Technical and financial due diligence on AI startups is well established. Investors look at the team, the technology, the market and the numbers. Regulatory due diligence, by contrast, is often limited to a GDPR questionnaire and a standard representation that the company “complies with applicable law”.

That is no longer enough. The AI Act already prohibits certain practices and imposes obligations on providers of general-purpose AI models. Most obligations for high-risk systems will apply from 2 December 2027, within the life of a typical investment. The Data Act, the Cyber Resilience Act and the new Product Liability Directive add requirements of their own. For an AI company, these rules can determine:

• which markets it can sell to;
• how much it will cost to bring its product into compliance;
• whether its most valuable asset, the model, was built on data it was entitled to use.

A regulatory problem discovered after closing becomes the investor’s problem. Discovered before, it becomes a negotiating point, a condition precedent or a milestone in the post-investment roadmap. The checks below are the ones that matter most.

What to check

1. The company’s role under the AI Act. The same startup can be a provider, a deployer or both, and the obligations differ sharply between the two roles. A company that fine-tunes a third-party model and sells the result under its own name is usually a provider. A company that only uses AI internally is a deployer. The role should be assessed product by product, not for the company as a whole.

2. The risk class of each product. The AI Act sorts products into risk classes, each with its own date of application:

• Prohibited practices, such as emotion recognition in the workplace and the untargeted scraping of facial images, have been banned since February 2025.
• High-risk systems used in recruitment, credit scoring, education, essential services or biometrics will be subject to obligations from 2 December 2027.
• AI embedded in regulated products, such as medical devices, will follow from August 2028.
• Chatbots and AI-generated content have been subject to transparency obligations since August 2026.

Classification depends on the intended purpose and on how customers actually use the product. A general-purpose tool marketed to HR departments may turn out to be a high-risk system.

3. General-purpose AI models. If the startup trains general-purpose models and places them on the market, obligations have applied since August 2025: technical documentation, information for downstream providers, a copyright policy and a public summary of the training content. If the startup builds on someone else’s model, the question is what documentation and contractual guarantees it has received from the model provider.

4. Training data and the GDPR. Personal data in training sets need a lawful basis. In its Opinion 28/2024, the European Data Protection Board made clear that a model trained on personal data is not automatically anonymous. It also stated that unlawful training can affect the lawfulness of the model’s later use. Enforcement is still developing. The Italian Garante fined OpenAI EUR 15 million in December 2024, but the Tribunale di Roma annulled the fine in March 2026. Uncertainty of this kind is itself a risk to be priced. Investors should ask for data provenance records, data protection impact assessments and the licences under which datasets were obtained.

5. Copyright and licences. Text and data mining is permitted under EU law, but rightsholders can opt out. Dataset licences may exclude commercial use, and some “open” models come with licences that restrict it. The ownership of outputs and the terms offered to customers should also be reviewed.

6. The Data Act, for connected products. If the startup makes connected products or provides related services, products placed on the market after 12 September 2026 must be designed so that users can access the data they generate. A business model that relies on exclusive control of device data may be weaker than it looks.

7. Cybersecurity and product liability. Software sold as a product falls under the Cyber Resilience Act. Its reporting obligations have applied since September 2026, and its essential requirements will apply from December 2027. The new Product Liability Directive treats software, including AI, as a product when it is placed on the market after 8 December 2026. NIS2 and DORA usually reach a startup indirectly, through the requirements its regulated customers impose on their suppliers.

8. Sector rules and governance. Medical device, financial, employment and consumer rules may apply on top. Basic governance also tells a story:

• who is responsible for compliance;
• whether the company has taken AI literacy measures, which the Digital Omnibus has turned into a best-efforts obligation;
• whether documentation exists or would have to be rebuilt.

Red flags

Some findings deserve particular attention:

• Prohibited purpose: a product whose intended purpose falls within a prohibited practice, or close to one, may have to be withdrawn or redesigned.
• No compliance plan: a high-risk product without a plan faces significant costs before December 2027, and customers will start asking about compliance well before then.
• Data of unclear origin: training data whose origin is unclear, especially personal data scraped from the web, can expose the company to orders that affect the model itself.
• Gaps that are costly to fix later: licences that exclude commercial use, missing documentation and the absence of anyone responsible for compliance are common.

Penalties matter too, although they are rarely the main risk. Under the AI Act, fines reach EUR 35 million or 7% of worldwide annual turnover for prohibited practices, and EUR 15 million or 3% for most other obligations. For SMEs and start-ups, the lower of the two amounts applies, and the Digital Omnibus has extended the tailored penalty caps to small mid-caps. The commercial consequences of non-compliance are usually larger than the fine: lost customers, blocked tenders and forced redesigns.

How to use the findings

Regulatory due diligence is not only a way to say no. Its findings feed directly into the deal:

• specific representations on data, licences and AI Act classification;
• indemnities for identified risks;
• conditions to be met before closing;
• a compliance roadmap with milestones after the investment.

In a companion article we look at how regulation affects valuation and which contractual tools work best.

For investors, the practical question is not whether a startup is fully compliant today; few are. It is whether its regulatory risks are known, priced and manageable within the time and budget of the investment.

At Data Valley Consulting, our Regulatory Intelligence service offers a preliminary Regulatory Check within 48 hours, combining AI-powered analysis with review by legal experts, followed by ongoing support where needed.

‍