EU AI Act for AI MVP Founders (2026): What Applies, When, and Who Is the Provider

The short answer

The EU AI Act reaches you if you place an AI system on the EU market or put it into service there, wherever your company is based, and also when you are a provider or deployer outside the EU whose system's output is used in the EU (Article 2). Most of the Act, including enforcement and the Article 50 transparency rules, has applied since 2 August 2026. The Digital Omnibus on AI, which entered into force on 27 July 2026, moved the high-risk rules for Annex III use cases to 2 December 2027 and those for AI embedded in regulated products to 2 August 2028.

For a typical AI MVP, such as a chatbot, an assistant or a tool that generates content, three duties come first: tell people they are dealing with an AI system, mark generated content so it can be detected, and take AI literacy measures. The question that changes the plan is whether any feature sits in an Annex III area such as hiring or credit scoring. Our reading is that the company that sells the product under its own name is the provider, even when an agency built it. This page is general information, not legal advice.

Key dates after the Digital Omnibus

These are the milestones on the official AI Act Service Desk timeline, read on 17 October 2026.

Date	What starts to apply	What it means for an MVP
2 February 2025	Definitions, AI literacy and the prohibitions	Article 4 literacy measures and the Article 5 prohibitions already apply
2 August 2025	Rules for general-purpose AI models, and governance	Mostly the duty of the model provider; ask your model vendor what documentation it supplies
2 August 2026	Most rules, with enforcement beginning, including the Article 50 transparency rules	Disclosure for chatbots and marking of generated content
2 December 2026	New prohibitions on non-consensual sexual deepfakes and child sexual abuse material; the Article 50(2) transition for systems already on the market before 2 August 2026	A system launched after 2 August 2026 should not plan on the transition
2 August 2027	At least one regulatory sandbox operational in each Member State	A route to supervised testing, not a duty
2 December 2027	High-risk rules for Annex III systems	Hiring, credit, education and the other Annex III areas
2 August 2028	High-risk rules for AI embedded in products regulated under Annex I	Physical regulated products such as machinery, toys and lifts

The Service Desk marks the 2 December 2026, 2 December 2027 and 2 August 2028 entries as reflecting the Digital Omnibus amendments, and says the main milestones are foreseen to be fully rolled out by 2 August 2028. A search we ran on 17 October 2026 returned articles that disagreed about whether the Omnibus had been adopted and about the dates, so check the date on any summary and compare it with the timeline and the Official Journal.

What the Digital Omnibus changed

The European Commission's news item of 27 July 2026 lists these changes, and the Omnibus entered into force the same day:

• Simplified rules that applied to SMEs are extended to small mid-caps.
• The AI literacy duty is simplified, and the Commission and Member States take a stronger role in promoting literacy.
• A ban on systems that generate non-consensual sexually explicit or intimate content, or child sexual abuse material.
• Processing special categories of personal data to detect and correct bias is allowed.
• The AI Office gets extended oversight of certain systems, including those built on general-purpose models and those embedded in large online platforms and search engines.
• New application dates for high-risk systems: 2 December 2027 for Annex III and 2 August 2028 for Annex I.
• Wider access to regulatory sandboxes, an EU-level sandbox, and a simpler duty to register exempted systems in the EU database.

What counts as an AI system, and who is the provider

Article 3(1) defines an AI system as a machine-based system designed to operate with varying levels of autonomy that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions. A chatbot or content generator built on a language model fits that description. A fixed-rule workflow that makes no inference may not, but classify it in writing instead of assuming.

Three roles matter for an MVP:

• Provider (Article 3(3)): anyone who develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether paid or free.
• Deployer (Article 3(4)): anyone using an AI system under its authority, except in a personal, non-professional activity.
• Downstream provider (Article 3(68)): a provider of an AI system that integrates an AI model, whether the provider made the model or received it from another entity under contract.

