Conversations most founders have had this year.
EU AI Act compliance when you build the AI yourself.
Three startups on the same engine.
A 14-person HR-tech startup screening CVs: Annex III §4, high-risk provider.
- Placed in §4 in under ten minutes; Aria weighs §4 against §5.
- Annex IV assembled from the model card, data record and risk plan.
- The dossier goes into the Series A data room.
A 22-person legal-tech startup fine-tuning an open-source LLM.
- GPAI duties (Art. 53) sit beside the high-risk provider set.
- Training-data summary and copyright policy filed in the GPAI tab.
- Documentation for downstream developers generated in the same flow.
13 obligations apply to a deployer of a high-risk system.
A 9-person healthtech startup working on MDR and EU AI Act conformity together.
- The notified body carries the EU AI Act conformity assessment.
- Annex IV reused as the MDR technical-file annex.
- Deployer hospitals receive the instructions for use; where Annex III applies, they run their own FRIA.
The features that get you to launch.
EU AI Act for SaaS and AI startups: questions founders ask
We build the AI product. Are we the provider?
Yes, if you place it on the EU market or put it into service under your own name; the Article 16 duties are yours. A deployer who rebrands or substantially modifies a system becomes one too (Article 25).
What does an investor's 'EU AI Act readiness pack' actually contain?
There is no button by that name. A data room wants a classification record per system, the mapped obligations, the Annex IV file, the DoC where one applies, and a dossier with a public verify URL.
Do we need ISO/IEC 42001 as well?
Not by law: it is voluntary, but enterprise procurement increasingly asks for it. Veritome runs it as a programme pre-credited from your EU AI Act work, included from the Govern plan; the certificate comes from an accredited body.
We fine-tune an open model. Which duties apply?
Placing a general-purpose model on the market brings the Article 53 duties: documentation, copyright policy and the training summary. The Article 55 systemic-risk duties apply only above that threshold.