[ MSP.DD ] For investors and founders · Updated
How does the EU AI Act affect due diligence on AI companies?
Short answer
It adds a regulatory check to every AI deal: which risk class each product falls in, which obligations already apply and which are coming. Prohibited practices have applied since 2 February 2025 and the rules for general-purpose AI models since 2 August 2025. Fines for prohibited practices go up to €35 million or 7% of worldwide turnover.
Why it matters
A product in a high-risk area with no compliance plan is unpriced work for the buyer, and in the worst case a product that can't be sold in the EU as it stands.
How to check
- 01Classify each AI system: prohibited, high-risk (Annex I or III), transparency obligations, or minimal risk.
- 02Identify the company's role for each system: provider, deployer, importer or distributor.
- 03Check which dates apply to each obligation.
- 04Check the documentation the Act requires for that risk class, or the plan to produce it.
- 05Price the remaining compliance work into the deal.
Red flags
- A product in an Annex III area, such as recruitment or credit scoring, with no compliance plan.
- No inventory of the AI systems in use.
- Marketing claims that contradict the risk classification.
Good signs
- An AI system inventory with risk classes.
- A named owner for AI Act compliance.