Making an AI product compliant with the EU AI Act is a long, expensive project for any team that takes it on, even a small one. I’m sharing what founders learn along the way, so you don’t have to make the same expensive mistakes.
When the first drafts of the EU AI Act started circulating, I, like many in Silicon Valley, was dismissive. It felt like another classic case of bureaucrats in Brussels trying to regulate something they didn’t understand. I’ve built and sold two companies, RemoteTeam and MovieLaLa, and invested in 234 startups, including some of the biggest names in AI like Anthropic and OpenAI. I thought I knew the game. I was wrong.
Navigating the EU AI Act is one of the most challenging things an AI founder can take on. The Act isn’t just a legal document; it’s a fundamental rethinking of how AI should be built and deployed. It forces teams to confront uncomfortable questions about fairness, transparency, and accountability. Here are the seven most important lessons.
1. The Act is a Moving Target
A team that started early would find the AI Act still being debated and amended. It would spend weeks implementing a feature to address a specific clause, only to have that clause rewritten or removed. It feels like trying to hit a target that is constantly moving. Keeping up can mean hiring lawyers in Brussels just to track the changes. My advice: don’t get bogged down in the details of the current draft. Instead, focus on the core principles of the Act: risk management, data quality, transparency, and human oversight. These are unlikely to change, and building your product around them will make you more resilient to future amendments.
A typical example: a team spends a month building a complex data lineage tracking system, only to find out that the final version of the Act has a slightly different interpretation of what is required. It has to refactor the entire system. That is an expensive mistake.
2. Data Provenance is Everything
The Act places a huge emphasis on data quality and governance. You need to know where your data came from, how it was collected, and what biases it might contain. For most teams, this means going back through years of data and meticulously documenting its provenance. It is a painful and time-consuming process, but it is also incredibly valuable. Teams uncover hidden biases in their datasets that they never would have found otherwise. For example, an early dataset for a hiring tool might turn out to be heavily skewed towards male candidates. The fix is to re-balance the dataset and retrain the model to ensure fairness.
This isn’t just about compliance; it’s about building a better product. If your data is biased, your AI will be biased. It’s that simple. Start documenting your data provenance now, even if you’re not subject to the AI Act. It will save you a lot of headaches down the road.
3. "High-Risk" is Broader Than You Think
The Act categorizes AI systems into different risk levels, with the strictest requirements reserved for "high-risk" applications. Picture a team that assumes its product, a tool for helping companies manage their staff, will be low-risk. It is wrong. Because the tool can be used to make decisions about hiring, promotion, and termination, it is classified as high-risk. That means a whole host of additional requirements, including a mandatory fundamental rights impact assessment.
Don’t assume your AI is low-risk. The definition of high-risk is broad and open to interpretation. If your AI has any impact on people’s lives or livelihoods, there’s a good chance it will be considered high-risk. The list of high-risk systems includes AI used in education, employment, and law enforcement. But it also includes systems that determine access to essential services, like credit scoring and insurance. The consequences of being classified as high-risk are significant, so it’s important to get this right.
4. Explainability is Not Just a Buzzword
For years, “explainable AI” has been a popular buzzword in the tech industry. The EU AI Act turns it into a legal requirement. For high-risk systems, you need to be able to explain how your AI makes its decisions. This is a huge technical challenge, especially for complex models like deep neural networks. Teams have to invest heavily in new tools and techniques to make their models more interpretable. One approach is a custom dashboard that allows users to see the factors that contributed to a particular decision. This not only helps a team comply with the Act, but it also increases users’ trust in the product.
This is a big deal. For a long time, the AI community has been comfortable with black-box models. The AI Act is forcing us to open up the black box and show our work. This is a good thing. It will lead to more robust, reliable, and trustworthy AI.
5. Your Team Needs a Philosopher
Compliance with the AI Act is not just a technical challenge; it’s also an ethical one. You need to think deeply about the potential societal impact of your AI. A typical team of engineers and data scientists isn’t equipped to have these conversations. An ethicist can help a team navigate the complex ethical issues it faces, and push it to think about things it had never considered, like the long-term impact of its AI on the future of work.
This might sound like a luxury, but I believe it’s essential. As AI becomes more powerful, the ethical stakes will only get higher. You need people on your team who can help you think through these issues from a humanistic perspective. A philosopher or an ethicist can be a valuable addition to any AI team.
6. The Cost of Compliance is a Moat
Let’s be honest: complying with the EU AI Act is expensive. Even a small company feels the cost. For larger companies, the cost could be in the millions. This creates a significant barrier to entry for new startups. While I’m a strong believer in responsible AI, I’m also a pragmatist. The high cost of compliance will give a huge advantage to large, incumbent companies that can afford to pay it. It will be a moat that keeps smaller, more innovative companies out of the market.
I don’t have an easy answer to this problem. On the one hand, we need strong regulations to ensure that AI is developed and deployed safely and ethically. On the other hand, we don’t want to stifle innovation and competition. This is a difficult trade-off, and it’s one that we as a society need to grapple with.
7. The US is Watching
While the EU has taken the lead on AI regulation, the US is not far behind. The White House has issued an executive order on AI, and there are several AI-related bills making their way through Congress. I believe that the EU AI Act will serve as a model for future US regulations. The concepts of risk-based regulation, data governance, and explainability are likely to be adopted in some form in the US.
This means that even if you’re not doing business in the EU, you should be paying close attention to the AI Act. The principles and practices that it establishes are likely to become the global standard for AI regulation. The sooner you start incorporating them into your product development process, the better prepared you’ll be for the future.
The Road Ahead
Building a compliant AI product is a long and difficult journey. But it is also a rewarding one. It forces a team to build a better product and to think more deeply about its responsibilities as creators of AI. The EU AI Act is not perfect, but it’s a good first step towards a future where AI is safe, fair, and transparent.
My advice to other entrepreneurs is this: don’t be afraid of the AI Act. Embrace it as an opportunity to build a better product and a better company. It won’t be easy, but it will be worth it. The future of AI depends on it.
Frequently Asked Questions
Q:What would you do differently looking back?
I'd move faster on the things that were working and cut the things that weren't sooner. Most founders, myself included, hold onto failing strategies too long because of sunk cost. Speed of learning is everything.
Q:Can these results be replicated?
The specific numbers will vary, but the underlying patterns and principles are transferable. The key is understanding the context behind the results, not just copying the tactics. Every company has unique constraints that shape what works.
Q:How long did it take to see results?
Most meaningful business results take 3-6 months to materialize. Anyone promising overnight success is selling something. The companies in my portfolio that grew fastest were the ones that stayed patient and consistent.
Q:What was the biggest challenge in this case?
Almost always, the biggest challenge is people and alignment, not technology or strategy. Getting the right team focused on the right problem is harder than any technical challenge I've encountered.