Most articles about the EU AI Act do the same thing — they open with the maximum fine number, describe the legislation in broad strokes, and leave you with a vague sense of urgency and zero idea what to actually do next.
This one works differently. By the end of it you should know exactly which tier your AI system falls into, which obligations are already live, and what you can reasonably leave for later. No law degree required.
1st — Does This Actually Apply to You?
Probably yes, if you have any EU users or customers. That's the part most US and UK founders miss.
If you build, deploy, or even procure AI systems that touch anyone in the European Union, the EU AI Act applies to you — regardless of where your company is headquartered. You don't need an EU office. You don't need EU employees. If someone in Germany, France, or Spain uses your product and your product involves AI in any meaningful way, you're in scope.
That includes companies using third-party AI tools on the backend. If you are building on top of a general-purpose AI model like GPT-4, Claude, or Gemini rather than training your own model, you are a deployer under the Act — which comes with its own distinct set of obligations, separate from the ones that apply to whoever built the model itself.
The 4 Tiers — Here's Where You Likely Sit
The Act organizes AI systems into four categories- unacceptable risk, high risk, limited risk, and minimal risk. Your tier determines everything — how much you need to document, what oversight you need to build in, and what fines you're exposed to if something goes wrong.
Tier 1 — Unacceptable Risk (banned outright)
This covers practices such as social scoring, manipulative or exploitative techniques, and certain biometric identification uses. These prohibitions have been in force since February 2025.
Most startups and SMBs aren't running social scoring systems. But it's worth doing a quick check — some marketing personalization and behavioral targeting systems sit closer to this line than their vendors admit.
Tier 2 — High Risk (serious obligations, major deadlines)
This is the tier that catches the most companies off guard, because the category is broader than it sounds.
Recruitment, credit scoring, insurance pricing, diagnostic support, and similar use cases are high-risk under Annex III. If your SaaS product uses AI to screen job applicants, score creditworthiness, triage patient requests, or influence access to essential services — you're here, not in the minimal-risk bucket where you might have assumed you were.
A concrete example: a SaaS company with 200 SMB customers doing CV pre-screening and skill matching using AI is classified as a provider of a high-risk AI system under Annex III No. 4. The size of the company doesn't change the classification. What the AI does is what matters.
The original deadline for most high-risk obligations was August 2, 2026. Following political agreement on the Digital Omnibus in May 2026, the high-risk deadlines for Annex III systems shifted to December 2, 2027. That extension gives you more runway, but it doesn't change the obligations themselves — and the extended timeline hasn't been officially published in the EU Official Journal yet as of this writing, so the safe approach is to treat August 2026 as your planning baseline while tracking the formal publication.
Tier 3 — Limited Risk (transparency obligations only)
Standard chatbots, FAQ bots, and conversational AI in customer service fall here. The obligation is one thing: the AI nature of the system must be clear to the user at the start of the interaction. If you're running a chatbot and it doesn't identify itself as an AI, that's a compliance gap — and it's already been live since August 2025.
Your system must clearly disclose its AI nature before or during interaction, unless it is already obvious to a reasonable user. "Obvious" is doing some work in that sentence — err on the side of disclosure. A one-line disclosure at the start of the chat session is all this requires for most conversational AI deployments.
Tier 4 — Minimal Risk (almost no obligations)
The vast majority of AI systems in production today fall here: spam filters, recommendation engines, AI-powered search ranking algorithms. No AI Act-specific requirements apply, though general EU law — GDPR, consumer protection, non-discrimination — still does.
One thing applies across every tier regardless of where your system sits: the Article 4 AI literacy duty applies at every tier.
The One Obligation Most Companies Have Already Missed
This is the part almost nobody is talking about, and it's already live.
Since February 2, 2025, the AI literacy obligation under Article 4 has been in force. Organisations providing or deploying AI must ensure their staff have a sufficient level of AI literacy. If your people are using AI tools at work and you have done no structured training, you have a live compliance gap right now.
Not in 2026. Not when the high-risk rules kick in. Right now, today, if your team is using ChatGPT, Copilot, Claude, or any AI-assisted tool without any structured training or awareness about how those tools work — you're already out of compliance with a provision that's been active for over a year.
This doesn't mean you need a formal certification programme. It means someone in your organisation needs to have documented that your team understands what AI tools they're using and what the limitations of those tools are. A written policy and a one-hour session with your team is a reasonable starting point.
What The Fines Actually Look Like
Article 99 sets tiered fines. Breach of the Article 5 prohibitions (unacceptable risk): up to €35 million or 7% of total worldwide annual turnover, whichever is higher. Breach of high-risk requirements or transparency obligations: up to €15 million or 3%. Supplying incorrect or misleading information to authorities: up to €7.5 million or 1%.
For SMEs and startups, fines are proportionate — you pay the lower of the fixed cap or the percentage of turnover. That's genuinely meaningful protection for early-stage companies. A startup doing €500K in annual revenue isn't facing a €35M fine for a first-time transparency violation. But the protection scales with your size — as your revenue grows, so does your maximum exposure.
A Practical Checklist — What To Do This Month
You don't need a legal team to make meaningful progress on this. Here's where to actually start-
Do an AI inventory. List every AI system your company uses or deploys — including tools your employees are using independently (ChatGPT, Copilot, Gemini). Most enterprises already have more AI in use than any single team can see end to end. You can't classify what you haven't catalogued.
Classify each system against the four tiers. The question to ask for each one: does this system affect access to services, employment decisions, creditworthiness, health, or education? If yes, it's probably high-risk. If it's customer-facing and conversational, it needs a transparency disclosure. If it's an internal productivity tool, it's probably minimal risk.
Fix your chatbot disclosure immediately. If you have a customer-facing AI assistant and it doesn't tell users it's an AI at the start — add that line today. This obligation has been live since August 2025 and it's the easiest one to fix.
Document your AI literacy. Write a simple internal policy. Run a one-hour team session. Document both. This closes the Article 4 gap that's already active.
If you're in high-risk territory, get advice. The high-risk requirements — risk management systems, technical documentation, human oversight mechanisms — are substantive and sector-specific. That's not a checklist you want to work through without someone who knows the Act.
The EU AI Act isn't going away and the timeline isn't as distant as some coverage suggests — parts of it have been live since early 2025, and the AI literacy obligation applies to almost every company using AI tools at work, right now.
The good news for most SMBs and startups is that if your AI systems are limited-risk or minimal-risk, your actual compliance burden is genuinely manageable. A transparent chatbot disclosure, a documented AI literacy effort, and a basic inventory of what you're using covers most of what's required. The companies in real trouble are the ones who assumed this didn't apply to them and did nothing — and the ones who've misclassified a high-risk system as minimal because they didn't look closely enough at what it actually does.
Start with the inventory. Everything else follows from knowing what you have.