EU AI Act for software teams
How the EU AI Act sorts AI systems by risk, what providers and deployers must do in each tier, and when each part applies.
What EU AI Act is
Regulation (EU) 2024/1689, the Artificial Intelligence Act
The EU AI Act, Regulation (EU) 2024/1689, is the EU's law on artificial intelligence. It entered into force on 1 August 2024 and applies in stages until 2027.
It is risk-based. A short list of practices is banned. High-risk systems, such as AI used in hiring, credit scoring or medical devices, carry the heaviest duties. Some systems, such as chatbots and AI-generated content, carry transparency duties. Most other AI has no new duties beyond AI literacy. General-purpose AI models have their own rules.
Duties depend on your role. The provider develops an AI system and places it on the market under its own name. The deployer uses an AI system in its work. A company that builds AI into its own product is usually the provider of that system, even if it uses someone else's model.
Who it applies to
Providers
Anyone who places an AI system on the EU market or puts it into service in the EU, wherever they are based.
Deployers
Organisations in the EU that use an AI system in their work, such as a bank using a vendor's credit model.
Non-EU companies whose AI output is used in the EU
Providers and deployers outside the EU are covered when the system's output is used in the EU.
AI used only for military or national security purposes, for scientific research and development alone, or by people for purely personal use is outside the Act. Classification is per use, not per model: the same model can be minimal risk in one product and high-risk in another.
Key requirements, and what they mean for the build
Each row links the official text. Read the source for the exact wording before you rely on it.
AI literacy
Providers and deployers make sure their staff who work with AI have enough understanding of it.
Short internal guidance for each AI feature: what it does, where it fails and when to escalate.
Prohibited practices
Bans manipulative techniques that cause harm, social scoring, untargeted scraping of face images, emotion recognition at work and school (with narrow exceptions) and other listed practices.
Screen every AI feature against the list at design time, and record why it does not fall under it.
High-risk classification
AI in listed areas is high-risk: biometrics, critical infrastructure, education, employment, access to essential services (including credit scoring and life and health insurance pricing), law enforcement, migration and justice. AI in products under EU safety law, such as medical devices, is too.
Keep a register of AI features with their intended purpose and risk tier, and review it when a feature's use changes.
Risk management and data governance
High-risk providers run a risk management system across the life of the system, and use training, validation and test data that are relevant, representative and examined for bias.
Versioned datasets with their source recorded, evaluation sets that cover the groups the system affects, and a risk log per release.
Technical documentation and logging
High-risk systems have technical documentation (Annex IV) and automatically record events over their lifetime.
Log each decision with its inputs, model version, output and reviewer, and generate documentation from the same model registry.
Transparency to deployers and human oversight
Clear instructions for use, and design that lets people understand, monitor, override or stop the system.
A review screen that shows the reasons behind an output, lets the reviewer change it and records why.
Accuracy, robustness and cybersecurity
High-risk systems reach declared accuracy levels and resist errors, misuse and attacks.
Evaluation gates before release, monitoring for drift after, and defences against prompt injection and data poisoning.
Deployer duties
Deployers of high-risk AI use it as instructed, assign human oversight, monitor it, and keep its logs for at least six months. Public bodies, and deployers doing credit scoring or life and health insurance pricing, assess the impact on fundamental rights first.
Give deployers the logs, controls and documentation they need to meet their own duties.
Transparency for chatbots and generated content
Tell people when they are talking to an AI, mark AI-generated content in a machine-readable way, and disclose deepfakes.
An AI disclosure in the interface, and markers or metadata on generated images, audio, video and text.
General-purpose models and penalties
Providers of general-purpose AI models keep documentation and a copyright policy. Fines reach up to EUR 35 million or 7% of worldwide turnover for prohibited practices.
If you build on a third-party model, keep its documentation and terms with your own technical file.
Engineering controls for EU AI Act
How the rules change the way the software is designed.
- 01
AI feature register
Every AI feature with its purpose, its users, the people it affects, its risk tier and the reason for that tier.
- 02
Decision logging
Inputs, model and prompt version, output, confidence and the human reviewer for each decision, kept for the required period.
- 03
Human review step
For decisions about people, a reviewer sees the reasons, can change the outcome and records why. The system never acts alone.
- 04
Evaluation and release gates
Fixed test sets, scored on every model or prompt change, with a release blocked when quality drops.
- 05
Data lineage
Where training, fine-tuning and retrieval data came from, under what terms, and what was checked for bias.
- 06
AI disclosure
Users are told when they deal with an AI, and generated content is labelled.
