_The following is a guest post by Sahin Boydas, a serial entrepreneur and angel investor. The views expressed are his own._
Making an AI product fully compliant with the EU AI Act is a long, expensive project for any team that takes it on. It is brutal. Forget the dry legal summaries and the high-level think pieces from consulting firms. I’m here to give you the ground truth founders face in the trenches, founder to founder.
Most people in Silicon Valley see regulation as a nuisance, a tax on innovation. I get it. But the EU AI Act is different. This isn't a simple checkbox exercise like GDPR. It's a fundamental shift in how you must build and operate an AI company if you want to touch the European market. It’s a minefield, and I’m going to share the hard-won lessons from that minefield that you won’t find in any legal guide.
This is what it really takes to be compliant.
1. Forget the Fines. The Real Cost is the Focus Drain.
Everyone loves to quote the headline-grabbing fines—up to €35 million or 7% of global turnover. It’s a scary number, for sure. But honestly, that isn’t what keeps founders up at night. The real killer, the silent startup killer, is the relentless drain on focus.
For months on end, a pair of co-founders can be pulled into hours of compliance-related meetings every single week. That’s not an exaggeration. There are meetings with lawyers to interpret the legalese, meetings with consultants to design a risk assessment framework, and meetings with the team to explain the new requirements. That’s a huge share of their productive time as founders, gone. Poof. Evaporated into thin air.
A team’s two best engineers—the ones who should be perfecting its core recommendation algorithm—end up writing documentation about data lineage and model testing protocols instead. A feature launch for a new personalization engine, something users are begging for, can slip by a full quarter. The opportunity cost is enormous. While a team is stuck in a conference room debating the precise definition of "meaningful human oversight," its competitors are shipping code. The Act doesn’t just demand your money; it demands your most precious resource: your team's undivided attention. And for a startup, that's everything.
2. Your Data Is a Toxic Asset Waiting to Happen.
Most teams think they have clean data. They really do. They’ve spent a fortune on what they believe is a pristine, well-labeled dataset for training their main classification model. They’re proud of it. Then the audit starts.
Picture this: a small fraction of the data, acquired from a data broker years earlier, turns out to have murky origins. The broker was reputable, or so the team thought. But it can't provide the granular, individual-level consent records that the Act requires. The team can prove consent for the dataset as a whole, but not for every single person within it. Say it is about 5% of the total training data.
Five percent. Sounds small, right? But under the AI Act, it is a ticking time bomb. There are two choices: risk it, or purge it. The safe call is to purge it. All of it. And then retrain the models from a new, smaller, but fully compliant dataset. Accuracy can drop noticeably overnight, and it can take a data science team weeks of frantic work to get it back to its previous performance. The lesson here is brutal: data isn’t just an asset anymore. It’s a liability. You need to treat your data governance with the same paranoid seriousness as your finances. Every single data point needs a bulletproof story. If you can’t tell that story, you can’t use it. Period.
3. "Explainable AI" Is No Longer a Boardroom Buzzword.
I’ve been in dozens of boardrooms where "Explainable AI" (XAI) was a term thrown around to make investors feel warm and fuzzy. It was a nice-to-have, a marketing slide. Those days are definitively over. The "right to an explanation" for automated decisions is a core tenet of the Act. And the regulators are not messing around.
Picture a three-hour meeting with a national authority where officials grill a team on why its model made a specific credit-scoring recommendation for a hypothetical user. They don’t want a high-level summary or a pretty visualization. They want the specific features, the exact weights assigned to them, and the full decision path through the model. An initial response based on a standard SHAP plot isn’t good enough. A regulator with a PhD in computer science can call it a "post-hoc rationalization" and say it doesn't represent the model's actual internal logic.
This is exactly why I’ve invested in companies like Anthropic and backed teams working on mechanistic interpretability. They get it. Building interpretability into the model from the ground up is the only way forward. A team in that position may have to completely re-architect a part of its system, moving away from a complex, high-performance XGBoost ensemble model to a simpler, less accurate, but fully interpretable logistic regression model. It feels like a step backward from a pure machine learning perspective, but it can be the only way to move forward in terms of compliance. You have to be able to show your work. There is no other option.
4. "Human-in-the-Loop" Is an Entire Product, Not a Feature.
For any system deemed "high-risk," the Act mandates human oversight. A common first reading is to have a person review a random 10% sample of the AI's outputs. That is wrong. So, so wrong.
Effective human oversight means building an entire workflow, a complete user interface, for a human to meaningfully intervene and override the AI's decision before it has an impact on the end-user. This isn't just a log file someone checks once a week. It's an active, real-time system. Expect to build a whole new internal dashboard, a "Cockpit" of sorts. It shows the AI's recommendation, the confidence score, the top five features that led to the decision, and a big red "OVERRIDE" button.
