The EU AI Act: What High-Growth Founders Need to Know.
How the EU AI Act classifies AI systems, which penalty tier actually applies to most B2B software companies, and what to document now so an enterprise procurement review does not stall.
The EU AI Act is in force and its obligations phase in across 2026 to 2028. For B2B founders selling into European and multinational enterprises, the practical risk arrives well before any regulator does. It arrives when a procurement team asks which risk tier your product falls into and you do not have a written answer.
The tiered risk model
The legislation sorts AI systems into tiers. Prohibited practices under Article 5, such as social scoring and certain biometric categorisation, are banned outright. High-risk systems, which include AI used in employment and recruitment, credit scoring, education and critical infrastructure under Annex III, carry the substantive obligations: risk management, data governance, logging, human oversight, transparency and post-market monitoring.
Most B2B software is neither prohibited nor automatically high-risk. The problem is that founders often cannot demonstrate which tier applies to them. Classification is a judgement about use case and deployment context, and if you have never written that judgement down, a buyer has to make it for you, conservatively.
Getting the penalty tier right
Penalties are widely quoted as up to EUR 35 million or 7 percent of worldwide annual turnover. That figure is real but narrow: Article 99(3) applies it to the prohibited practices in Article 5. It is not the general exposure for a typical SaaS company.
The tier that matters for most operators is Article 99(4), which covers breaches of operator obligations including the high-risk requirements in Chapter III Section 2. It provides for up to EUR 15 million or 3 percent of worldwide annual turnover, whichever is higher. Supplying incorrect or misleading information to authorities sits lower again under Article 99(5).
Quoting the wrong tier in a board pack is its own problem. If you overstate the exposure and a reviewer checks, everything else in the document gets read more sceptically.
What to document now
Obligations for Annex III standalone high-risk systems apply from 2 December 2027, with embedded product safety components following on 2 August 2028. That is enough time to prepare and not enough to leave until the year before.
Four things are worth writing down while they are cheap:
- •A system inventory. Which AI systems you run, which are customer-facing, and which make or materially influence automated decisions about people.
- •A tier judgement. Your reasoned position on whether each system is high-risk under Annex III, and why.
- •Logging and oversight. Whether you retain records of model inputs and outputs in a structured form, and whether a human reviews high-risk outputs before they take effect.
- •Ownership. Who inside the company is accountable for AI governance, with a named deputy.
Each of these is a document, not a project. The cost of not having them is not a fine in 2027. It is a stalled enterprise deal in the next quarter.
Where a diagnostic helps
A structured self-assessment will not classify your systems for you, and it will not inspect anything. What it does is ask the questions a reviewer will ask, record your answers against the specific articles they relate to, and date the result. If your position is sound, you now have it in writing. If there are gaps, you know which ones and in what order to close them before somebody else finds them for you.