You ship the models the first AI regulation was written for.

AI startups get regulated from two directions at once. Customers ask for the familiar things, SOC 2 and GDPR answers, before they send data to your models. And if your system lands in the EU AI Act's high-risk scope, the Act adds duties that are engineering artifacts, not policies: record-keeping over the system's lifetime, governance over the data that trained it. Both kinds of duty change in pull requests, often in the fast-moving pipeline code an AI team refactors weekly.

The Act's duties live in your pipeline

What the AI Act asks of a high-risk system reads like a code review checklist: keep automatic logs of the system's events (Art. 12), govern the data that goes into training (Art. 10). Those properties erode the same way test coverage does, one convenient deletion at a time. heygrc is built to read each change against the frameworks you selected and cite the article or control it touches, so the trace you will need for a conformity assessment does not quietly disappear in a cleanup PR.

It does not classify your system's risk tier or run your conformity assessment, and whether the Act applies to you is your own assessment. It catches the diffs that erode the record either way, which the SOC 2 and GDPR lenses want too.