EU AI Act is already shifting products
Compliance work for the EU AI Act is driving product and audit changes at US startups — a regulatory reality that’s influencing architecture and vendor choices right now reported. Startups with EU exposure are factoring security, logging, and auditability into vendor selection.
The EU AI Act’s milestones have moved from lawmaking into enforcement: the first prohibitions took effect on 2 Feb 2025, general‑purpose AI obligations came into application on 2 Aug 2025, and the stricter high‑risk regime becomes fully applicable by Aug 2026. (dig.watch) Article 12 of the Act now requires automatic, lifetime record‑keeping (logs) for high‑risk systems, forcing engineering teams to add persistent, queryable event trails and versioned model provenance to production stacks. (artificialintelligenceact.eu) Brussels has also published model contractual clauses and procurement guidance that public buyers updated in 2025, which procurement and legal teams are reusing in private RFPs to demand audit rights, documentation, and conformance evidence from AI vendors. (public-buyers-community.ec.europa.eu) Enterprise buyers are tightening vendor checklists: mid‑market and enterprise RFPs increasingly require SOC 2 Type II and AI‑specific disclosures, and SaaS risk guides now list model provenance, logging, and operational controls as mandatory pre‑sale items. (docket.io) That demand is already shaping architecture: startups are adopting hybrid or on‑prem deployments plus AI control planes to keep raw data and tamper‑resistant logs in their control, while orchestration and governance tools (and acquisitions in that space) are being prioritized. (devpoint.org) Cloud custom silicon remains a competitive alternative—AWS and Google report growing Trainium/TPU usage among labs and startups—so vendor selection is now a tradeoff between cloud price/performance and the on‑prem/hybrid stacks that make Article 12 compliance, auditability, and data residency simpler to prove. (aws.amazon.com)
