Episode Details

Eighty three percent of enterprise buyers now require AI vendors to hold SOC 2 Type II certification before signing a vendor contract in 2026. That number climbs to 91 percent among companies with more than 5,000 employees, and it applies with equal force to a fintech underwriting tool, a hospital diagnostic assistant, and a federal contractor’s chat interface. The EU AI Act adds a second deadline: high risk obligations under Articles 9 through 17 become binding on August 2, 2026, with fines reaching 7 percent of global turnover. A founder who treats these two facts as legal housekeeping, rather than as product requirements on the same list as uptime and latency, will watch a signed term sheet or a signed enterprise contract go to a competitor instead.

Complyance provides the clearest evidence of where capital is moving. The company raised a 20 million dollar Series A led by GV in February 2026 specifically to build AI agents that automate compliance work against HIPAA, ISO, and NIST control lists, the same three standards a hospital system or a bank now asks about before signing anything. Zenskar closed a 15 million dollar Series A the same quarter behind Susquehanna Venture Capital and Bessemer Venture Partners, and LeapXpert raised 180 million dollars from Riverwood Capital to push AI deeper into the recordkeeping layer that broker dealers already depend on. None of these companies sell a better model. They sell proof that a model can be trusted inside a regulated function, and investors are paying for that proof at prices that used to belong to the model itself.

why enterprise buyers stopped accepting promises

Enterprise vendor risk teams read SOC 2 Type II reports the way a litigator reads a deposition transcript: line by line, looking for the gap between what a vendor says and what a vendor can prove. First year SOC 2 Type II spend for an AI startup runs 40,000 to 120,000 dollars and typically takes 6 to 12 months from audit kickoff to a completed report, and 67 percent of startups that finished the process said it directly closed a deal they would otherwise have lost, at a median deal size of 120,000 dollars. ISO/IEC 42001, the first international AI management system standard, published December 2023, has followed the same trajectory: 72 percent of enterprise buyers now screen for it before the first request for proposal round, at a first year certification cost running 85,000 to 650,000 dollars. Neither certification is cheap, and neither is optional once a company is selling into a bank, a hospital system, or a federal agency.

what the eu ai act actually requires by august 2026

The EU AI Act’s high risk provider obligations under Articles 9 through 17 and deployer obligations under Article 26 become binding on August 2, 2026, alongside Article 50 transparency rules, conformity assessments, CE marking, and enforcement power vested in the AI Office. High risk categories include biometric identification, credit scoring, insurance underwriting, employment decisions, and access to essential services, a definition wide enough to capture most fintech underwriting tools and most healthcare diagnostic tools sold into the European market. Maximum fines reach 7 percent of global annual turnover or 35 million euros, whichever is greater, a number calculated against the parent company’s total revenue rather than the revenue of the AI product line alone. The Council of the European Union approved a simplification package on June 29, 2026 that would defer this deadline to December 2, 2027, following European Parliament endorsement on June 16, 2026, but that act had not entered into force at the time of this analysis, and companies selling into Europe should keep building toward August 2026 until the deferral is formally published.

what colorado changed and what it did not

Colorado enacted the first comprehensive state AI statute, SB 24-205, in 2024, requiring deployers whose AI decides a