The EU AI Act for Software Teams: What Changes in Practice
Short answer
For most software teams, the EU AI Act changes three things: you must know whether you are a provider or a deployer of each AI system, classify each use case by risk, and meet transparency duties such as telling users they are interacting with AI. Only high-risk systems trigger heavy obligations like risk management, technical documentation, logging and human oversight.
The EU AI Act (Regulation (EU) 2024/1689) entered into force on August 1, 2024 and applies in stages. As of November 2026, prohibited practices, AI literacy duties and obligations for general-purpose AI model providers already apply, and the bulk of the remaining rules phase in from August 2026 onward. This article translates the regulation into engineering terms: which role your team plays, what the risk class means for your backlog, and what to build. It is a practical orientation, not legal advice.
Five terms every developer should know
- AI system: a machine-based system that infers from input how to generate outputs such as predictions, content, recommendations or decisions, with some degree of autonomy. Most LLM features qualify; classic rule-based software usually does not.
- Provider: whoever develops an AI system (or has it developed) and places it on the market or puts it into service under their own name. If you ship a product with an AI feature to customers, you are likely the provider of that system.
- Deployer: an organization using an AI system under its authority in a professional context. A company using an AI tool internally is a deployer.
- General-purpose AI (GPAI) model: a model like those behind ChatGPT, Claude or Gemini. Obligations for the model itself sit with the model provider, not with you as an API customer.
- Substantial modification: changing a system in a way that affects compliance or its intended purpose. A deployer that substantially modifies a high-risk system, or rebrands it, can become its provider.
Classify first: the four risk buckets
| Category | Examples | What it means for engineering |
|---|---|---|
| Prohibited | Social scoring, manipulative techniques causing significant harm, untargeted scraping of facial images, emotion recognition at work or in education (with narrow exceptions) | Do not build. Applies since February 2, 2025. |
| High-risk | AI in recruitment and employee management, credit scoring, access to education, essential public services, certain critical infrastructure; AI as a safety component of regulated products | Full compliance program: risk management, data governance, documentation, logging, human oversight, accuracy and robustness, conformity assessment |
| Transparency obligations | Chatbots, generators of synthetic audio, image, video or text, deepfakes, emotion recognition and biometric categorization | Disclosure to users and, for generators, machine-readable marking of outputs |
| Minimal risk | Spam filters, code assistants, most internal productivity tools | No specific AI Act obligations beyond AI literacy; voluntary codes encouraged |
Classification is per use case, not per model. The same LLM can power a minimal-risk writing assistant and a high-risk CV screening tool. Record each classification with a short justification in your repository or product documentation.
The timeline that matters for your roadmap
- February 2, 2025: prohibitions and the AI literacy requirement apply.
- August 2, 2025: obligations for providers of general-purpose AI models apply, along with governance and penalty provisions.
- August 2, 2026: most remaining provisions, including transparency duties and the requirements for high-risk systems listed in Annex III.
- August 2, 2027: rules for high-risk AI embedded in products covered by existing EU product legislation (Annex I).
The EU institutions have discussed postponing parts of the high-risk timeline as part of a broader simplification package. Check the current official status before you plan a release around a specific date, rather than relying on any article, including this one.
What to build if your system is high-risk
High-risk requirements map surprisingly well onto good engineering practice. Turn them into backlog items:
- Risk management process: a living document of foreseeable risks, mitigations and test results, updated each release.
- Data governance: documented provenance, representativeness checks and bias examination for training, validation and test data.
- Technical documentation: architecture, intended purpose, limitations, performance metrics and the evaluation method, kept current.
- Automatic logging: event logs that make the system's operation traceable over its lifetime.
- Human oversight by design: UI that lets an operator understand outputs, override them and stop the system.
- Accuracy, robustness, cybersecurity: declared accuracy metrics, regression tests, protection against manipulation such as prompt injection and data poisoning.
- Quality management system and conformity assessment before placing the system on the market, plus registration in the EU database where required.
What almost every team must do anyway
Even if nothing you build is high-risk, these tasks apply to many teams:
- Tell users when they talk to AI. A chatbot must make clear it is an AI system unless that is obvious from the context.
- Mark generated content. Providers of systems that generate synthetic content need to make outputs detectable as AI-generated in a machine-readable way where technically feasible. Watch the related standards and codes of practice.
- Document AI literacy measures. Training for staff who build or operate AI systems, appropriate to their role. Engineering-focused trainings such as those from neooutput can be part of that record.
- Keep an AI inventory. List every AI system you provide or deploy, its purpose, risk class and owner. This is also the foundation for GDPR documentation; see our GDPR checklist for AI product teams.
- Review supplier contracts. Ask AI vendors how they meet their own obligations and what documentation they provide to you as deployer.
Where governance tooling helps
Once an organization runs more than a handful of AI workflows, spreadsheets stop working as an inventory. Central orchestration with built-in logging, role-based permissions and approval steps produces much of the evidence the AI Act asks for as a by-product of normal operation. kalAIDoCreate follows this approach for enterprises and public bodies, combining governed AI workflows with senior advisory on European trusted AI. For the rollout side, see our roadmap for enterprise AI agents and, for coding tools specifically, the security risks of agentic coding.
If you are unsure how to classify a specific product, you can book a free intro call to talk it through before involving legal counsel.
Frequently asked questions
Does using the OpenAI or Anthropic API make my company a GPAI model provider?
Generally no. Obligations for general-purpose AI models apply to the companies that develop and place those models on the market. As an API customer building an application, you are typically the provider or deployer of your own AI system.
Are AI coding assistants regulated under the EU AI Act?
Code assistants used for software development usually fall into the minimal-risk category, so no specific obligations apply beyond AI literacy. The software you build with them may be regulated depending on its own purpose.
What are the penalties under the EU AI Act?
Fines are tiered. The highest tier, for prohibited practices, reaches up to 35 million euros or 7 percent of worldwide annual turnover, whichever is higher. Lower tiers apply to other violations.
Does the EU AI Act apply to companies outside the EU?
Yes, if they place AI systems on the EU market or if the output of their AI system is used in the EU. Non-EU providers of high-risk systems must also appoint an authorized representative in the EU.
Want a second opinion on your project?
Book a free 30-minute call with our team. We look at your idea, prototype or app and tell you honestly which route makes sense – whether you work with us or not.
Book a free call or write to [email protected]