Does the EU AI Act apply to my small AI startup? What's due when, after the 2026 AI Omnibus

Yes, the EU AI Act probably applies to your small AI startup if people in the EU can use your product, even if your company is registered somewhere else. For most chatbot, agent and AI wrapper startups, what's due now is short: tell people when they're talking to an AI, make sure generated content is marked, and train your team to use AI sensibly. The heavy high-risk rules that most articles still warn about were pushed back by the AI Omnibus in 2026, to December 2027 and August 2028.

Plenty of answers online, including AI chatbot answers, still give the old 2 August 2026 high-risk deadline. This guide uses only the European Commission's own pages, checked on 28 October 2026.

Does the AI Act apply to me if I'm outside the EU?

Article 2 sets the scope. It covers:

• Providers placing AI systems on the EU market or putting them into service, "irrespective of whether those providers are established or located within the Union or in a third country".
• Deployers of AI systems established or located in the EU.
• Providers and deployers in a third country where "the output produced by the AI system is used in the Union".

The definitions in Article 3 matter here. A provider develops an AI system, or has one developed, and places it on the market under its own name or trademark, whether it charges or not. A deployer uses an AI system under its authority, other than for personal, non-professional use. If you build a product on top of a model from OpenAI, Anthropic or Google and sell it under your own brand, the definitions point to you being the provider of that AI system, while the model company is the provider of the general-purpose model underneath. If you only use AI tools in your business, you're a deployer.

A few things sit outside the Act: AI built and used only for scientific research, research and testing before anything goes on the market (real-world testing isn't covered by that exclusion), and purely personal use. Open-source AI systems are mostly exempt, but not if they're high risk, banned, or covered by the transparency rules in Article 50, which catches most chatbots and generators.

What's due when, after the AI Omnibus (checked 28 Oct 2026)

The Commission says the AI Omnibus entered into force on 27 July 2026. It postponed the high-risk deadlines, added a ninth ban, and extended simplified SME rules to small mid-cap companies.

Sources: the Commission's AI Act page (last updated 19 October 2026) and the AI Act Service Desk's implementation timeline, both checked 28 October 2026.

Which risk tier is your product in?

The Commission describes four levels of risk:

• Unacceptable risk: banned. Nine practices, including social scoring and emotion recognition in workplaces and education institutions.
• High risk: strict rules before you can sell. Examples include CV-sorting software for recruitment, credit scoring and AI safety components in critical infrastructure. For Annex III uses (biometrics, critical infrastructure, education, employment, migration and border control, among others), these rules now apply from 2 December 2027.
• Transparency risk: tell people. Chatbots must say they're AI, AI-generated content must be identifiable, and deepfakes and certain text on public-interest matters must be labelled.
• Minimal or no risk: no specific rules. The Commission's examples are AI-enabled video games and spam filters.

Most small AI products, such as writing assistants, support bots, coding tools, AI agents for small businesses and image generators, land in the transparency tier. The tier depends on what the system is used for, not on the model, so an "AI recruiter" that ranks job applicants is high risk even if it's a thin wrapper.

What a chatbot, agent or generator owes from 2 August 2026

Article 50 splits the transparency duties between providers and deployers.

If you're the provider (you built and sell the product):

1. Say it's an AI. AI systems that interact directly with people must be designed so those people know they're dealing with an AI, unless that's obvious to "a natural person who is reasonably well-informed, observant and circumspect". A support widget that looks like a human agent needs a clear label.
2. Mark generated content. If your system generates synthetic audio, images, video or text, its output must be "marked in a machine-readable format and detectable as artificially generated or manipulated". This doesn't apply where the system only performs an assistive function for standard editing, or doesn't substantially change the input or its meaning. Certain providers whose systems were already on the market before 2 August 2026 have until 2 December 2026 for this, according to the Service Desk timeline.

If you're the deployer (you use AI in your business):

1. Disclose deep fakes. If you publish AI-generated or manipulated image, audio or video that is a deep fake, you must say so. Article 3 defines a deep fake as content that "resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful". For clearly artistic, satirical or fictional work, a light-touch disclosure that doesn't spoil the work is enough.
2. Disclose AI text on public-interest matters. AI-generated text published to inform the public on matters of public interest must be disclosed, unless a human has reviewed or edited it and someone holds editorial responsibility.

For all of these, the information must be "clear and distinguishable", given at the latest at the first interaction or exposure, and accessible.

AI literacy: the duty that already applies

Article 4, as amended, says providers and deployers "shall take measures to support the development of AI literacy of their staff", taking into account their knowledge and experience and the people the AI is used on. It adds that this "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". For a team of two, a short written note on how you use AI, its limits and when a human checks the output, plus a record that everyone has read it, is a sensible start. The Commission has to publish practical examples of how to comply.

What happens if you get it wrong

Article 99 sets the ceilings:

For a small startup, the lower figure is the percentage of turnover, so the ceiling scales with your size. These are maximums: each member state adopts its own national law on penalties, which the timeline says was due by 2 August 2025.

Help that's meant for small companies

• Simplified technical documentation for SMEs, which the AI Omnibus extended to small mid-cap companies.
• Regulatory sandboxes, including an EU-level sandbox, where you can test with a regulator's guidance. Each member state should have at least one running by 2 August 2027.
• The AI Act Service Desk, the Commission's help point, with the article-by-article text used in this guide.
• The AI Pact, a voluntary scheme the Commission invites "AI providers and deployers from Europe and beyond" to join.

Common mistakes

• Planning to the old date. The Annex III high-risk rules now start on 2 December 2027, not 2 August 2026. The transparency rules didn't move.
• Assuming you're too small. There's no headcount exemption. Size changes the fines and the paperwork, not whether the Act applies.
• Assuming you're out of scope because you're outside the EU. EU users, or output used in the EU, bring you in.
• Leaving marking to the model company. If you sell a generator under your own name, the marking duty is yours as its provider.
• Ignoring what customers use your tool for. A general tool sold into hiring or lending can become high risk through its use.

Checklist for a small AI startup

1. Write down whether you're a provider, a deployer, or both, for each product.
2. Check your product's use against the Commission's high-risk examples, and note the date you checked.
3. Add a clear "you're talking to an AI" notice wherever users interact with your system, shown at the first interaction.
4. If you generate images, audio, video or text, ship machine-readable marking, or confirm your model provider's marking carries through to your output.
5. Label deep fakes in your own marketing and content.
6. Write a one-page AI literacy note for your team and keep a record that they've read it.
7. Check the AI Act Service Desk and the Commission's page every quarter, because guidance and codes of practice are still being published.

Where to go next

If you're building an AI product, read how to price an AI product next, because compliance work is a cost your pricing has to carry. If you'd like to compare notes with other founders building AI products for EU customers, you can join Remote Builders: it's free, and you're in straight away.