Venture Matters
EU AI Act: Implications for the Venture Ecosystem
Welcome to the inaugural edition of Venture Matters, a monthly publication bringing you concise legal insights for the venture capital ecosystem in Germany. In each issue, in cooperation with Deutsche Börse, expert lawyers from Ashurst Perkins Coie (APC) will cover current regulatory, tax, and transactional developments relevant to the venture capital ecosystem. For this inaugural edition our VC fund and investor community chose the EU AI Act as the first regulatory "hot" topic to be featured.
The EU Artificial Intelligence Act (“AI Act”) entered into force on 1 August 2024, marking the world’s first comprehensive horizontal regulation of AI systems. It establishes a risk-based framework with phased implementation. It addresses:
- Prohibited practices (e.g., social scoring, certain biometric systems) since February 2025.
- Obligations for general-purpose AI (GPAI) models since August 2025.
- Transparency obligations since August 2026 – requiring providers of chatbots and synthetic content generators to ensure users know they are interacting with AI or that content is AI-generated, and deployers of emotion recognition or deepfake systems to inform affected persons.
- High-risk systems (use case oriented classification, e.g. for biometrics, critical infrastructure, education, employment): full compliance requirements including conformity assessment are now expected from August 2027.
The AI Act affects any company placing AI systems on the EU market or using AI outputs in the EU – regardless of where the developer is established.
Why it matters/What to look out for:
If you're a VC fund/Investor
- Due diligence on AI classification: Assess whether portfolio companies develop or deploy high-risk AI systems (Annex III covers areas like biometrics, critical infrastructure, employment, credit scoring) or GPAI/foundation models. Classification determines compliance burden and potential liability exposure.
- Warranty and indemnity considerations: Consider AI Act-specific representations in transaction documents – covering conformity assessments, CE marking status (for high-risk systems), technical documentation, and ongoing compliance obligations.
- Valuation and exit impact: Non-compliance risks (fines up to €35m or 7% of global turnover) and the cost of achieving compliance can materially affect valuations. Factor AI Act readiness into pricing and exit timing.
If you're a founder/start-up
- Classify your AI system early: Determine if your system falls under prohibited practices, high-risk categories (e.g., AI in robotics safety components, medical devices, industrial machinery), or GPAI obligations. Classification drives your compliance roadmap.
- Build compliance into product development: High-risk AI requires risk management systems, data governance, technical documentation, human oversight capabilities, and conformity assessments before market placement. Retrofitting is costly – design for compliance from day one.
- GPAI/frontier model obligations: If you develop foundation models or GPAI systems, prepare for transparency requirements, technical documentation, and (for systemic risk models above 10²⁵ FLOPs) additional obligations including model evaluations, adversarial testing, and serious incident reporting.
Top 7 Questions by Deutsche Börse Venture Network:
Deutsche Börse: What counts as “high-risk” AI?
APC: AI systems are high-risk if they are (i) safety components of products covered by EU harmonisation legislation (e.g., machinery, medical devices, toys) or (ii) fall within the use-cases listed in Annex III (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice). A conformity assessment is mandatory before market placement.
Deutsche Börse: What are the obligations for GPAI models?
APC: Providers of General Purpose AI models must maintain technical documentation, provide information to downstream deployers, implement copyright compliance policies, and publish training data summaries. GPAI models with systemic risk (presumed at 10²⁵ FLOPs) face additional requirements: model evaluations, adversarial testing, cybersecurity measures, energy consumption reporting, and serious incident notification to the AI Office.
Deutsche Börse: What are the fines for non-compliance?
APC: Fines scale by violation type: up to €35 million or 7% of global turnover for prohibited practices; up to €15 million or 3% for other AI Act violations; up to €7.5 million or 1.5% for supplying incorrect information. SMEs and start-ups benefit from proportionate caps. Market surveillance authorities may also order withdrawal of non-compliant systems.
Deutsche Börse: Does the AI Act apply to non-EU companies?
APC: Yes. The AI Act applies to providers placing AI systems on the EU market and to deployers located in the EU – regardless of where the provider is established. It also applies where AI system output is used in the EU. Non-EU providers must appoint an EU authorised representative.
Deutsche Börse: What should founders and investors do now?
APC: Conduct an AI system inventory and risk classification. For high-risk systems, begin documenting risk management, data governance, and human oversight measures. Budget for conformity assessments. Include AI Act compliance in due diligence checklists and transaction documentation.
Deutsche Börse: Are there exemptions for start-ups?
APC: The AI Act includes SME-friendly provisions: access to regulatory sandboxes, proportionate fine caps, and simplified compliance pathways. However, the core obligations for high-risk systems and GPAI models apply regardless of company size.
Deutsche Börse: What is the timeline?
APC: The rules on prohibited practices apply since 2 February 2025 and the GPAI model obligations since 2 August 2025. Transparency obligations for other AI systems are in force since 2 August 2026. Providers must ensure users know they are interacting with AI (chatbots) and that content is AI-generated (synthetic media), deployers must inform persons exposed to emotion recognition systems or deepfakes. Following the AI Omnibus, requirements for high-risk AI system requirements will apply from 2 August 2027 (extended from the original August 2026 deadline). Fines apply as each set of obligations comes into force.
If you have any further queries on this topic or suggestions for topics you would like to see featured by us in the next editions, please click here.
Authors: Matthias von Oppen, Partner; Alexander Duisberg, Partner and Dennis Stottmann, Associate.
