7 Things I Learned Building a Compliant AI Under the EU AI Act
Making an AI product fully compliant with the EU AI Act is a long, expensive project for any team that takes it on. It is brutal. There’s no other word for it. As someone who has built and sold companies in Silicon Valley, I’m used to moving fast, breaking things, and asking for forgiveness later. That playbook is officially dead in the age of AI regulation. My entire career has been about speed, about getting to market before the competition, about the "minimum viable product." AI compliance is the "maximum viable process," and it feels like driving with the emergency brake on.
This isn’t some academic exercise. It is real money, real engineering hours, and a real risk to a company’s go-to-market strategy. The EU AI Act isn't just a checklist you hand off to your lawyers; it's a fundamental shift in how you build and operate an AI company. It’s a minefield. I’m sharing the hard-won lessons founders learn in the trenches that you won't find in any legal guide. This is what it really takes to be compliant.
1. Your Legal Team Becomes Your Co-Founder
I’ve always seen legal as a support function. You call them for contracts, for fundraising, for the occasional cease and desist letter. In this new world, an AI company’s lead counsel sits in every single product meeting. Every design sprint. Every engineering stand-up. A founder may talk to her more than to the lead investor. At first, the engineers are skeptical. They see her as a roadblock, the "department of no."
Picture a meeting like this. A team is designing a new feature for predictive analytics in its HR tech product. It has built this beautiful, complex model that can forecast employee churn with incredible accuracy. Everyone is high-fiving. Then the lawyer quietly asks, "What data is the model using to make that prediction?" The answer: tenure, performance reviews, promotion history, even things like the sentiment of internal communications. Her face goes pale. She explains that under the Act, using that kind of data for hiring or promotion—or in this case, predicting churn which could lead to pre-emptive action—could be seen as using biased inputs. The model might inadvertently penalize someone for having a bad week or being a non-native English speaker. It puts the product squarely in the "high-risk" category. Months of work get scrapped. The team is furious. But the lawyer walks them through the specific articles in the Act. She isn’t just saying no; she is explaining the "why" in a language they can understand. That is the turning point. The team realizes she isn’t a roadblock; she is a guardrail, keeping it from driving off a cliff. The feature has to be re-architected from the ground up, focusing only on anonymized, aggregated data. It is painful, but she is right. The cost of re-architecting is a fraction of the potential fines or being barred from the EU market entirely.
2. “High-Risk” Is a Sticker You Can’t Peel Off
The moment your AI is classified as “high-risk” under the Act, your world changes. The list of high-risk applications is long and intentionally broad—hiring, credit scoring, medical diagnostics, critical infrastructure. If you’re anywhere near those, you’re in the hot seat. Teams argue they aren’t. A team can spend a fortune on legal opinions from several firms to make the case that its tool is merely an "assistive" technology, and still lose. The regulators’ view is simple: if your AI provides information that a human uses to make a high-stakes decision about another human, it’s high-risk. Period.
Once you’re labeled high-risk, the compliance burden multiplies by an order of magnitude. It’s not just a little more paperwork. It’s a complete change in your operational reality. Suddenly, you need a full-blown Quality Management System (QMS), something I’d only ever associated with medical device companies. You need rigorous post-market monitoring, meaning you have to track the performance of your models in the real world, constantly checking for drift or degradation. And you need automatic, immutable logging of every single prediction your model makes, along with the data that went into it. It’s like going from running a lemonade stand to running a nuclear power plant overnight. My advice: do everything in your power to design your product to stay out of the high-risk category. If you can’t, be prepared for a world of pain and process. And raise a separate funding round just for compliance.
3. Data Governance Isn’t a Department, It’s a Religion
I used to think of data governance as something for big, boring enterprise companies. It was about databases and access controls. I was wrong. For an AI company, data is everything. And under the EU AI Act, how you collect, label, and use that data is under a microscope. You can
't just have a data lake anymore; you need a data monastery, where every drop is blessed, cataloged, and accounted for.
Expect to build an entirely new system just to document your datasets, an internal library of every dataset you’ve ever touched. For each one, you have to document its provenance: Where did every single piece of training data come from? What were its statistical properties? Was it balanced across different demographics? Do you have explicit, documented consent to use it for this specific purpose? The data annotation and verification tools alone are a real expense. It feels like building a second product just to manage the data for the main product. Picture an engineer spending months doing nothing but tracing the lineage of a dataset acquired two years prior, only to find that the vendor who sold it didn
't have the right to sell it for commercial use. The team has to purge the entire dataset and retrain models from scratch. It is a nightmare. But this is the new reality. Your model is only as compliant as the data it’s trained on. There are no shortcuts.