- 07
Deployer pack
Instructions for use, known limits and the logs a deploying customer needs to meet its own duties.
- 08
Incident path
A way for users and staff to report harmful outputs, and a process to investigate, fix and report serious incidents.
Key dates
- 1 August 2024The Act entered into force.
- 2 February 2025Prohibited practices and AI literacy duties apply.
- 2 August 2025Rules for general-purpose AI models, governance and penalties apply.
- 2 August 2026Most remaining rules apply, including Annex III high-risk systems and Article 50 transparency.
- 2 August 2027High-risk rules for AI in products covered by EU safety law (Annex I) apply.
These are the dates in the Act as published. In November 2025 the European Commission proposed moving some high-risk dates later as part of a "digital omnibus" package. Check the current timetable on the Commission's page before planning around them.
Checked against the official sources on 2026-10-25.
16 OceanLab product builds cite EU AI Act
Counted from our published case studies: a build counts when EU AI Act is in the list of rules it was built for.
Kaganek - RAG Knowledge Assistant with Citations and Permissions Intact
Designed and built a clickable internal knowledge assistant for a Kraków consulting engineering firm: staff ask in Polish or English and get answers built only from the firm's own SharePoint, Confluence, Google Drive and file share documents, with every claim linked to its source passage and an honest "I don't know" when the sources are weak.
Kittiwake - AI Claims Intake with a Person Behind Every Decision
Designed and built a clickable claims intake console for a UK motor and home insurer: AI reads the customer's story and photos, extracts the facts, drafts a damage estimate and suggests a triage route with its reasons, while a named person confirms cover, routes the claim and makes every call that could go against the customer.
Sonde - LLM Evaluation and Observability Platform with Release Gates
Designed and built a clickable LLM evaluation and observability platform for the AI team of a French health mutual: redacted production traces span by span, release gates that block a prompt or model change when quality regresses, alerts with owners and ageing, and the monitoring record its risk and compliance teams can show a supervisor.
Tallyman - Intelligent Document Processing for Trade and Customs Documents
Designed and built a clickable document processing platform for a Rotterdam freight forwarder and customs representative: it classifies commercial invoices, packing lists, bills of lading, air waybills and certificates of origin, extracts each field with a confidence score, checks it against business rules and sends only the uncertain fields to a person in a side-by-side review workspace.
Brázda - Applicant Tracking System for High-Volume Hourly Hiring
Designed and built a clickable applicant tracking system for a Bratislava retail and logistics group that hires about 3,500 store, warehouse and driver staff a year: a hiring dashboard, jobs with pay ranges on every posting, a per-job pipeline board with no ranking or AI sort, candidate profiles with consent and retention, and a knockout review where a person confirms every rejection.
Keelson - Performance and OKR Platform with the Works Agreement Built In
Designed and built a clickable performance platform for a 520-person Berlin SaaS company with a works council: OKRs on an alignment tree with weekly check-ins, a manager review workspace with an AI summary the manager must edit before submitting, and calibration on a 9-box with a reason logged for every change.
Every build that cites EU AI Act
- Atalaya - Radiology workflow
- Baqueano - Sales call analyser
- Brázda - Applicant tracking system
- Busola - Skills assessment
- Kaganek - RAG knowledge assistant
- Keelson - Performance & OKRs
- Kittiwake - AI claims intake
- Latu - Wearable data dashboard
- Leitstern - AI symptom checker
- Lichtung - AI journaling app
- Lukturis - AI knowledge search
- Pour - AI sommelier
- Qissa - AI video editor
- Sonde - AI evaluation dashboard
- Tallyman - Document processing (IDP)
- Tekmė - Workflow automation builder
Check your product
Other frameworks and industries
Build with EU AI Act in mind from day one
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
EU AI Act questions
Does the EU AI Act apply to our chatbot?
Most chatbots are not high-risk, but Article 50 still requires telling people they are talking to an AI unless it is obvious. If the chatbot makes or shapes decisions in a high-risk area, such as hiring or credit, the high-risk rules can apply too.
Is credit scoring high-risk?
Yes. AI used to assess the creditworthiness of people or set their credit score is listed in Annex III. AI used only to detect financial fraud is excluded from that entry.
We build on a third-party model. Are we a general-purpose AI provider?
Usually not. The model's maker carries the general-purpose model duties. You are normally the provider of the AI system you build on it, so the duties for your system's risk tier are yours.
How does the AI Act relate to the GDPR?
They apply side by side. The GDPR covers personal data used by the system, including rights around automated decisions. The AI Act covers the AI system itself: its risk tier, documentation, oversight and transparency.