You may have to hire and train people, not to do the primary task, but to watch the AI do the task, and write a detailed manual on how to handle disagreements. For example, if the AI recommends declining a loan application but the human reviewer thinks it should be approved, the reviewer has to document their reasoning in a structured format, which is then reviewed by a senior manager. It adds a whole new layer of operational complexity and cost. It’s like having a driver’s ed instructor in the car with your self-driving AI, forever. It’s necessary, but you need to budget for it from day one, both in terms of salary and engineering resources.
5. The Technical Documentation Is a Beast of Its Own.
I'm a big believer in documentation. At my last company, RemoteTeam, we lived by our wiki. But the technical documentation required by the AI Act is on another planet. It’s not a README file in a GitHub repo. It’s a 200-page, legally-scrutinized, living document that details every single aspect of your AI system.
The section on risk assessment alone can run dozens of pages. A team has to brainstorm every conceivable way its AI could fail or be misused—from adversarial attacks to perpetuating societal biases—and document its mitigation strategies for each one. It is a soul-crushing exercise in structured paranoia.
It is usually a collaborative effort between a lead engineer, a product manager, and very expensive lawyers billing by the hour. The first version alone can take months. And it’s never “done.” Every time you update a model, tweak an algorithm, or change a data source, the documentation has to be updated. It’s a product in itself, and it requires a dedicated owner to maintain. If you wait until you’re ready to ship to start this, you’ll be looking at a six-month delay, minimum. This isn't an afterthought; it's a prerequisite.
6. Your Supply Chain Is Your Responsibility. No Excuses.
Modern software is built on APIs. A typical AI product uses a number of third-party APIs—one for identity verification, another for enriching user data. It is tempting to think that a solid contract with them means you are covered. The AI Act makes it brutally clear: you are responsible for the compliance of your entire AI supply chain.
That means auditing every single AI-powered service you use. Picture a provider, say a well-known startup that offers a sentiment analysis API, that can't give you the detailed documentation on its training data and model architecture that you need to satisfy your own compliance requirements. Its response is basically, "It's proprietary." That doesn't fly.
Then you have to rip it out of your product, and maybe spend months building your own, less-capable version in-house. It is a painful, expensive decision that can set a product roadmap back significantly. But it may be the only one you can make. If you are building an AI product, you need to think like a car manufacturer. You are responsible for every component. Vet your vendors with the same rigor you vet your employees. Get their compliance documentation upfront. If they can’t provide it, you have to walk away.
7. Compliance Is a Product, Not a Project.
This is the most important lesson of all. Many teams initially treat compliance as a project. It has a start date, an end date, and a budget. They think they can “get compliant” and then move on. That is the biggest and most costly mistake.
Compliance is a feature of your product. It’s a core part of your value proposition, especially in a regulated market. It needs a product manager, a roadmap, and dedicated engineering resources. It needs to be integrated into your sprint planning, your quarterly goals, and your marketing.
The fix is a “Head of AI Trust & Safety.” It sounds like a fancy corporate title, but it’s a critical role. A strong fit is a former data protection lawyer who has retrained as a product manager. The job is to live and breathe the AI Act, to translate its requirements into engineering tickets, and to work with the team to ensure the company is always compliant. That person becomes one of the most important people in the company. It’s a permanent role, and it’s one of the best investments a team can make.
The New Cost of Doing Business
Becoming compliant is one of the hardest things a founder can take on. It is more expensive, more distracting, and more frustrating than most founders could ever imagine. But it is also clarifying. It forces a team to be better engineers, better product managers, and a better company.
The EU AI Act isn’t just a hurdle. It’s the new foundation for building AI in one of the world's largest markets. It’s a challenge, for sure. But it’s also an opportunity. The companies that embrace this new reality, the ones that build trust and safety into the core of their products, are the ones that will win. They will be the ones that earn the trust of their users, their investors, and the market. And in the age of AI, trust isn't just a currency—it's the only thing that matters.
Frequently Asked Questions
Q:Which item on this list has the highest impact?
It depends on your stage and context, but in my experience, the items near the top of the list tend to have the broadest applicability. That said, sometimes the less obvious items create the biggest breakthroughs for specific situations.
Q:How were these items selected?
Each item on this list comes from direct experience, either from building my own companies or from patterns I've observed across the 234 startups I've invested in. I prioritize practical, actionable items over theoretical concepts.
Q:Can I implement all of these at once?
I'd strongly recommend against it. Pick the 2-3 items that resonate most with your current situation and focus there. Trying to do everything simultaneously is a recipe for doing nothing well.