The AI startup compliance map: UK GDPR, the EU AI Act and ISO 42001 on one page

The ten questions enterprise buyers now ask AI vendors

1. 1

   Which AI systems run in your product and what data do they touch?

   Keep an AI system register: every model, API and tool, with data touched and owner.

2. 2

   Are you a provider or a deployer under the EU AI Act, and for which systems?

   Provider: you build or brand the system; deployer: you use someone else's system in your product or operations, and you can be both.

3. 3

   Which risk tier, and on what basis?

   The Act has four risk levels: unacceptable (banned), high (Annex I and III), limited (transparency duties) and minimal.

4. 4

   Do you keep an AI system register and an AI risk register?

   The register comes first, then an AI policy, risk register and named owner.

5. 5

   Who is accountable for AI governance, by name?

   Buyers expect a named owner for the AI policy and risk register.

6. 6

   Do you use customer data to train or fine tune models?

   Under UK GDPR you need a lawful basis per purpose for training and inference data.

7. 7

   How are model outputs monitored, and who reviews them?

   Buyers ask this inside enterprise security reviews of AI startups, so name the reviewer and the method in writing.

8. 8

   Which third-party models and APIs sit underneath, and under what terms?

   Hold processor terms with every model and hosting supplier, and have your sub-processor list ready.

9. 9

   How do users know they are interacting with AI?

   Limited-risk systems carry transparency duties, and general application, including transparency rules, starts on 2 Aug 2026.

10. 10

    Are you working towards ISO 42001, and what evidence can you show today?

    ISO/IEC 42001 is the certifiable AI management system standard, and certification is issued by an accredited certification body, never by your consultant.

Questions 1, 5 and 7 follow the pattern safet.com reports in enterprise security reviews of AI startups; the rest follow the Act's own provider and deployer duties.