4. Forget “Move Fast and Break Things.” The New Motto is “Document Everything.”
The startup ethos I grew up with is dead. The EU AI Act demands a level of documentation that is completely alien to most founders. Every decision, every assumption, every test—it all needs to be written down, versioned, and auditable. It’s not about creating bureaucracy for its own sake; it’s about creating a chain of evidence. If something goes wrong, you need to be able to show the regulators that you weren't reckless.
Expect a “Technical Documentation” file that runs to hundreds of pages. It details everything from the mathematical description of the algorithms you use to the hardware you run them on. It includes sections on the foreseeable risks, the steps taken to mitigate them, and the metrics used to measure performance and fairness. It feels like writing a PhD thesis while also trying to ship a product. A practical setup is a combination of Confluence and Jira, with a specific "Compliance" ticket type that has to be linked to every new feature or model update. It is tedious, but it creates an incredible repository of institutional knowledge. When a new engineer joins, you can show them not just what you built, but why you built it that way. That document is your only defense. It’s your proof that you did the work, that you thought through the risks, and that you built your system responsibly. It’s not about slowing down for the sake of it; it’s about being deliberate and accountable.
5. The Cost of Compliance is a Rounding Error Compared to the Cost of Non-Compliance
Yes, compliance is expensive. It’s a lot of money. It could pay for senior engineers for a year. It could fund a massive marketing campaign. But the fines for non-compliance with the EU AI Act are up to €35 million or 7% of global annual turnover, whichever is higher. That’s not a slap on the wrist. That’s an extinction-level event for a startup. Do the math. For a company with $10 million in revenue, that’s a $700,000 fine. For a company with $100 million, it’s $7 million. It’s a number designed to get your attention.
But it’s not just about the fines. It’s about market access. The EU is one of the largest and most lucrative markets in the world, with a GDP of over $17 trillion. Being locked out is a death sentence. The money spent on compliance isn’t a cost; it’s an investment. It is the price of admission to the European market. And as other countries and regions—from California to Canada to Brazil—follow the EU’s lead, it will become the price of admission to the global market. Compliance work can pay dividends in conversations with large enterprise customers in the US, too. They see EU compliance as a proxy for maturity and trustworthiness. It’s a competitive advantage.
6. Your Users Don’t Care About Compliance, They Care About Trust
Here’s the thing: customers rarely ask whether a product is EU AI Act compliant. They don’t care about the specific articles or annexes. They don’t speak the language of regulation. But they do care if they can trust the product. They care if it’s fair. They care if it’s reliable. They care if it’s safe. They ask questions like, "How do I know the AI isn't making biased decisions?" or "What happens if the model gives me a wrong answer?"
All the work that goes into compliance—the data governance, the risk assessments, the transparency logs—has a side effect. It makes the product better. It makes it more robust, more reliable, and more trustworthy. Use compliance as a selling point, but translate it from regulator-speak into customer-speak. Don’t say "We have a robust Quality Management System." Say, "We have a rigorous, 100-point checklist that every model must pass before it touches your data." Don’t say "We are compliant with Article 13 on transparency." Say, "You can click this button right here and see exactly why the AI made the recommendation it did." Show customers the work you’ve done. Prove that you’re not just another black box AI. That builds trust. And trust is the ultimate currency.
7. This Isn’t a One-Time Fix; It’s a New Way of Life
The worst mistake you can make is to think of this as a project you can complete and then forget about. The Act requires continuous monitoring and reporting. Your models will drift. New data will introduce new biases. New risks will emerge. The regulations themselves will evolve. This is not a static target.
Plan on a permanent AI safety and compliance function within the engineering team. It doesn’t need to be a big team—a couple of engineers and a product manager—but it’s their full-time job to monitor the systems, conduct regular audits, and stay on top of the regulatory landscape. They run "compliance sprints" just like product teams run feature sprints. They are constantly testing the models against new fairness metrics and looking for edge cases the team might have missed. It’s a permanent operational cost, just like server hosting or customer support. You have to budget for it, you have to hire for it, and you have to build it into your company culture.
Building a compliant AI is one of the hardest things an entrepreneur can take on. It challenges everything most founders think they know about building a tech company. It forces a team to be slower, more deliberate, and more paranoid. But it also makes the team better. It forces it to be more rigorous, and to build a product that is not just powerful, but also responsible. The age of unregulated, "ask for forgiveness later" AI is over. The future belongs to those who build with discipline and trust from day one. Don't get left behind.
Frequently Asked Questions
Q:How were these items selected?
Each item on this list comes from direct experience, either from building my own companies or from patterns I've observed across the 234 startups I've invested in. I prioritize practical, actionable items over theoretical concepts.
Q:Can I implement all of these at once?
I'd strongly recommend against it. Pick the 2-3 items that resonate most with your current situation and focus there. Trying to do everything simultaneously is a recipe for doing nothing well.
Q:How do I know which items apply to my situation?
Start by honestly assessing where your biggest bottleneck is right now. The items that address that specific constraint will give you the highest return on your time and energy.