Episode Details

Artificial intelligence regulation imposes no intellectual property obligations on most startup founders, and its data security duties arrive first through the Cyber Resilience Act reporting deadline of September 11, 2026. Two of the three European regimes founders ask about do not reach them at all. The Digital Markets Act, Regulation (EU) 2022/1925, binds only companies the European Commission designates as gatekeepers, which under Article 3 requires annual Union turnover of at least EUR 7.5 billion, about 8.71 billion US Dollars, in each of the last three financial years, or a market value of at least EUR 75 billion, about 87.1 billion US Dollars, together with 45 million monthly active end users and 10,000 yearly active business users in the Union. The Digital Services Act, Regulation (EU) 2022/2065, reaches intermediary services that transmit or host information supplied by others, and its Article 19 exempts micro and small enterprises from the online platform obligations even where a company is otherwise in scope.

That leaves the AI Act, Regulation (EU) 2024/1689, and the chapter founders were bracing for moved. Regulation (EU) 2026/1744, published in the Official Journal on July 24, 2026 and in force since July 27, 2026, deferred the Chapter III high risk requirements from August 2, 2026 to December 2, 2027 for standalone systems listed in Annex III, and to August 2, 2028 for artificial intelligence embedded as a safety component in regulated products. What binds a founder today is the prohibition list in Article 5, the transparency and marking duties in Article 50, and, for anyone training or substantially fine tuning a general purpose model, the copyright policy and training data summary duties in Article 53. Article 99, paragraph 6 caps fines for small and medium enterprises at the lower of the stated percentage or the stated amount, which is the most useful sentence in the statute for a company under 50 people.

The enforceable intellectual property rules come from United States case law and agency guidance, not from European regulation. The enforceable data security rules come from the Cyber Resilience Act, the NIS2 Directive, and Article 32 of the General Data Protection Regulation. At seed stage the compliance spend is security attestation, and the AI attributable portion is close to zero.

Detailed Findings

Which AI regulations actually apply to a startup right now

Three European regulations get named in founder conversations, and only the AI Act currently creates a duty for a company under 50 employees. The prohibitions in Article 5 of Regulation (EU) 2024/1689 have applied since February 2, 2025, and Regulation (EU) 2026/1744 added two more, covering artificial intelligence that generates child sexual abuse material or non consensual intimate imagery, with a transition period running to December 2, 2026.

The Article 50 transparency duties began applying on August 2, 2026. A provider whose system generates synthetic audio, image, video, or text must mark the output in a machine readable format detectable as artificially generated. A deployer of an emotion recognition system or a biometric categorisation system must inform the people exposed to it. A deployer who publishes deepfake content must disclose that it is artificially generated. Systems already on the market before August 2, 2026 received a grace period to December 2, 2026 for the marking requirement.

Article 4 was softened. Providers and deployers must now take measures to support the development of sufficient artificial intelligence literacy among staff. The original text required them to ensure it. That change matters because it lowers the evidentiary burden on a small company that cannot fund a training program.

The penalty structure sets the risk. Article 99, paragraph 3 sets a ceiling of EUR 35 million, about 40.7 million US Dollars, or 7 percent of worldwide annual turnover for a prohibited practic