Practical EU AI Act, GDPR, NIS2, and Cyber Resilience Act guides for startups and SMEs. Source-referenced, written for product and operations teams.https://maditon.com/en-gb© Abiton Ventures ABhttps://maditon.com/guides/eu-ai-act-compliance-checklist-for-smes/https://maditon.com/guides/eu-ai-act-compliance-checklist-for-smes/A practical, source-referenced compliance checklist for European startups and SMEs that use or build AI systems. Written for product and operations teams, not lawyers.Fri, 15 May 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI Actcompliance checklistSMEEU AI ActArticle 4Article 27https://maditon.com/guides/is-my-ai-system-high-risk-under-the-eu-ai-act/https://maditon.com/guides/is-my-ai-system-high-risk-under-the-eu-ai-act/A decision tree to classify AI systems under Articles 6 and Annex III of the EU AI Act, with concrete SaaS, HR, finance, and healthcare examples for European SMEs.Tue, 12 May 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI Acthigh-risk AIAnnex IIIArticle 6risk classificationhttps://maditon.com/guides/eu-ai-act-deadlines-2026/https://maditon.com/guides/eu-ai-act-deadlines-2026/The EU AI Act timeline after the Digital Omnibus delay: prohibited practices (Feb 2025), GPAI (Aug 2025), high-risk (Dec 2027), regulated products (Aug 2028).Sun, 10 May 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActdeadlinesEU AI Act timeline2026registrationhttps://maditon.com/guides/article-6-3-d-preparatory-task-explained/https://maditon.com/guides/article-6-3-d-preparatory-task-explained/The EU AI Act's Article 6(3)(d) carve-out lets some AI systems escape high-risk classification by performing a preparatory task. Here's exactly when it applies.Fri, 08 May 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActArticle 6Article 6(3)(d)high-riskpreparatory taskSaaShttps://maditon.com/guides/eu-ai-act-fines-and-penalties/https://maditon.com/guides/eu-ai-act-fines-and-penalties/The EU AI Act's three-tier fine structure: €35M / 7% for prohibited practices, €15M / 3% for high-risk breaches, €7.5M / 1% for misinformation. SME perspective.Thu, 07 May 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActfinespenaltiesArticle 99enforcementhttps://maditon.com/guides/gpai-obligations-eu-ai-act/https://maditon.com/guides/gpai-obligations-eu-ai-act/What the EU AI Act requires of general-purpose AI model providers — and what changes if you fine-tune or significantly modify a GPAI model on the EU market.Wed, 06 May 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActGPAIgeneral-purpose AIArticle 53Article 51foundation modelshttps://maditon.com/guides/annex-iii-high-risk-categories-explained/https://maditon.com/guides/annex-iii-high-risk-categories-explained/The eight Annex III categories of high-risk AI under the EU AI Act, with worked examples in biometrics, employment, credit, education, and infrastructure.Tue, 05 May 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActAnnex IIIhigh-riskuse casesemploymentcredit scoringhttps://maditon.com/guides/ai-literacy-article-4-requirements/https://maditon.com/guides/ai-literacy-article-4-requirements/Article 4 of the EU AI Act requires staff AI literacy from every provider and deployer. What it means in practice, and how to document a programme regulators accept.Mon, 04 May 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActArticle 4AI literacytrainingcompliance programmehttps://maditon.com/guides/how-to-register-high-risk-ai-system-eu-database/https://maditon.com/guides/how-to-register-high-risk-ai-system-eu-database/The EU AI Act Article 49 registration process for high-risk AI systems — what data goes in, who submits it, and what happens after the 2 December 2027 deadline.Wed, 22 Apr 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActArticle 49EU databaseregistrationhigh-riskconformity assessmenthttps://maditon.com/guides/eu-ai-act-vs-iso-42001/https://maditon.com/guides/eu-ai-act-vs-iso-42001/ISO/IEC 42001 is the international AI management system standard. How it differs from the EU AI Act, where the two reinforce each other, and which to start with.Thu, 16 Apr 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActISO 42001AI management systemcompliance frameworkscertificationhttps://maditon.com/guides/transparency-obligations-chatbots-ai-content/https://maditon.com/guides/transparency-obligations-chatbots-ai-content/EU