AI Act Compliance Guide for Startups & Companies
AI Act compliance: secure your AI systems from day one.
Regulation (EU) 2024/1689: provider or deployer qualification, risk classification, technical documentation, CE marking, GPAI, Code of Practice of 10 July 2025, interaction with GDPR, digital law and intellectual property.
INFLUXIO audits, structures compliance and defends startups, scale-ups, SaaS publishers and user companies in Paris and Brussels. Confidential reply within 24 hours.
served
rating
appearances
Insights
Learn more about this area.
The essentials on the AI Act and your compliance.
Regulation (EU) 2024/1689 of 13 June 2024, known as the AI Act, entered into force on 1 August 2024 and applies progressively until August 2027. The first horizontal piece of AI legislation worldwide, it imposes strict obligations on providers and deployers of AI systems placed on the market or used in the European Union, even when established outside the EU.
INFLUXIO advises startups, scale-ups, SaaS publishers and user companies on compliance, technical documentation and defense in case of inspection, in Paris and Brussels, with a response within 24 hours.
Why the AI Act concerns your startup.
The AI Act applies as soon as an AI system is placed on the market, put into service or used in the Union, regardless of where the provider is established. A US startup offering a large language model accessible to European users is in scope. A French scale-up integrating a third-party model in its product is too.
Three use cases trigger application: placing on the market, putting into service, and use of the outputs in the Union. The stakes are not only regulatory: compliance conditions access to European public contracts, investor confidence at funding rounds, cyber insurance and contracts with large accounts themselves subject to the regulation.
Non-compliance can lead to fines of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher.
The four risk categories.
The AI Act follows a risk-based approach. Each AI system is classified in one of the following four categories, determining the level of applicable obligations.
- ✓Unacceptable risk (Article 5): practices prohibited as of 2 February 2025. Social scoring, cognitive manipulation, exploitation of vulnerabilities, real-time remote biometric identification in public spaces save for exceptions, emotion recognition at work or in schools.
- ✓High risk (Article 6 and Annex III): systems used in education, employment, essential services, law enforcement, migration, justice or democratic processes. Subject to the full set of obligations in Articles 8 to 22.
- ✓Limited risk (Article 50): chatbots, deepfakes, AI-generated content. Transparency obligations (user notice, labelling of synthetic content).
- ✓Minimal risk: the vast majority of AI systems (spam filters, AI in video games). No binding obligation, codes of conduct encouraged.
Are you a provider or a deployer?
Qualification determines all your obligations. A provider develops an AI system or has it developed with a view to placing it on the market or putting it into service under its own name or trademark. A deployer (formerly user) is any natural or legal person using an AI system in the course of its professional activity.
Beware of qualification switching: a deployer who substantially modifies a high-risk AI system, places it on the market under its own name or modifies its intended purpose is re-qualified as a provider (Article 25) and inherits all related obligations.
This mechanism particularly affects SaaS publishers that integrate and customise third-party models, and is one of the most frequent blind spots in an AI Act audit.
Obligations of high-risk AI providers.
Providers of high-risk AI systems bear a comprehensive set of obligations under Articles 8 to 22, 47, 48 and 49 of the regulation. Our firm drafts the documentation, structures governance and prepares the CE marking.
- ✓Risk management system (Article 9): continuous, iterative and documented across the lifecycle.
- ✓Data governance (Article 10): quality, representativeness, absence of bias, traceability of training, validation and test datasets.
- ✓Technical documentation (Article 11 and Annex IV): description of the system, design choices, performance, limitations and human oversight measures.
- ✓Record-keeping (Article 12): automatic logging of relevant events during operation.
- ✓Transparency and information (Article 13): clear, concise and complete instructions for deployers.
- ✓Human oversight (Article 14): technical and organisational measures enabling effective supervision.
- ✓Accuracy, robustness and cybersecurity (Article 15): appropriate level of accuracy, resilience against errors and attacks (data poisoning, model evasion, adversarial inputs).
- ✓CE marking and declaration of conformity (Articles 47 and 48) before placing on the market, and registration in the EU database (Article 49).
Obligations of deployers.
Article 26 requires deployers to use high-risk AI systems in accordance with the instructions for use, to ensure effective human oversight, monitor operation and report any serious incident to the provider and the competent authority. Public deployers and certain private actors must carry out a fundamental rights impact assessment (Article 27) before first use.
