EU AI Act Readiness for US Startups

The EU AI Act reaches US startups that ship to EU users — and most assume it doesn't. Here's what readiness actually means, and the parts that don't matter yet.

The EU AI Act is extraterritorial: if your AI system is on the EU market or affects EU users, it reaches you. Most US startups either ignore it or over-rotate on it. Readiness is narrower than the panic suggests.

The Act tiers systems by risk: prohibited, high-risk, limited-risk, minimal-risk. Readiness starts with knowing which tier your system is in — most US startups are limited or minimal, not high-risk, and the obligations follow the tier.

• Prohibited: don't ship these.
• High-risk: the full obligations apply.
• Limited-risk: transparency obligations.
• Minimal-risk: largely voluntary.

For most US startups, readiness is three things:

• **Classification.** Know your risk tier, documented.
• **Transparency.** If you're limited-risk, tell users they're interacting with AI.
• **Documentation.** For high-risk: data, model, evals, audit trail, risk management.

The first two are cheap; the third is the one to scope early if you might be high-risk.

The Act bites at the points where a regulator or a counterparty asks for evidence — at procurement, at a complaint, at an audit. Readiness is having the evidence ready: classification, transparency, and (if high-risk) the documentation. Not having it is where the cost lands.

• The parts that apply only to prohibited systems (you shouldn't be building those).
• The panic about obligations that don't apply to your tier.
• The assumption that it doesn't reach you (it does, if you touch EU users).

EU AI Act readiness for a US startup is knowing your risk tier, meeting the transparency obligations, and — if you're high-risk — scoping the documentation early. Most startups are limited or minimal risk, and the obligations follow the tier. Ignore the panic; don't ignore the reach.