Artificial intelligence (AI) is driving the startup economy, with about 65% of United States enterprise software venture capital going to AI startups. In the US and globally, businesses are using AI for everything from automating routine tasks to building entirely new products. While the innovation and breakthroughs are significant, regulation is also needed to govern how AI is developed and used.

The European Union's Artificial Intelligence Act (AI Act) is legislation designed to regulate AI based on the level of risk it poses in the EU. Some US companies might have to follow its regulations to operate in the EU. Below, we'll cover how the AI Act works, when it applies to US startups, and what founders need to know about compliance.

Key takeaways

• The AI Act governs AI use across the 27 EU member states. It aims to make AI systems safe and protect people from harmful AI applications. The law bans social scoring and most uses of AI to detect employees' emotions. It sets the strictest requirements for companies that build or use high-risk AI systems.

• US startups are subject to AI Act regulations when they sell AI products or services in the EU or use their AI output there. The law can apply even if a startup runs its entire business from the US, with no physical offices, employees, or servers in Europe.

• Businesses within the AI Act's scope must ensure their processes and AI systems comply. That can include documenting, monitoring, and disclosing how their systems work. Founders should consult a lawyer to determine which requirements apply to their products, and then build those requirements into their product development and sales plans.

What does the AI Act cover?

The AI Act regulates AI systems according to their risk level, from no or minimal to unacceptable risk. It assigns different obligations to each category, from transparency and labelling requirements to stricter rules for high-risk systems. The regulation aims to support safe, trustworthy AI while protecting health, safety, and fundamental rights.

The law also applies to companies outside the EU when they offer AI systems in the EU or use their systems' output there. The European Parliament and Council adopted the legislation in June 2024. In July 2026, an amendment known as the Digital Omnibus on AI took effect, expanding regulatory supervision and clarifying how penalties apply to smaller enterprises.

Why could a US startup fall under the AI Act?

The AI Act affects businesses worldwide, not just those based in the EU. Any provider that sells or runs an AI system in the EU is subject to the law, including those based in the US and other countries, if their AI systems produce outputs used within the EU. The legislation includes extraterritorial reach to prevent operators from evading the rules by running their AI systems outside the EU while the output is used within the EU.

The AI Act's reach is similar to the EU's privacy law, the General Data Protection Regulation (GDPR). The GDPR also applies to companies in the US and other countries that sell to EU customers or monitor their behaviour.

When does the AI Act apply to a US startup?

A US startup could be subject to the AI Act when it does any of the following:

• Has a presence in the EU: It operates a subsidiary, branch, or other business location there.

• Produces AI-powered products and services for the EU market: US startups that sell AI-powered software-as-a-service (SaaS) to EU customers or who partner with an EU-based distributor to make their products in the EU might fall under the regulation.

• Creates AI outputs used in the EU: This could involve an AI feature that affects people in the EU, such as a tool that screens job candidates or a recommendation engine serving EU users.

A US business's requirements under the AI Act depend in part on the classification of its AI system. AI deployed for hiring, credit scoring, facial recognition, or certain types of insurance pricing is considered high risk and faces more extensive requirements. By contrast, the legislation largely leaves minimal-risk AI applications, such as video games and spam filters, unregulated.

What are the AI Act compliance obligations for US startups?

Requirements depend on how risky a startup's AI system is. US-based ventures building high-risk AI systems might face stricter standards. These can include maintaining technical documentation, keeping activity logs, and providing information about how they use AI. A risk management process might also be necessary.

Companies offering lower-risk AI systems typically face fewer obligations. In some cases, the business might need to label and disclose to users when they're interacting with AI or when content is AI-generated. Businesses whose AI use is classified as lower risk, such as spambots and grammar checkers, generally don't have mandatory obligations under the AI Act.

What can founders do now?

Start by assessing your EU exposure. Identify which countries your users and customers are in and whether any are located in the EU. Consult a lawyer to review your legal risks and create a compliance plan. You can also build the AI Act's requirements into your product development and sales planning.

Review your regulatory exposure periodically as the law develops. EU regulators are still issuing guidance, and enforcement priorities might shift as they apply the rules. For example, the Digital Omnibus legislation added some new prohibitions and postponed the compliance timeline to June 2026.

How do AI Act enforcement and penalties work?

Three bodies enforce the AI Act: national regulators, the European AI Office, and the European Data Protection Supervisor (EDPS). Each EU country has its own agency to oversee AI systems sold or deployed within its borders and set its own penalty rules within the EU's caps. The AI Office oversees companies behind general-purpose AI (GPAI) models and the applications they build on top of them, while the EDPS covers AI used by the EU's own institutions.

Fines are set by the type of violation:

• Prohibited AI practices: Up to €35 million or 7% of global yearly revenue, whichever is more

• High-risk and transparency violations: Up to €15 million or 3%

• Conduct-related fines: Up to €7.5 million or 1% for giving regulators false or incomplete answers

For startups and other small and mid-sized businesses, the fine is capped at the lower of the two figures. A venture with €2 million in revenue that breaks a high-risk rule would face a fine of up to €60,000, not €15 million.

How Stripe Atlas can help

Stripe Atlas handles everything you need to legally launch your company – incorporation, Employer Identification Number (EIN), equity setup, and tax filings – so you can fundraise, open a bank account, and start accepting payments in as little as two working days, from anywhere in the world.

Join 100,000+ startups incorporated using Atlas, including startups backed by top investors like Y Combinator (YC), a16z, and General Catalyst.

Get started in minutes with Atlas

The application takes under 10 minutes. You'll choose your company structure, confirm your name is available, add up to four co-founders, set your equity split, and e-sign. Then Atlas takes it from there, including notifying co-founders to sign their documents electronically.

Banking and payments before your EIN arrives

Atlas files your EIN application automatically after incorporation. You don't have to wait – Atlas enables pre-EIN payments and banking so you can start accepting payments and making transactions right away. US founders with a Social Security number (SSN) are typically eligible for expedited IRS processing.

Automatic 83(b) tax election filing

Atlas files your 83(b) election for you – US and non-US founders alike – with US Postal Service (USPS) certified mail and tracking to reduce personal income taxes. You'll get a signed 83(b) election and proof of filing directly in your Stripe Dashboard, with certified mail confirmation.

World-class company legal documents

Atlas provides all the legal documents you need to start running your company, drafted by Cooley, one of the world's leading venture capital law firms, and stores them directly in your Stripe Dashboard. These documents are designed to help you fundraise immediately and ensure your company is legally protected, covering aspects like ownership structure, equity distribution, and tax compliance.

US$2,500 in Stripe credits, plus US$50K+ in partner discounts

Atlas startups get US$2,500 in Stripe product credits for their first year, plus US$50,000+ in partner discounts on essential tools like AWS, Google, Xero, Perplexity, and more. Delaware registered agent service is also included free for your first year.

Learn more about how Atlas can help you set up your new business quickly and easily and get started today.

FAQs about the AI Act for US startups