The EU AI Act for scale-ups: what applies in 2026?

What is the EU AI Act?

The EU AI Act, Regulation (EU) 2024/1689, is the European Union’s law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages (EUR-Lex). It regulates AI by the risk of its use and reaches companies outside the EU when their AI systems are placed on the EU market or their output is used in the EU (Article 2).

The European Commission describes four tiers (European Commission, AI Act):

• Unacceptable risk. Banned practices, such as social scoring and emotion recognition in workplaces and education.
• High risk. Uses in defined areas, such as employment, education and credit scoring, with strict obligations before market entry.
• Transparency risk. Systems such as chatbots and deepfakes, which must disclose that AI is involved.
• Minimal or no risk. Everything else, such as spam filters, with no specific obligations.

A separate set of rules covers general-purpose AI models, defined in Article 3(63) as models that display significant generality and can perform a wide range of distinct tasks. The large language models many scale-ups build on fall here.

Which AI Act obligations already apply in November 2026?

Four groups of obligations are in force today (AI Act Service Desk, timeline).

• Prohibited practices, from 2 February 2025. Article 5 bans practices such as harmful manipulation, exploitation of vulnerabilities, social scoring, untargeted scraping of facial images and emotion recognition at work and in education.
• AI literacy, from 2 February 2025. Providers and deployers must take measures to support AI literacy among staff who operate AI on their behalf. The Omnibus rewrote Article 4 so that no specific level of literacy has to be guaranteed for any individual (Article 4, consolidated text as at 27 July 2026).
• General-purpose AI models, from 2 August 2025. Providers of these models must meet the Chapter V duties, including technical documentation, information for downstream providers, a copyright policy and a public summary of training content (Article 53). Models already on the market before 2 August 2025 have until 2 August 2027 (Article 111). The Commission published a voluntary General-Purpose AI Code of Practice on 10 July 2025 (European Commission, Code of Practice).
• Transparency duties and enforcement, from 2 August 2026. Most of the Act applied from this date, including the Article 50 transparency rules, and enforcement began for prohibitions, general-purpose AI models, transparency and AI literacy.

What did the Digital Omnibus change?

The Commission proposed the Digital Omnibus on AI on 19 November 2025 as part of its digital simplification package. Parliament and Council reached political agreement on 7 May 2026, and it entered into force on 27 July 2026 (European Commission, AI Act) as Regulation (EU) 2026/1744 (EUR-Lex). It is adopted law, not a proposal.

• High-risk, Annex III use cases. Obligations now apply from 2 December 2027.
• High-risk AI in regulated products (Annex I). Obligations now apply from 2 August 2028.
• Marking of AI-generated content. Providers of systems that generate synthetic audio, image, video or text placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2) (Article 111(4)).
• A new prohibition. AI systems that generate non-consensual sexual deepfakes or child sexual abuse material are banned from 2 December 2026.
• Smaller fines for small mid-caps. For small mid-cap enterprises, fines under Article 99(4) and 99(5) are capped at the lower of the amount or percentage, as they already were for SMEs (Article 99).

The delay gives high-risk providers more time; it does not remove the obligations. For founders selling into hiring, education or lending, December 2027 is a product roadmap date.

Are you a provider or a deployer?

Most obligations attach to a role, and one company can hold different roles for different systems. A provider develops an AI system or general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its own authority in a professional setting (Article 3).

A scale-up that ships an AI feature is usually the provider of that system, even when the model underneath comes from someone else, and a deployer of the AI tools it uses internally.

Article 25 sets out when a company becomes the provider of a high-risk system (Article 25): when it puts its name or trademark on a high-risk system already on the market, makes a substantial modification to one, or changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. The last case matters for vertical products built on general-purpose models.

Deployers of high-risk systems have their own duties under Article 26, including following the instructions for use, competent human oversight, keeping logs for at least six months and informing workers and affected people (Article 26).

What should a scale-up building on third-party models check?

