The EU AI Act for engineering teams shipping AI features

01The risk tiers, and where most products land

The Act classifies by use case rather than by technology. The same model can be unregulated in one product and high-risk in another - what matters is what decision it influences and who it affects.

02The timeline that is already running

The Act entered into force in August 2024 with staged application. Prohibitions and AI literacy obligations applied from February 2025. General-purpose AI model obligations applied from August 2025. The main body of high-risk obligations applies from August 2026, with an extended deadline into 2027 for certain regulated-product cases.

For most product teams the practical implication is that transparency obligations are current, and if you are anywhere near a high-risk category you should be treating the conformity work as active rather than future.

03Transparency: what applies to nearly everyone

If your product interacts with people using AI, they need to know. This is the obligation most teams will actually encounter, and it is straightforward to satisfy provided it is designed in rather than retrofitted.

Users must be informed they are interacting with an AI system unless it is obvious. Synthetic audio, image, video and text content must be marked as artificially generated in a machine-readable form. Deepfakes require explicit disclosure. Emotion recognition and biometric categorisation require notification of the people subject to them.

• Disclose AI interaction clearly in the interface, not only in terms of service.
• Mark generated content in a machine-readable way, not just visually.
• Keep disclosure visible at the point of interaction.
• Document what your system does and its known limitations.

04If you are high risk, what that actually involves

High-risk obligations are substantial and closer to medical-device style conformity work than to typical software compliance. The engineering-relevant requirements below are the core of it.

The requirement teams find hardest is data governance - being able to describe your training data, assess it for bias, and evidence that assessment. Retrofitting this onto a model trained on loosely documented data is genuinely difficult, which is why it needs deciding before training rather than after.

• A quality management system covering the AI lifecycle.
• Data governance: provenance, representativeness, bias examination.
• Technical documentation sufficient to demonstrate conformity.
• Automatic logging of events over the system's lifetime.
• Human oversight designed in, with genuine ability to intervene.
• Accuracy, robustness and cybersecurity appropriate to the purpose.
• Conformity assessment and registration before market placement.

05Practical steps for a team shipping AI now

Most teams need a classification exercise, some transparency work, and documentation proportionate to the risk. The cost of doing this early is low; the cost of discovering a high-risk classification after launch is not.

• Inventory every AI feature and classify each by use case, not by model.
• Check specifically for employment, credit, education and essential-services adjacency.
• Implement interaction disclosure and content marking now.
• Record training and evaluation data provenance from the start.
• Log model inputs, outputs and human interventions.
• Reassess classification whenever the use case changes - it is the use that determines tier.