 billion five-year AI and data center program, and an expected €20 billion or more annually in deep tech funding driven specifically by expanded defense spending. Defense and dual-use technology is now the fastest-growing single segment in the entire deep tech landscape, up 125%.

The clearest headline example of this sovereignty thesis in action came in September 2025, when ASML — the Dutch company that makes the lithography machines the entire global chip industry depends on — became French AI company Mistral’s largest shareholder through a €1.3 billion investment, taking roughly an 11% stake. It’s difficult to find a cleaner single transaction illustrating how seriously European industrial giants now treat technological sovereignty as a genuine strategic priority rather than a policy talking point. At the earlier stage, companies like Orqa — a vertically integrated first-person-view drone manufacturer building its own flight controllers, radios, and motors specifically to avoid Chinese-made components — closed a €12.7 million Series A in March 2026 with customers spanning the US Department of Defense, the Croatian Army, and Ukraine’s armed forces, a genuine illustration of supply-chain sovereignty as a company’s core value proposition rather than a side benefit.

Quantum: the rare case of Europe genuinely leading, not catching up

Most conversations about European tech competitiveness default to a catch-up framing relative to the US. Quantum computing is a genuine exception. Europe holds 89% of global venture funding in quantum cryptography and 47.5% of overall global quantum investment — not a competitive position, a dominant one. Quantonation closed a €220 million early-stage quantum fund in February 2026, more than double its predecessor’s size, and companies like IQM are already delivering superconducting quantum processors to national programs across Finland, Germany, and Spain — evidence the sector is genuinely crossing from laboratory research into industrial deployment rather than remaining a purely speculative research bet. Within the broader “Future of Compute” category quantum anchors, funding more than doubled to $2.5 billion in 2025 alone, the fastest-growing segment of Europe’s entire deep tech landscape outside defense itself.

Where the money actually concentrates geographically

Country-level funding data shows a consistent three-way leadership pattern: the UK attracts the largest overall share, followed by France and Germany, with all three countries pulling meaningfully ahead of the rest of the continent in absolute deep tech investment. City-level specialization tells a more useful story for founders choosing where to actually locate. London remains the top hub across most of the newer, fastest-growing deep tech segments. Munich has become the clear European leader specifically in both defense and space technology — a genuine cluster effect worth knowing about for any founder in either category deciding where to base a European headquarters. Zurich leads specifically in novel robotics, a more specialized but genuinely dominant position within its category.

Beyond defense and quantum, the broader 2025 sector data shows real breadth: Novel AI grew 27% to $3.4 billion, Space Tech grew 22% to $1.3 billion, Computational Biology and Chemistry surged 88% to $1.1 billion, and Novel Robotics grew 64% to $468 million. Novel Energy stood out as the sole declining category, down 41% to $700 million — a genuine counter-trend reflecting capital concentration into defense and sovereignty-adjacent categories rather than any real collapse in the long-term climate tech thesis itself.

The honest structural weakness underneath the growth story

None of this momentum resolves Europe’s most persistent deep tech problem. Beyond Series A, there genuinely isn’t enough growth-stage capital in Europe to fund companies through to scale domestically — the practical consequence is that companies raise smaller rounds than their American counterparts, sell earlier than they might otherwise choose to, or take capital from overseas investors in a way that can quietly shift a company’s actual center of gravity outside Europe even when its origins and technology remain firmly European. The exit environment reinforces the same pattern: more than 80% of European deep tech exits are driven by M&A rather than public listings, and a meaningful share of the value created ends up captured by US acquirers rather than recirculating back into the European ecosystem that originally funded the research.

This is the real tension underneath the headline growth numbers, and it’s worth understanding before assuming Europe has fully solved its historical capital gap. The public and early-stage capital genuinely is there now, at a scale that didn’t exist even five years ago. What’s still catching up is the growth-stage private capital needed to keep a European deep tech success story funded, and owned, by European capital all the way through to a major exit.

What this means for founders and investors positioning now

The practical read for anyone building or backing a European deep tech company in 2026: defense, dual-use, and sovereignty-adjacent technology carries genuine tailwinds that look structural rather than cyclical, backed by public commitments in the tens of billions of euros that aren’t likely to reverse on a short political timeline. Quantum represents a genuine area of European global leadership worth building toward specifically rather than treating as a distant research bet. And the growth-stage funding gap, while real, is also arguably the clearest current opportunity for growth-stage investors specifically — the exact bottleneck constraining otherwise strong European deep tech companies from scaling on domestic terms. I’ve written separately about the practical funding mechanisms available to European founders navigating this landscape, including the specific EIC Accelerator and Horizon Europe programs behind much of the earlier-stage capital driving this growth, in my guide to raising capital without Silicon Valley.

The broader signal worth taking away: European deep tech in 2026 isn’t a story about catching up to the US across the board. In defense, quantum, and semiconductor sovereignty specifically, it’s increasingly a story about Europe setting its own terms entirely.

Stay Connected for More Travel and Lifestyle Inspiration

For more insights into travel, culture, and lifestyle tips, follow me on Instagram @salvadorordorica.

If you’re seeking professional translation and localization services to enhance your global ventures, visit The Spanish Group — your trusted partner in bridging cultures worldwide.