Trust

The EU AI Act
for AI deployers.

Most organisations deploying AI in the EU are not building regulated high-risk systems. But the ones who are usually do not realise it until late, and the obligations are expensive to retrofit.

Last reviewed: September 2026
Not legal advice

Last reviewed 4 September 2026 · Engineering guidance, not legal advice.

All Trust & Security →

A note on this page

SCOPE AND LIMITS

This is an engineering summary, not legal advice, and the Act is being phased in with guidance still emerging. Treat it as a guide to what to ask your counsel, and check the date above — regulatory pages that are not dated are not trustworthy. For a binding assessment of your obligations, speak to a qualified lawyer.

The risk tiers

Prohibited

A small set of practices banned outright — including social scoring (by public and private actors alike), certain biometric categorisation, emotion inference in workplaces and education, and manipulative techniques exploiting vulnerability. If a proposed system is near this line, that is a stop, not a compliance exercise.

High risk

Systems used in employment decisions, education access, essential public and private services including creditworthiness, law enforcement, migration, and safety components of regulated products. Substantial obligations: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, and conformity assessment.

Limited risk — transparency

Systems interacting with people, generating synthetic content, or performing emotion recognition must disclose that fact. Practically: label your chatbot as a chatbot and mark AI-generated media. Low cost, and easy to overlook.

Minimal risk

Everything else — the large majority of business AI. No specific obligations under the Act, though GDPR and sector rules still apply in full. Most internal productivity and automation systems land here.

The part people miss

Deployers have obligations, not just providers.

Many organisations assume the Act applies to whoever built the model. If you deploy a high-risk system, you carry duties of your own: use it in accordance with instructions, ensure input data is relevant and representative, assign competent human oversight with authority to intervene, monitor operation, and retain logs.
Recruitment is the common surprise.

AI used to screen CVs or rank candidates is listed as high-risk in Annex III. A great many companies have quietly adopted such tooling without recognising which tier it sits in.
Credit and insurance decisioning too.

Creditworthiness assessment for individuals, and risk assessment and pricing in life and health insurance, are explicitly listed.
GPAI obligations are separate.

General-purpose model providers carry their own duties around documentation, copyright policy and training-data summaries. If you fine-tune and distribute a model, consider whether you have become a provider yourself.
Timelines are staged.

The Act entered into force on 1 August 2024. The prohibited practices applied from 2 February 2025 and the GPAI obligations from 2 August 2025. Most Annex III high-risk obligations and the Article 50 transparency obligations were scheduled for 2 August 2026, with Annex I product-embedded systems following on 2 August 2027. In late 2025 the Commission proposed, in its digital omnibus package, delaying some of the high-risk deadlines, so the timetable should be checked against the Official Journal and confirmed with counsel at the time you read this. Anything you are building now with a multi-year life should be designed for the end state rather than the current one — retrofitting logging and human-oversight mechanisms is considerably more expensive than including them.

What this means for a build

Classify first

Determine the tier during discovery, not after. It changes the architecture — high-risk obligations around logging and oversight are structural, not features you enable later.

Log by construction

High-risk systems must record operation over their lifetime. Building traceability in from the start costs little; adding it to a live system is a project.

Oversight that is real

A named human able to interpret output, override it and stop the system — with the authority and the time to do so. A rubber-stamp reviewer does not satisfy the requirement.

Questions

Questions about The EU AI Act.

Does the AI Act apply to us if we are outside the EU?

It can. The Act has extraterritorial reach comparable to GDPR: it applies where an AI system is placed on the EU market, or where its output is used within the EU. A US company whose system produces output used in the EU may well be in scope. This is exactly the question to put to counsel rather than assume away.

Is a customer support chatbot high-risk?

Generally no — a support assistant answering product questions is typically in the transparency tier, meaning users must be told they are interacting with an AI. It moves up a tier if it makes or materially influences decisions about access to essential services. The distinction is what the system decides, not how sophisticated it is.

What if we fine-tune an open model?

You may take on provider obligations, depending on what you do with it. Fine-tuning for internal use is generally different from placing a modified model on the market. The line is genuinely unclear in places and guidance is still developing — worth a specific legal view rather than a general answer.

How do you help with this?

On the engineering side: classifying systems during discovery, building the logging and traceability that high-risk obligations require, implementing meaningful human oversight, and producing the technical documentation. We are engineers, not a law firm — we work alongside your counsel, who determines what applies, and we make sure the system can satisfy it.