The EU AI Act (Regulation (EU) 2024/1689) sets duties by risk tier and by role. For an engineering team the useful question is simple: which records must exist before this feature ships, and who signs them? This guide covers that question. It is not legal advice; your counsel decides how the law applies to your systems.
Start with an inventory
Every later step reads from a register of AI systems: owner, intended purpose, deployment context, model and vendor, data sources, and who is affected by the output. Without it you cannot classify risk or show what changed between releases.
Know the four tiers
- Prohibited practices (Article 5) — not allowed on the EU market.
- High-risk systems — the use cases in Annex III, and AI in the regulated products of Annex I.
- Transparency duties (Article 50) — for example, telling people they are talking to an AI system, and marking synthetic content.
- Minimal risk — no specific duties beyond general law, though AI literacy (Article 4) applies to providers and deployers.
The dates that matter
- Article 50 transparency duties apply from 2 August 2026.
- Article 50(2) marking of AI-generated content applies from 2 December 2026.
- Annex III high-risk duties apply from 2 December 2027, after the Digital Omnibus on AI.
- Annex I embedded high-risk duties apply from 2 August 2028.
Keep evidence next to the release
For high-risk systems the Act expects technical documentation, record keeping, human oversight, and accuracy and robustness testing. In practice that means a model card, a data protection impact assessment where personal data is involved, an oversight procedure, evaluation results with thresholds, and a record of who approved the release. Store them with the system, not in a shared drive.
Make missing evidence fail the build
A checklist in a wiki drifts. A release gate in CI does not: it reads the current evidence, evaluation scores, data-contract status and approvals, and returns PASS, REVIEW or BLOCKED. A blocked release stops the pipeline until someone fixes the gap.
This article is general information, not legal advice. Your counsel decides how the law applies to your systems.
