EU AI Act Starter Pack — Transparency, Deployer Notices, and AI Literacy

Yes, if your AI system is placed on the EU market, used in the EU, or produces output used in the EU. The Act applies extraterritorially under Article 2. A US SaaS company with EU users, a Canadian startup selling to EU enterprises, and a UK company exporting AI-generated content into the EU are all in scope. Templates that only address US disclosure laws (NY AI Disclosure Law, Colorado AI Act, California AB 2013) will not cover your EU exposure. The Grecta starter pack is built for companies in scope of the EU Act regardless of where they're headquartered.

The Act entered into force on 1 August 2024 with a staged application timeline. Article 4 (AI literacy) and Article 5 (prohibited practices) became enforceable on 2 February 2025. GPAI obligations under Chapter V began applying on 2 August 2025. High-risk system obligations under Annex III apply from 2 August 2026. High-risk obligations under Annex I (product safety legislation) apply from 2 August 2027. The "August 2026" framing common in 2025 marketing materials is misleading — substantial parts of the Act have been enforceable for over a year.

A provider develops an AI system or has it developed and places it on the EU market under its own name or trademark. A deployer uses an AI system under its authority in a professional capacity. The same company can be both, for different systems. A company that fine-tunes a GPAI model or substantially modifies an AI system can become a provider under Article 25 even if it originally deployed someone else's system. The provider obligation set is heavier, but Article 26 imposes substantial obligations on deployers of high-risk systems that most founders underestimate.

Article 50 imposes four distinct transparency obligations. Providers of AI systems that interact directly with natural persons must disclose the AI nature of the interaction. Providers of AI systems generating synthetic audio, image, video, or text content must mark outputs as artificially generated in a machine-readable format. Deployers of emotion recognition or biometric categorisation systems must inform exposed natural persons. Deployers generating deep fakes or AI-generated text on matters of public interest must disclose the artificial nature of the content. Which obligation applies depends on your role and the system's function — the trigger map in Template 1 of the Grecta pack walks through this in one page.

Article 4 has been enforceable since 2 February 2025. It requires providers and deployers to ensure a sufficient level of AI literacy among staff and others operating AI systems on their behalf, taking into account their technical knowledge, experience, education, training, and the context in which the systems will be used. National competent authorities in EU Member States have been designated through 2025–2026 and have Article 4 within their mandate. The obligation is principles-based rather than prescriptive, but evidence of a structured training programme with attendance records is the practical compliance artefact regulators and procurement teams ask for.

For specific obligations that are template-shaped — Article 50 notices, Article 26 deployer notices, Article 4 training outlines, DDQ responses — well-built templates are a legitimate starting point. For obligations that are not template-shaped — Annex IV technical documentation, Article 17 quality management systems, Article 27 fundamental rights impact assessments, Article 43 conformity assessments, Article 72 post-market monitoring — templates alone are insufficient. Any pack that claims to deliver "complete EU AI Act compliance" through PDFs is misrepresenting what the Act requires.

The AI Act does not replace existing frameworks — it layers on top of them. GDPR continues to govern personal data processing within AI systems; Article 22 (automated decision-making) overlaps with Articles 26 and 50 of the AI Act on deployer notices. DORA Article 6 (ICT risk management) applies in parallel for financial-sector entities deploying AI systems. ISO/IEC 42001 (AI management system standard) is not mandatory under the AI Act but is the most direct route to demonstrating Article 17 quality management system compliance through certification. Procurement DDQs in 2026 routinely ask about all four frameworks together — Template 4 of the Grecta pack addresses the crossover questions directly.

Article 99 sets penalties at up to €35 million or 7% of worldwide annual turnover for prohibited practices under Article 5, up to €15 million or 3% of turnover for most other infringements, and up to €7.5 million or 1.5% of turnover for supplying incorrect information to authorities. For SMEs and startups, the lower of the two figures applies. Enforcement is delegated to national competent authorities in each Member State, with the AI Office coordinating GPAI enforcement at EU level. As of mid-2026, no major enforcement actions have been publicly announced, but Member State authorities have entered the operational phase of their mandates.