In a startup investment, regulation is usually treated as a box to tick: a section of the due diligence report, a few representations in the investment agreement, a clause on compliance with applicable law. For companies that build on data and AI, this underestimates what is at stake.

Several sets of rules now affect what a company can sell, to whom, at what cost and with what risk:

• the AI Act;
• the GDPR;
• the Data Act;
• the new rules on cybersecurity and product liability.

These rules can open markets, for instance when a startup is among the first to offer a compliant solution in a high-risk sector. They can also close them, when a product cannot be brought into line without a redesign. Either way, they affect value.

This article looks at how regulation enters valuation, and at the contractual tools investors and founders can use to deal with it.

Four ways regulation affects value

Compliance debt. Like technical debt, compliance debt is the cost of work that has not yet been done but will have to be: documentation, risk management, data governance, conformity assessment and transparency measures. The deadlines now fall within a typical investment horizon:

• AI Act: a high-risk AI system must be compliant by 2 December 2027, or by 2 August 2028 if it is a safety component of a regulated product, under the timeline set by the Digital Omnibus.
• Cyber Resilience Act: the main obligations apply from 11 December 2027, and reporting obligations have applied since September 2026.

If this work is not reflected in the business plan, the plan overstates future margins.

Market access. Regulated customers increasingly ask suppliers to demonstrate compliance before signing. These include banks, insurers, hospitals, public bodies and large manufacturers. A startup that cannot answer an AI Act, NIS2 or DORA questionnaire may lose tenders and renewals, however good its technology. A company that can demonstrate compliance early has an advantage that competitors will need time to match.

The model as an asset at risk. For many AI companies, the most valuable asset is a trained model. If the data used to train it were collected unlawfully or in breach of licences, that asset may be impaired. European data protection authorities have already ordered the deletion of unlawfully collected data. In the United States, the Federal Trade Commission has gone further and required companies to delete the models and algorithms built on such data. In its Opinion 28/2024, the European Data Protection Board stated that unlawful processing in the development phase can affect the lawfulness of the model’s later use. A valuation that assumes the model can be freely used and licensed should therefore be tested against its data history.

Exposure to sanctions and liability. Fines under the AI Act reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices. For SMEs and start-ups, the lower of the two amounts applies. Further exposure comes from three sources:

• fines under the GDPR;
• liability under the new Product Liability Directive, which covers software and applies to products placed on the market after 8 December 2026;
• contractual claims from customers.

These risks rarely sink a company on their own, but they shape its risk profile and the cost of insurance.

Contractual tools that work

Once regulatory risks have been identified, they can be priced and allocated. The tools are familiar from any investment, but they work better when they are specific.

Targeted representations. A generic statement of compliance with “applicable law” offers little protection. Representations should address the points that matter:

• the AI Act classification of each product;
• the absence of prohibited practices;
• the lawful origin of training data;
• compliance with dataset and model licences;
• the existence of data protection impact assessments;
• the absence of pending investigations.

Specific indemnities. Where due diligence reveals a concrete risk, such as a dataset of doubtful origin or an open complaint, a specific indemnity is more effective than general warranties. Warranty and indemnity insurance usually excludes known issues.

Conditions precedent. Some problems should be resolved before the money arrives, for example:

• removing a prohibited feature;
• regularising a licence;
• appointing a person responsible for compliance.

Post-closing covenants and a compliance roadmap. Some risks take time to address, such as preparing a high-risk system for December 2027. For these, the investment agreement can include a roadmap with milestones, budget and reporting to the board, and tranches of funding can be linked to its progress.

Valuation adjustments. Where compliance requires significant investment, its cost can be reflected directly in the price or in the allocation of the use of proceeds.

The founder’s perspective

For founders, the same logic works in reverse. A startup should arrive at a funding round with four things already in order: its AI Act classification, data provenance, licences and documentation. This shortens due diligence, reduces the number of special clauses and strengthens the founders’ negotiating position. Compliance is not only a cost: it is evidence that the company knows its market.

For both sides, the practical question is the same: what would it cost to bring this company into line, and who will bear that cost?

Our Regulatory Intelligence service supports investors and startups with a preliminary Regulatory Check within 48 hours and ongoing assessment of the regulatory roadmap.

‍