Skip to content
AIAssuranceLabs
Menu

Startups entering the EU market

Regulation (EU) 2024/1689 gives a startup no fixed role: the role and the risk tier decide the obligation set. A provider of an Annex III high-risk system carries Art. 9 to Art. 17 from the Annex III application date Deferred; a provider of a system that generates synthetic content or interacts with natural persons carries Art. 50 already. The SME provisions in Art. 11, 17 and 63 simplify the form of some documentation and remove no requirement; Regulation (EU) 2026/1744 moved the Annex III date, not the obligations. This hub holds the obligation set with dates, evidence, scenarios, guides, services and tools.

The situation

The company is small, the product is new, and Regulation (EU) 2024/1689 arrived through an enterprise procurement questionnaire or an investor's due-diligence list before any regulator asked. The first question is classification under Art. 6: a safety component of an Annex I product under Art. 6(1), a use case listed in Annex III under Art. 6(2), or neither. Art. 6(3) removes the high-risk label from an Annex III system that does not pose a significant risk of harm, for example one that performs a narrow procedural task or a preparatory task, while profiling of natural persons stays high-risk. Art. 50 applies by function, whatever the tier: a system that interacts with natural persons or generates synthetic audio, image, video or text carries its own duties, and a startup that trains or substantially modifies a general-purpose AI model carries Art. 53 as a model provider. The classifier walks the Art. 6 and Art. 50 questions in the order of PR-CLS v1.0, and the result is a reasoned technical assessment for discussion with counsel.

A wrong call in either direction is expensive. The high-risk label brings Art. 9 to Art. 17, a conformity assessment under Art. 43, by internal control under Annex VI for most Annex III systems, and registration in the EU database under Art. 49(1). A not-high-risk conclusion under Art. 6(3) brings a documented assessment under Art. 6(4) and, on the working reading of an unsettled point, registration under Art. 49(2) before placing on the market. No compliance function exists to make the call, so engineering produces the evidence that a legal reviewer on the buyer's side accepts. Budget allows one round of testing, and the scope has to match the buyer's questions: accuracy, robustness and cybersecurity results under Art. 15, the technical documentation under Art. 11 and Annex IV, the risk management file under Art. 9, and for synthetic content the marking evidence under Art. 50(2).

Four provisions carry the SME simplifications. Art. 11(1) third subparagraph lets an SME, including a start-up, supply the Annex IV elements in the simplified form the Commission establishes. Art. 17(2) makes the quality management system proportionate to the size of the provider and keeps the degree of rigour the Regulation requires. Art. 63(1) of the consolidated text lets an SME, including a start-up, without partner or linked enterprises within the meaning of Recommendation 2003/361/EC meet certain elements of the Art. 17 quality management system in a simplified manner, and Art. 63(2) states that the derogation removes nothing from Art. 9 to 15, 72 and 73. Art. 62 gives an SME priority access to the national regulatory sandboxes and fees for conformity assessment reduced in proportion to its size. The questions this hub answers:

  • Procurement or an investor asks for AI Act evidence and the company has none
  • Classification is uncertain and a wrong call in either direction is expensive
  • No compliance function exists; engineering has to produce evidence that legal reviewers accept
  • Budget allows one round of testing, so the scope has to match the buyer's actual questions
  • The SME simplifications are known to exist but not what they change

Obligations and dates

The list holds the three entries that can govern a startup's dates depending on the role, and the table holds the five provider articles a buyer's questionnaire maps onto.

Which entry applies depends on the role and the risk tier the classifier result gives; the SME simplifications in Articles 62 and 63 change the form of some documentation, not the underlying requirement.