The model provider carries the general-purpose AI obligations; the scale-up carries those of the system it sells. The questions to answer are:

1. What is the intended purpose of each AI feature? Check it against the eight Annex III areas: biometrics, critical infrastructure, education, employment and worker management, access to essential services (including credit scoring and life and health insurance pricing), law enforcement, migration and the administration of justice (Annex III).
2. Does the feature interact with people or generate content? If so, Article 50 applies: users must be told they are interacting with AI unless it is obvious, and synthetic content must be marked in a machine-readable format (Article 50).
3. What does the model supplier provide? Ask for the downstream information Article 53 requires and whether the supplier has signed the Code of Practice.
4. Who carries what in the contract? Terms with model suppliers and customers should say who holds which obligation.
5. Do customers use the product in a high-risk way? A general tool sold into HR or lending may be configured for Annex III purposes; founders should know where that happens.

How do you prepare? A practical checklist

Preparation is mostly inventory and documentation:

• Build an AI inventory. Every AI system the company builds, sells or uses, with the model and supplier behind it.
• Classify each system. Record the role, the risk tier and the reasoning, especially where an Annex III system is argued not to be high-risk.
• Start the documentation. For likely high-risk systems, begin technical documentation, data governance and risk management records now.
• Design human oversight. Decide who can review, override or stop each system, with the training and authority to do it.
• Write transparency notices. Check chatbot disclosures, content labelling and machine-readable marking against Article 50, with the 2 December 2026 date in mind for generative features already on the market.
• Send supplier questions. Ask for AI Act documentation, Code of Practice position and contractual allocation of obligations.
• Run AI literacy measures. Record the training and guidance given to staff who use AI.
• Name a governance owner. One accountable person, reporting to the board, who owns the inventory, tracks changes to the Act and its guidance, and brings in legal counsel.

The board should see this as a recurring item, like data protection and security. Founders should take legal advice on their specific products, markets and contracts before relying on any classification. The article on legal considerations when scaling covers the wider legal groundwork.

What are the penalties under the AI Act?

The Act sets maximum fines in Article 99 (Article 99):

• Prohibited practices. Up to €35M or 7% of total worldwide annual turnover, whichever is higher.
• Most other operator obligations. Up to €15M or 3% of worldwide annual turnover, whichever is higher.
• Incorrect or misleading information to authorities. Up to €7.5M or 1% of worldwide annual turnover, whichever is higher.
• SMEs, including start-ups. Each fine is capped at the lower of the two figures.

Providers of general-purpose AI models face separate fines set by the Commission of up to €15M or 3% of worldwide annual turnover, whichever is higher (Article 101).

How TGC Capital Partners approaches AI governance

For software and technology scale-ups, AI Act readiness is part of governance, not a separate legal project. TGC Capital Partners, the strategic investment arm of Gateway Group of Companies, works with founders on 4X Governance & Back Office: board reporting, policies and the operating discipline that make compliance work repeatable. An accurate AI inventory and a named owner make customer, investor and regulator questions easier to answer as the 2027 and 2028 dates approach.

The AI Act rewards companies that know what AI they run, which role they hold and who is accountable for it.

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?

Yes. It applies to providers placing AI systems or general-purpose AI models on the EU market wherever they are based, and to providers and deployers outside the EU whose AI output is used in the EU.

When do the high-risk AI obligations apply after the Digital Omnibus?

The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved the high-risk obligations for Annex III use cases to 2 December 2027 and for AI embedded in regulated products under Annex I to 2 August 2028.

Is the Digital Omnibus on AI adopted or still a proposal?

It is adopted. The Commission proposed it on 19 November 2025, Parliament and Council reached political agreement on 7 May 2026, and it entered into force on 27 July 2026.

If we build on a third-party model, are we a provider?

Usually, yes, for the AI system you build and sell under your own name. The model supplier is the provider of the general-purpose AI model; your company carries the obligations of the system built on it.

What transparency obligations apply in 2026?

From 2 August 2026, Article 50 requires that people are told when they interact with AI, that synthetic content is machine-readably marked and that deepfakes are disclosed. Generative systems on the market before that date have until 2 December 2026 for the marking duty.

What are the maximum fines under the AI Act?

Up to €35M or 7% of worldwide annual turnover for prohibited practices, up to €15M or 3% for most other obligations and up to €7.5M or 1% for misleading information, whichever is higher. For SMEs and start-ups the lower figure applies.

Related reading

Legal considerations when scaling your business · Board composition for SaaS scale-ups · AI adaptation and the new architecture of hyperscaling · What will make a SaaS business defensible and valuable? · 4X Governance & Back Office