Natural persons exposed to a high-risk AI system must be informed. Individual decisions producing legal effects must be explainable (Article 86). Articulation with the GDPR is constant: the AI Act does not replace obligations of lawful processing, legal basis, information and data subjects' rights provided by the General Data Protection Regulation.
GPAI and foundation models: a specific regime.
General Purpose AI models (Articles 51 to 55) are subject to a specific regime applicable from 2 August 2025. Any GPAI provider must publish a summary of the content used for training, comply with EU copyright and maintain up-to-date technical documentation.
Models presenting a systemic risk, presumed above the threshold of 10^25 floating-point operations (FLOPs), bear reinforced obligations: systemic risk assessment, adversarial testing, reporting of serious incidents to the European AI Office, and cybersecurity guarantees.
The General-Purpose AI Code of Practice, published on 10 July 2025 and structured in three chapters (transparency, copyright, safety and security), constitutes the presumption-of-conformity route until harmonised standards are adopted. Non-signatory providers will have to demonstrate equivalent compliance, with a heightened litigation risk.
Generative AI transparency and watermarking.
Article 50 requires clear labelling of AI-generated or AI-modified content: deepfakes, synthetic audio, image, video or text produced at scale and published. Providers must implement technical marking solutions (watermarking, C2PA metadata) that are machine-readable. Deployers must bring this information to the public's attention.
This obligation combines with parallel regimes of copyright (TDM opt-out under Directive 2019/790), right to one's image, criminal identity theft, and provisions of the French Act of 21 May 2024 on AI-generated pornographic content.
INFLUXIO handles these issues in an integrated way with its intellectual property and e-reputation teams.
Application timeline 2024-2027.
The AI Act applies progressively, in steps, requiring each milestone to be anticipated in the company's product and legal roadmap.
- ✓1 August 2024: entry into force of the regulation.
- ✓2 February 2025: Article 5 prohibitions and AI literacy obligations (Article 4).
- ✓2 August 2025: GPAI rules, governance, designation of national authorities, sanctions.
- ✓2 August 2026: general application, including Annex III high-risk systems.
- ✓2 August 2027: high-risk systems embedded in products covered by sectoral legislation.
Sanctions and financial risk.
The sanctions regime, among the strictest in EU law, is based on ceilings modulated by the severity of the breach.
- ✓Violation of prohibited practices (Article 5): up to EUR 35 million or 7% of worldwide annual turnover.
- ✓Other obligations applicable to providers and deployers: up to EUR 15 million or 3% of turnover.
- ✓Supply of inaccurate information to authorities: up to EUR 7.5 million or 1% of turnover.
- ✓SMEs and startups: application of the lower of the two thresholds.
Articulation with other European texts.
The AI Act sits within a dense regulatory landscape.
It combines with the GDPR (processing of personal data), the Digital Services Act (content moderation and recommendation systems), the Digital Markets Act (gatekeepers), the Data Act (access to data generated by connected devices and cloud services) and the revised directive on liability for defective products (Directive (EU) 2024/2853), which now expressly covers software and AI systems.
The proposed specific directive on civil liability for AI (AI Liability Directive) was withdrawn by the European Commission in 2025 for lack of agreement; compensation for damage caused by AI therefore falls under the renewed product liability regime and national civil liability laws. INFLUXIO conducts cross-cutting audits to avoid contradictions and exploit synergies between these regimes.
10-point compliance checklist.
An operational roadmap that can be broken down into internal workstreams or steered with our firm, to turn regulatory obligation into a competitive advantage.
- ✓Map all AI systems developed, integrated or used.
- ✓Qualify the company's role (provider, deployer, distributor, importer) for each system.
- ✓Classify each system in an AI Act risk category.
- ✓Check the absence of any practice prohibited by Article 5.
- ✓For each high-risk system, implement a documented risk management system.
- ✓Build the Annex IV technical documentation.
- ✓Define and test human oversight measures.
- ✓Train teams in AI literacy (Article 4).
- ✓Prepare the declaration of conformity, CE marking and EU registration.
- ✓Implement a serious incident reporting process and an authority point of contact.
AI Act litigation: inspections, appeals and defense.
The competent national authorities designated by France from 2 August 2025 have extensive investigative powers: requests for access to documentation, audits, administrative sanctions.
The CNIL has been given, through an amendment to the French Data Protection Act of 6 January 1978, the role of market surveillance authority for several high-risk AI systems (biometrics, human resources, scoring) as well as for personal data processing.