Obligations that apply to Startups
ObligationApplies fromTestableDocumentationProcessServices
Art. 9Risk management systemDeferred6116
Art. 11Technical documentationDeferred12194
Art. 15Accuracy, robustness and cybersecurityDeferred764
Art. 17Quality management systemDeferred81712
Art. 50Transparency obligations for providers and deployers of certain AI systemsIn force11128

Also relevant, without an obligation page:

  • Art. 6
  • Art. 62
  • Art. 63
  • Annex III

Regulation (EU) 2024/1689 sets no numeric threshold in Art. 9, 11, 15 or 17: Art. 9(8) leaves the metrics and probabilistic thresholds to the provider, Art. 15(1) asks for an appropriate level and Art. 15(3) for a declared one, and Art. 17(2) states proportionality without a size figure. Art. 50(2) sets four qualitative criteria, effective, interoperable, robust and reliable, bounded by technical feasibility and the state of the art. No harmonised standard is cited in the Official Journal as of the anchor date, so no presumption of conformity is available to any provider. The metric categories and the declaration structure for accuracy and robustness come from prEN 18229-2Draft, a JTC 21 draft, and the clause structure of the quality management system comes from prEN 18286Published, a JTC 21 document not cited in the Official Journal. Below them sit the published ISO/IEC standards and the published NIST framework named on each obligation page, and then the state of the art the provider justifies. The provider sets each target against the context of use and records the justification; the acceptance-criteria step of PR-15-ROB v1.0 and the target-setting step of PR-50-MARK v1.0 hold that record.

What an assessor or authority will ask for

A buyer's legal reviewer, an investor's due-diligence counsel, or a market surveillance authority acting under Art. 74 asks a startup for the classification rationale first and the evidence behind it second, in this order.

  1. Classification memo: role, risk tier, Article 6(3) rationale where applicable, presented as a reasoned technical assessment for discussion with counsel
  2. Obligation register with applicability dates from the regulation data
  3. Gap list against the applicable articles and a prioritised readiness roadmap ordered by deadline and effort
  4. A first evidence pack sized to the buyer's questionnaire: test report, traceability matrix, documentation outline
  5. Simplified technical documentation form where the SME provisions apply

The list maps onto the artifact families specified with synthetic samples on the deliverables page: the assessment memo for the classification rationale from PR-CLS, the register or checklist for the obligation register and the gap list, the test report from PR-15-ROB and PR-50-MARK, the traceability matrix that links each questionnaire item to an article, a test and an artifact, and the evidence pack that holds them in one indexed set. The simplified technical documentation form is the provider's own document under Art. 11(1); the Annex IV consistency step of PR-11-DOC v1.0 checks that each declared value matches a dated test report.

Scenarios

Each scenario page tagged for startups states the sequence of events, the evidence list and the consequence of inaction with its article reference.

Guides

Each guide tagged for startups holds a real command, configuration or synthetic example and a threshold or pitfall with its source.

Services

Four services test a startup's evidence in the order the classification result sets; the scope limits are stated on what we cannot do, and the compliance decision remains with the provider, its counsel and, where a notified body is involved, that body.

Protocols

Each protocol is versioned and published in full on the methodology index with the derivation from the standards it cites and the limits of what it shows.

Tools and templates

The classifier, the checklist and the traceability matrix run in the browser, nothing is sent to a server, and their rules are published on the tool logic page; the obligation register outline and the other templates are on the templates page.

Questions

How does the AI Act apply to startups?

Regulation (EU) 2024/1689 has no startup exemption; the role under Art. 3 and the risk tier under Art. 6 decide the obligation set. Art. 62 gives an SME, including a start-up, priority access to regulatory sandboxes and conformity assessment fees reduced in proportion to its size. Art. 11(1) allows a simplified technical documentation form, and Art. 63(1) lets an SME without partner or linked enterprises meet certain quality management system elements in a simplified manner. Art. 63(2) keeps Art. 9 to 15, 72 and 73 in full.

What does an AI vendor security questionnaire ask for under the AI Act?

The AI Act items in a procurement questionnaire map onto five records: the role and risk tier of the system under Art. 6, the accuracy, robustness and cybersecurity results under Art. 15, the technical documentation under Art. 11 and Annex IV, the risk management file under Art. 9, and for synthetic content the marking evidence under Art. 50(2). An evidence pack answers with a classification memo, a test report, a traceability matrix and a documentation outline, each traceable to a protocol run; compliance decisions remain with the provider.

Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.

Ask about scopehello@aiassurancelabs.com