Our reading, for a startup that commissions an agency, is this:

1. If you launch the product under your own name or trademark, you had it developed and put it on the market, so you are the provider. The agency is your contractor.
2. If the agency also sells or runs the product under its own name or trademark, it may be a provider as well.
3. If you only use a finished third-party product inside your business, you are a deployer.
4. If your product calls a model through an API, the model vendor carries the general-purpose model duties that began on 2 August 2025, and you are the downstream provider of the system built on it.

For high-risk systems, Article 25(1) adds three cases in which another party becomes the provider. A distributor, importer, deployer or other third party is treated as the provider if it puts its name or trademark on a high-risk system already on the market or in service, if it substantially modifies such a system so that it remains high-risk, or if it changes the intended purpose of a system, including a general-purpose AI system, so that it becomes high-risk. Article 25(4) also asks the provider of a high-risk system and any third party that supplies a model, tool, service, component or process used in it to set out in a written agreement the information, technical access and assistance the provider needs; free and open-source tools and components are excepted, other than general-purpose AI models.

Write the roles into the contract. State who prepares the classification memo for each feature, who supplies the disclosure text and the content-marking step, what documentation the model vendor provides, and who keeps records after launch. The same agreement should settle who owns the code: see who owns your MVP code.

Which duties apply to which MVP

MVP type	What the Act asks	What to build in	Applies from
Customer-facing chatbot or voice assistant	Article 50(1): design the system so people know they are interacting with AI, unless that is obvious from the context	A visible AI label and a disclosure in the first message that meets the accessibility requirements	2 August 2026
Tool that generates audio, image, video or text	Article 50(2): providers make outputs detectable as AI-generated with machine-readable marking, where technically feasible; assistive editing and no substantial change to input are excepted	A marking step in the output pipeline; ask your model vendor what it already embeds	2 August 2026; a transition to 2 December 2026 covers certain systems already on the market before that date
Product that creates deepfakes, or publishes AI text to inform the public on matters of public interest	Article 50(4): deployers disclose the artificial origin; text is excepted where a person reviews it and holds editorial responsibility; evidently artistic, creative, satirical or fictional works get a lighter disclosure	A disclosure label and an editorial sign-off step	2 August 2026
Emotion recognition or biometric categorisation	Article 50(3): deployers inform exposed people how the system operates; Annex III area 1 lists biometrics; Article 5 lists prohibited practices	Take legal advice before you build	2 August 2026 for Article 50(3), 2 December 2027 for Annex III
Candidate screening, hiring or worker monitoring	Annex III area 4; under Article 6(2) listed systems are high-risk unless an Article 6(3) condition applies, and profiling is always high-risk	A classification memo, documented human review and a plan for the high-risk obligations	2 December 2027
Credit scoring, or risk assessment and pricing for life and health insurance	Annex III area 5	The same memo and plan	2 December 2027
Admissions, assessment or exam-monitoring tools	Annex III area 3, education and vocational training	The same memo and plan	2 December 2027
Internal AI assistant for your own staff	Article 4: measures to support AI literacy among staff who operate AI systems on your behalf	A short written briefing and a record of who received it	Literacy since 2 February 2025, enforcement from 2 August 2026
Prototype tested only inside the company	Article 2(8) excludes research, testing and development before a system is placed on the market or put into service, but not testing in real-world conditions	A dated record of when a beta first reaches real users	Not applicable until launch or real-world testing

Annex III lists eight areas: biometrics; safety components in digital infrastructure, road traffic and the supply of water, gas, heating and electricity; education and vocational training; employment and workers' management; access to essential private and public services and benefits, including creditworthiness and insurance; law enforcement; migration, asylum and border control; and the administration of justice and democratic processes.

Article 6(3) lets a provider treat an Annex III system as not high-risk when it does not pose a significant risk of harm to health, safety or fundamental rights and one of four conditions holds: it performs a narrow procedural task, improves the result of a human activity already completed, detects decision-making patterns without replacing the human assessment, or performs a preparatory task for an assessment relevant to an Annex III use case. A system that profiles natural persons is always high-risk. Under Article 6(4) a provider that relies on the exception must document the assessment before placing the system on the market and comply with the registration duty in Article 49(2).