AI Act Article 50 transparency: when you must tell users they're talking to AI, how to label deepfakes, and what counts as adequate disclosure.Tue, 14 Apr 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActArticle 50transparencychatbotsdeepfakesAI-generated contenthttps://maditon.com/guides/eu-ai-act-deployer-obligations-article-26/https://maditon.com/guides/eu-ai-act-deployer-obligations-article-26/Most European companies are deployers, not providers, under the EU AI Act. Article 26 is the practical obligation set: human oversight, logging, transparency.Sun, 12 Apr 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActArticle 26deployertillhandahållarehuman oversighthttps://maditon.com/guides/audit-ready-compliance-dossier-template/https://maditon.com/guides/audit-ready-compliance-dossier-template/What a regulator-ready EU AI Act compliance dossier actually contains — section by section, with the Annex IV mapping for high-risk providers.Fri, 10 Apr 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActdossierAnnex IVtechnical documentationaudittemplatehttps://maditon.com/guides/article-5-prohibited-ai-practices/https://maditon.com/guides/article-5-prohibited-ai-practices/Article 5 of the EU AI Act bans eight specific AI practices outright. Enforceable since February 2025. What's banned, what's allowed, and the narrow exceptions.Mon, 06 Apr 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActArticle 5prohibited practicesbanned AIemotion recognitionhttps://maditon.com/guides/conformity-assessment-high-risk-ai/https://maditon.com/guides/conformity-assessment-high-risk-ai/Article 43 conformity assessment: internal control vs notified body, what gets assessed, and the practical timeline before a high-risk system goes to market.Sat, 04 Apr 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI Actconformity assessmentArticle 43CE markingnotified bodyAnnex VIAnnex VIIhttps://maditon.com/guides/eu-ai-act-for-hr-tech-recruitment/https://maditon.com/guides/eu-ai-act-for-hr-tech-recruitment/Most HR and recruitment AI is high-risk under Annex III point 4. What the EU AI Act requires of ATS, candidate scoring, and performance management tools.Thu, 02 Apr 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI ActHR techrecruitment AIAnnex IIIATScandidate scoringhttps://maditon.com/guides/eu-ai-act-for-fintech-credit-scoring/https://maditon.com/guides/eu-ai-act-for-fintech-credit-scoring/Credit-decisioning, insurance-pricing, and fraud-detection AI under Annex III point 5 — what fintech providers and deployers must do before 2 December 2027.Mon, 30 Mar 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI Actfintechcredit scoringinsuranceAnnex IIIDORAhttps://maditon.com/guides/eu-ai-act-for-healthcare-ai/https://maditon.com/guides/eu-ai-act-for-healthcare-ai/Healthcare AI under the EU AI Act: Annex II medical devices expected from August 2028, Annex III essential services from December 2027, plus the MDR overlap.Sat, 28 Mar 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI Acthealthcare AImedical devicesMDRAnnex IIAnnex IIIhttps://maditon.com/guides/article-14-human-oversight-design/https://maditon.com/guides/article-14-human-oversight-design/Article 14 requires human oversight built into every high-risk AI system. What 'meaningful review' actually means in product design, and patterns that satisfy regulators.Thu, 26 Mar 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI ActArticle 14human oversightUX designaccountabilityhttps://maditon.com/guides/substantial-modification-eu-ai-act/https://maditon.com/guides/substantial-modification-eu-ai-act/Article 43(4) requires a new conformity assessment when an AI system undergoes substantial modification. How to draw the boundary in routine ML retraining.Tue, 24 Mar 2026 00:00:00 GMT2026-05-28T00:00:00.000ZEU AI Actsubstantial modificationArticle 43conformity assessmentretraininghttps://maditon.com/guides/post-market-monitoring-serious-incidents/https://maditon.com/guides/post-market-monitoring-serious-incidents/Articles 72 and 73 of the EU AI Act: how providers must monitor AI systems in the wild, and the 15-day clock for reporting serious incidents to supervisory authorities.Sun, 22 Mar 2026 00:00:00 GMT2026-05-29T00:00:00.000ZEU AI Actpost-market monitoringArticle 72Article 73serious incidentsreporting