Other sector regulators intervene depending on the field: the DGCCRF (in particular for prohibited practices under Article 5), ARCOM (audiovisual), ACPR (finance), HAS and ANSM (health) or the Ministry of Labour. The DGE provides strategic coordination. The European AI Office supervises GPAI at EU level. Appeals lie before the administrative courts.
Civil actions for damages can be brought before the Paris Judicial Court or the Court of Economic Activities depending on the parties. Where a breach of the AI Act overlaps with an offence (fraud, breach of trust, attacks on automated data processing systems), our business criminal law team works alongside the business litigation team.
INFLUXIO's AI Act support.
Our firm intervenes at every stage of the compliance cycle, from the first audit to defense before the supervisory authority or the competent court.
AI Act qualification audit.
Mapping of systems, risk classification, identification of applicable obligations and delivery of a prioritised action plan.
Operational compliance.
Drafting of Annex IV technical documentation, data governance policies and human oversight procedures, embedded in product and quality processes.
GPAI and generative AI compliance.
Adherence to the Code of Practice of 10 July 2025, training summary, copyright and TDM opt-out management, deployment of watermarking and C2PA metadata.
Articulation with GDPR, DSA and IP.
Cross-cutting audits and legal opinions to articulate AI Act, GDPR, Digital Services Act, Data Act and related rights, avoiding duplications and contradictions.
AI literacy training.
Tailored sessions for product, data, legal and compliance teams, in execution of the obligation under Article 4.
Inspection and litigation defense.
Coordinated response to authority notifications, administrative appeals, civil actions for damages and criminal defense where the breach overlaps with an offence.
Contact
Contact INFLUXIO.
Would you like to schedule a meeting or get a quote?
We respond within 24 hours.
FAQ
Frequently asked questions.
Yes. Article 2 of Regulation (EU) 2024/1689 adopts a market criterion: as soon as an AI system is placed on the market, put into service or its outputs are used in the Union, the regulation applies, regardless of where the provider is located.
The GDPR governs the processing of personal data; the AI Act governs the placing on the market and use of AI systems, whether or not they process personal data. The two regimes cumulate: a high-risk AI system processing personal data must comply with both GDPR obligations (legal basis, DPIA, data subjects' rights) and AI Act obligations.
2 August 2026 for the vast majority of obligations, including Annex III high-risk systems. Certain provisions apply as of 2 February 2025 (Article 5 prohibitions and AI literacy) and 2 August 2025 (GPAI, governance, sanctions). High-risk systems embedded in sectoral products fall under 2 August 2027.
Yes, on several counts. The provider (OpenAI) is subject to GPAI obligations. The company using ChatGPT is the deployer of a limited-risk system (transparency on generative AI). If it integrates it in a high-risk product or substantially modifies its purpose, it can be re-qualified as a provider under Article 25.
A general-purpose AI model whose training compute exceeds 10^25 floating-point operations (FLOPs) is presumed to present a systemic risk. It then bears reinforced obligations of assessment, adversarial testing, cybersecurity and reporting of serious incidents to the European AI Office.
France has opted for a decentralised architecture, being finalised since August 2025. The CNIL is supervisory authority for several high-risk AI systems (biometrics, human resources, scoring). Other regulators intervene depending on the field: DGCCRF (prohibited practices), ARCOM (audiovisual), ACPR (finance), HAS and ANSM (health), Ministry of Labour.
The DGE ensures strategic coordination and the European AI Office supervises GPAI.
The AI Act does not create a role equivalent to the DPO. However, Article 4 imposes an AI literacy obligation for relevant staff, and the technical documentation implies an internal steering function. Appointing an AI compliance officer is a recommended best practice.
Yes, with caveats. Article 2 partially excludes AI systems released under a free and open-source licence, save where they are high-risk, prohibited, subject to Article 50 transparency obligations or GPAI with systemic risk. Distribution under an open-source licence does not exempt from transparency obligations on training data.
GPAI providers must respect the TDM opt-out provided by Article 4 of Directive 2019/790 and publish a sufficiently detailed summary of the content used for training. Proof of compliance with these obligations is becoming a major litigation issue, particularly in connection with intellectual property.
Preserve confidentiality, document every exchange, organise a coordinated response with counsel. INFLUXIO assists clients from receipt of the notification letter to the final decision and, where applicable, before the administrative court.
Yes. You must keep the provider's instructions for use, document your human oversight, your logs and, where applicable, your fundamental rights impact assessment (Article 27).
Yes. As the AI Act is a directly applicable EU regulation, we assist entities established throughout the Union and outside the EU as long as they serve European users, in coordination with our Paris and Brussels offices.
Related publications