Scope: outside the EU, and what is excluded

Article 2(1) covers providers placing systems on the EU market or putting them into service there, wherever they are established (point a), deployers established or located in the Union (point b), and providers and deployers in a third country where the system's output is used in the Union (point c). A US or Indian startup that sells to EU customers is inside the scope.

The exclusions that matter most to an MVP team are narrow:

• Systems developed and put into service solely for scientific research and development (Article 2(6)).
• Research, testing and development before a system is placed on the market or put into service, except testing in real-world conditions (Article 2(8)).
• Natural persons using AI in a purely personal, non-professional activity (Article 2(10)).
• Systems released under free and open-source licences, unless they are placed on the market as high-risk systems or as systems under Article 5 or 50 (Article 2(12)).

Article 2(7) keeps EU data protection law in force for personal data processed under the Act, so a GDPR review is a separate task. For health products, see our guides to GDPR for health apps and software as a medical device.

Penalties

Breach	Maximum for a company
Prohibited practices (Article 5)	EUR 35 million or 7% of worldwide annual turnover, whichever is higher
Operator obligations, including providers (Article 16), deployers (Article 26) and transparency (Article 50)	EUR 15 million or 3%, whichever is higher
Incorrect, incomplete or misleading information to authorities or notified bodies	EUR 7.5 million or 1%, whichever is higher

For SMEs, including start-ups, each fine is capped at the lower of the percentage and the amount (Article 99(6)). Small mid-caps get the lower figure for the second and third rows (Article 99(6a), added by the Omnibus). Article 99(1) also requires Member States to consider the interests and economic viability of SMEs, start-ups and small mid-caps when they set penalties. These are the maximums the Act sets.

A checklist for an AI MVP team

Our recommendation, in the order we would do it:

1. Classify each AI feature in writing. One page per feature: intended purpose, who is affected, whether it sits in an Annex III area, and any Article 6(3) reasoning. Write it before launch.
2. Disclose AI at the first interaction. A label and a first message, accessible to everyone who uses the product.
3. Mark generated content. Add a machine-readable marking step for audio, image, video and text, and check what your model vendor already provides.
4. Add the deepfake and public-interest text disclosures if your product does either.
5. Brief the people who run the system and keep a record of the briefing, which is the evidence of the Article 4 measures.
6. Write the roles into your contracts: provider, deployer, model vendor and agency.
7. Handle data protection separately, with a GDPR review.
8. Test security before launch. The OWASP LLM Top 10 pre-launch tests cover prompt injection, excessive agency and the other risks, and the AI MVP checklist covers the rest of the launch gate.
9. Keep a dated decisions log, and re-check the timeline every quarter. The Act was amended in July 2026, and Article 50(7) has the Commission supporting codes of practice on marking and labelling and allows it to adopt common rules if the codes prove inadequate.

For chatbot builds specifically, see how to build an AI chatbot MVP. For how this Act sits beside other frameworks, see the ethical AI frameworks comparison.

Limits of this page

The article text above comes from the AI Act Service Desk, which shows the EUR-Lex consolidated version as at 27 July 2026 and calls its summaries explanatory. The legal text is the one published in the Official Journal on EUR-Lex. We read every page on 17 October 2026, and the Act, the Commission's guidance and national laws can change. This page does not cover the duties of general-purpose model providers, products under Annex I, national implementing laws, or sector rules for medical devices and financial services. The provider and deployer readings, the table and the checklist are our own and are not legal advice.

Sources

All pages were read on 17 October 2026.

• AI Act implementation timeline, AI Act Service Desk, European Commission
• Article 2 (scope), Article 3 (definitions), Article 4 (AI literacy), Article 6 (high-risk classification), Article 25 (value chain), Article 50 (transparency) and Article 99 (penalties), AI Act Service Desk, consolidated version as at 27 July 2026
• Annex III (high-risk areas), AI Act Service Desk
• AI Omnibus enters into force, European Commission, 27 July 2026
• Regulation (EU) 2026/1744, the Digital Omnibus on AI, EUR-Lex