Most founders are still bracing for an August 2026 high-risk compliance deadline that quietly no longer exists in its original form. The EU pushed it back over a year — and most of the content circulating hasn’t caught up.
What’s actually already in force right now
It’s worth being precise about what’s binding today versus what’s still ahead, because the two get conflated constantly. Prohibited AI practices have been illegal since February 2, 2025 — this includes things like emotion recognition in the workplace and certain forms of social scoring, and any organization still running a system that falls into this category needs to stop immediately regardless of size or headquarters location. General-purpose AI obligations, national authority designation, and the Act’s overall penalty framework became applicable August 2, 2025. And as of August 2, 2026, the Act’s general application and its Article 50 transparency duties are now live — this is the provision that catches essentially every chatbot and every piece of AI-generated synthetic content, requiring clear disclosure that a person is interacting with AI or viewing AI-generated material.
What’s genuinely been pushed back is the far heavier high-risk regime — the conformity assessments, registration requirements, risk management systems, and detailed logging obligations that apply to Annex III high-risk systems. That’s the piece now landing December 2027 instead of August 2026, and it’s the deferral most founders planning a 2026 compliance sprint haven’t fully absorbed yet.
The Spanish Group
If you’re seeking professional translation and localization services to enhance your global ventures, visit The Spanish Group — your trusted partner in bridging cultures worldwide.
LEARN MOREThe narrow category that actually carries the weight
Here’s the detail that should genuinely reassure most founders: the vast majority of AI systems — spam filters, recommendation engines, general productivity tools — face zero new obligations under the Act at all. The regulation’s real weight falls on a narrow, specifically enumerated set of high-risk applications where a wrong decision has serious consequences for someone’s life: hiring and recruitment screening, credit scoring, insurance pricing, medical diagnostic support, and criminal justice-adjacent tools fall under Annex III’s high-risk classification. If a founder’s product doesn’t touch one of these specific categories, the Act’s heaviest machinery simply doesn’t apply to it, regardless of how sophisticated the underlying AI actually is.
The classification mistake worth avoiding is treating a product as automatically low-risk just because it doesn’t look like a stereotypical “AI product.” Recruitment screening tools, automated credit decisions, and diagnostic support software all qualify as high-risk under Annex III even when they’re marketed and sold as ordinary SaaS products rather than explicitly AI-branded ones — a genuine classification trap that catches founders who assume the Act only applies to companies building foundation models.
Provider versus deployer: the distinction that determines your actual workload
For founders building on top of existing foundation models rather than training their own, the practical obligations are considerably lighter than headlines about the Act tend to suggest. If a company is a deployer — building an application on top of an API from an existing model provider like OpenAI or Anthropic — the main obligations are transparency toward users, human oversight of the system’s outputs, and confirming the underlying model provider has actually completed its own documentation requirements. If a company is a provider — releasing its own foundation model, or substantially modifying an existing one — the obligations are genuinely heavier, though the GPAI Code of Practice offers a reasonably clear compliance roadmap for exactly this category of company.
Most startups building products, rather than foundational models themselves, sit in the lighter deployer category by default — a distinction worth confirming explicitly with counsel rather than assuming, since it changes the entire practical compliance workload.
The extraterritorial reach American founders specifically need to know about
The Act applies regardless of where a company is actually headquartered. Any organization that places an AI system on the EU market, or whose AI system’s output affects people physically located within the EU, falls under the Act’s scope — a US-headquartered founder selling a product to European customers is bound by the same obligations as a company incorporated inside the EU itself. This connects directly to the broader pattern I’ve covered elsewhere regarding EU compliance obligations that apply to American founders the moment EU customers enter the picture, regardless of physical presence in Europe — VAT registration works the same way, with no meaningful grace period simply because the company itself sits outside EU borders.
The penalties, and the relief built in for smaller companies
The Act’s penalty structure is genuinely more severe than GDPR’s — prohibited-practice violations carry fines up to €35 million or 7% of global annual turnover, whichever is higher, and high-risk system non-compliance carries penalties up to €15 million or 3% of turnover. There’s a real, specific mitigation built in for smaller companies worth knowing about directly: for SMEs, including startups, the Act applies the lower of the applicable fixed amount or percentage ceiling, rather than the higher figure used for larger undertakings — a genuine, if partial, acknowledgment that a flat percentage-of-turnover penalty structure would be disproportionately punishing for an early-stage company relative to an established enterprise.
What this means for actually planning compliance in 2026
The practical framework starts with an honest inventory rather than an assumption. Many founders assume “we don’t really use AI” when their own HR tools, marketing platforms, or customer support systems already embed AI features that could bring them into scope if those tools touch EU customers or EU employees. From there, classification matters more than almost anything else — confirming whether a specific product genuinely falls into one of the narrow Annex III high-risk categories, rather than assuming a product is exempt simply because it doesn’t resemble a stereotypical AI company’s output. The February 2025 prohibited practices list deserves immediate attention regardless of company size or stage, since that provision is already fully enforceable today, unlike the deferred high-risk regime. And the newly extended timeline for high-risk compliance — now genuinely running to December 2027 for most categories — is worth treating as real, additional planning time rather than a reason for complacency, since building proper technical documentation as a system is developed costs meaningfully less than reconstructing it retroactively once a 2027 deadline is suddenly close.
None of this should read as a reason to ignore the Act entirely. It should read as a reason to plan against the deadlines that are actually still in force, rather than the ones a founder half-remembers from a headline eighteen months ago that’s since been superseded by a regulation most compliance content hasn’t caught up to yet.
Stay Connected for More Travel and Lifestyle Inspiration
For more insights into travel, culture, and lifestyle tips, follow me on Instagram @salvadorordorica.
If you’re seeking professional translation and localization services to enhance your global ventures, visit The Spanish Group — your trusted partner in bridging cultures worldwide.
The Spanish Group
If you’re seeking professional translation and localization services to enhance your global ventures, visit The Spanish Group — your trusted partner in bridging cultures worldwide.
LEARN MORE