AI Compliance for Startups in 2026: GDPR, the EU AI Act, and What You Actually Have to Do
You do not need a legal team to ship compliant AI. You need six controls, documented once, and honestly maintained.
Most AI compliance work is not legal work. It is engineering hygiene written down, and the startups that lose enterprise deals lose them on documentation, not on architecture.
Know which tier you are in
The EU AI Act sorts systems by risk. The overwhelming majority of startup features are minimal or limited risk, which means transparency duties: tell users they are interacting with AI, label synthetic content, and document what the system does. High-risk obligations apply to things like employment screening, credit decisions, and biometric identification — if you are in one of those, the burden is materially heavier and you should get specialist advice early.
The six controls that cover most of it
- Data map. One table: what personal data enters the AI path, which provider processes it, where it is stored, how long it is kept.
- DPAs and sub-processors. Signed agreements with every model provider, plus a public sub-processor list. Enterprise buyers ask for this in the first email.
- No-training guarantees. Use the enterprise or API tier that contractually excludes your data from training, and cite the clause in your own docs.
- Retention limits. Prompt and completion logs are personal data if they contain user content. Set a retention window (30–90 days is common), enforce it with a scheduled job, and prove it.
- Human oversight. Any decision affecting a person needs a documented review path and an appeal route.
- Audit logging. Who accessed what, when. Immutable, queryable, retained for at least a year.
Rights requests, in practice
Deletion is the one that bites AI products. If a user's content sits in a vector index, deletion must remove the embeddings too — build that path before you need it, because retrofitting deletion across an index is painful.
Residency
EU-only customers increasingly demand EU inference. Most major providers offer regional endpoints; pick the region at the config layer so you can flip it per tenant instead of forking your stack.
What enterprise buyers actually check
- Sub-processor list and DPA availability
- Training-data exclusion clause
- Retention and deletion policy with a real timeframe
- Encryption at rest and in transit
- Access controls and offboarding process
- Incident response contact and SLA
Publish a one-page trust summary covering these. It shortens security review by weeks and costs you an afternoon.
This is general information, not legal advice. Get counsel before shipping into a high-risk category.
FAQ
Frequently asked questions
Do I need to disclose that a feature uses AI?+
Yes, for user-facing conversational and generative features under EU transparency rules — and it is good practice everywhere.
Can I send customer data to OpenAI or Anthropic?+
Under a signed DPA on an API or enterprise tier with training exclusion, yes for most use cases. Special-category data needs a stricter assessment.
Is SOC 2 required?+
Not legally, but it is effectively required to sell to mid-market and enterprise. Type I in three months, Type II after a six to twelve month observation window.
How long can I keep prompt logs?+
Only as long as you need them for a stated purpose. Thirty to ninety days with automated deletion is the common default.
Building something similar?
Let's talk in 30 minutes.