If you ship anything with a model inside it to European users, the EU AI Act is now part of your job. The good news: for most apps the obligations are light. The bad news: you have to know which bucket you're in, and the buckets are defined by what the system is used for, not by how clever the model is.
This is the developer's version: what to check, in what order.
The basics
- Regulation (EU) 2024/1689, in force since August 2024.
- Applies to providers (who build and place AI on the market) and deployers (who use it professionally), plus importers and distributors.
- Has extraterritorial reach: a US startup whose AI output is used in the EU can be in scope.
The four risk tiers
| Tier | Examples | What it means |
|---|---|---|
| Unacceptable (prohibited) | Social scoring, manipulative techniques that cause harm, untargeted facial-image scraping, emotion recognition at work or school (with exceptions) | Banned |
| High-risk | AI used in hiring, education access, credit scoring, critical infrastructure, law enforcement, and safety components of regulated products | Heavy obligations |
| Limited risk (transparency) | Chatbots, AI-generated or manipulated content, deepfakes | Disclose |
| Minimal risk | Spam filters, recommendation for a to-do app, most internal tools | No specific obligations |
On top of these sits a separate regime for general-purpose AI (GPAI) models, the foundation models themselves.
Step 1: Check you're not doing anything prohibited
Read Article 5. For most product teams this takes ten minutes and the answer is no. Do it anyway and write down that you did.
Step 2: Check the high-risk lists
High-risk comes from two places:
- Annex I: AI that is a safety component of products already covered by EU product law (machinery, medical devices, toys, and so on).
- Annex III: specific use cases, including biometrics, critical infrastructure, education and vocational training, employment and worker management, access to essential services like credit and insurance, law enforcement, migration, and justice.
If your feature screens CVs, scores exams, or decides credit, assume high-risk until a lawyer says otherwise.
If you are high-risk, providers need things like a risk management system, data governance, technical documentation, logging, human oversight, accuracy and robustness measures, a conformity assessment, and registration in an EU database.
Step 3: Transparency duties (this is most of you)
Article 50 is the part most developers will actually implement:
- Tell users they're talking to an AI, unless it's obvious from context.
- Mark AI-generated content (synthetic audio, images, video, text) in a machine-readable way where technically feasible.
- Disclose deepfakes: content that resembles real people, places, or events.
- Disclose emotion recognition or biometric categorisation to the people exposed to it.
In practice that means a clear "AI assistant" label in your chat UI, provenance metadata on generated images, and a policy for what your app generates. For an image app like HairOver, the generated-image marking is the relevant part.
Step 4: If you build on a foundation model
If you call a GPAI model via API, the GPAI obligations mostly sit with the model provider. You are usually the provider of your system and still own the transparency duties above.
If you fine-tune or substantially modify a model and release it, read the GPAI rules carefully. The line between "using" and "becoming a provider" is where teams get caught.
Key dates
The Act applies in stages. As originally adopted:
| Date | What applies |
|---|---|
| 2 Feb 2025 | Prohibitions and AI literacy duties |
| 2 Aug 2025 | GPAI model obligations, governance, penalties |
| 2 Aug 2026 | Most remaining obligations, including Annex III high-risk and transparency |
| 2 Aug 2027 | High-risk systems under Annex I (product safety) |
A practical checklist for small teams
- Write a one-page AI inventory: every feature that uses a model, what it does, who uses the output.
- Classify each against Article 5, Annex III, and Article 50.
- Add AI disclosure to chat UIs and generated content.
- Log inputs, outputs, and model versions. You'll want this for debugging anyway (see Evals and Observability).
- Make sure your team has basic AI literacy. A short internal doc counts as a start.
- Revisit when you add a feature that touches hiring, education, credit, or health.