What the EU AI Act means for AI software development: everything you need to know

*updated October 2026

AI isn’t just a tool anymore.

AI models are making critical decisions that have a huge impact on people’s careers, finances, and lives.

But without oversight, they’re (too) often biased and unaccountable.

The EU AI Act changes that. It sets strict rules for high-risk AI, mandating transparency, fairness, and human oversight, and parts of it already apply today.

But, how exactly do these rules impact AI software development? And how do you stay compliant?

Here, I’ll break down what the law means for AI software development in the EU and give you tips on how to ensure compliance.

This article is general information, not legal advice. For decisions about a specific product, talk to a lawyer who specializes in EU tech regulation.

What is the EU AI Act?

The EU AI Act is the world’s first comprehensive AI regulation.

Its goal is ensuring AI systems are safe, transparent, and respect fundamental rights.

The EU AI Act affects anyone that develops, deploys, or sells AI systems in the EU, even if they’re not headquartered in Europe. This directly impacts:

• AI developers and providers – Companies that build AI-powered software or offer AI services.
• AI deployers – Businesses that integrate AI into their operations (e.g., banks using AI for credit scoring, hospitals using AI for diagnostics).

Even if you’re building on third-party AI models, e.g. OpenAI APIs, the Act still applies to you. Your obligations depend on your role and on what your product does.

Transparency duties and AI literacy apply well outside high-risk areas. And if you use the model in areas like hiring, credit scoring, or healthcare, the full high-risk rules can land on you.

Or, in other words – the higher the risk, the stricter the rules.

Here’s what Ursula von der Leyen, President of the European Commission, said when EU lawmakers reached political agreement on the Act in December 2023:

Today’s agreement focuses regulation on identifiable risks, provides legal certainty and opens the way for innovation in trustworthy AI. By guaranteeing the safety and fundamental rights of people and businesses, the Act will support the human-centric, transparent and responsible development, deployment and take-up of AI in the EU.

Ursula von der Leyen, President of the European Commission

The EU AI act is a structured legal framework designed to promote AI innovation while also protecting users.

Key dates for the EU AI Act

The Act entered into force on 1 August 2024, but its obligations apply in stages. The Digital Omnibus pushed the high-risk dates back, so here’s the timeline as it stands today:

I wouldn’t read the extra time on high-risk rules as a reason to wait. Use it to get classification, documentation, and data governance right while you still have room to change your architecture.

Why the EU passed the AI Act

The almost exponential growth of AI, while coming with a lot of benefits, has also exposed some deep flaws with AI systems: built-in bias, misinformation, and a lack of accountability.

Some high-profile examples include:

• Amazon’s AI hiring tool: Amazon scrapped a recruiting tool after it showed bias against female candidates.
• Dutch child care benefits scandal: A self-learning algorithm used by the Dutch tax authority falsely accused around 26,000 parents of committing fraud.
• Biased predictive policing tools: Predictive policing tools, trained on racially biased arrest data, reinforced existing biases in policing.
• Deepfakes: AI-generated video, images, and audio of real people have turned up in scams, fake news, and political disinformation.

The EU AI Act directly addresses these risks by requiring better transparency, human oversight, and bias prevention in AI systems. For an easy-to-read version, artificialintelligenceact.eu is useful, but check the Commission’s AI Act page and the Omnibus regulation for the latest changes.

Fines under the EU AI Act

The Act introduces severe fines for violations. In each case, the higher of the two amounts applies:

• Up to 35 million euros or 7% of global annual turnover for using prohibited AI practices (Art. 99(3)).
• Up to 15 million euros or 3% of global annual turnover for breaching operator obligations, including the high-risk requirements and the Art. 50 transparency obligations. This covers providers, authorized representatives, importers, distributors, deployers, and notified bodies (Art. 99(4)).
• Up to 7.5 million euros or 1% of global annual turnover for supplying incorrect, incomplete, or misleading information to notified bodies or national authorities (Art. 99(5)).

For small and medium-sized enterprises (SMEs) and start-ups, the rule flips: the lower of the two amounts applies (Art. 99(6)). The Omnibus extends that relief to small mid-cap companies, too.

GPAI model providers face a separate regime. Since 2 August 2026, the Commission can fine them up to 15 million euros or 3% of global annual turnover (Art. 101).

The EU’s message is clear: AI must be transparent, accountable, and human-centered.

And if you want access to the EU market, you need to follow these rules.

The EU AI Act’s risk classification system

The EU AI Act introduces a risk-based approach to AI regulation. 

The higher the potential negative impact of an AI system, the more compliance requirements it has to meet.

This way, low-risk AI can be developed freely, while high-risk AI has to comply with stricter rules to protect users. 

This classification system is at the core of the EU AI Act.

EU AI Act risk levels: overview

A few notes on the table. The Act itself doesn’t use the label “limited risk,” and the Commission now calls this tier “transparency risk.”
The tier also depends on how you use a system. A chatbot is a transparency-risk system, but a chatbot that screens job applicants can be high-risk.
Recommendation engines usually count as minimal risk under the AI Act. On very large online platforms, though, they’re regulated separately by the Digital Services Act (DSA).
According to the Commission, most AI systems on the EU market are minimal risk.

But the AI features most businesses worry about, like chatbots, content generation, and anything that scores or ranks people, land in the transparency or high-risk tiers.

High-risk AI systems

If your AI system is classified as high-risk, you have to meet strict compliance requirements before you can place it on the market.

High-risk AI systems are those that can significantly impact people’s rights or safety. They need to have:

• Extensive documentation: Technical documentation drawn up before the system is placed on the market (Art. 11, Annex IV).
• Human oversight: People must be able to oversee the system, and step in or override it when needed (Art. 14).
• Bias prevention: Training, validation, and testing data must meet quality criteria and be examined for possible biases (Art. 10).
• Robust security: AI systems must meet accuracy, robustness, and cybersecurity requirements (Art. 15).

High-risk systems also need to be registered in the EU database before they go on the market.

That includes one case people often miss: if you’re a provider and you decide your Annex III system isn’t high-risk under Art. 6(3), you still have to document that assessment and register the system.

Prohibited AI practices

Some AI applications are completely prohibited. The Act bans AI practices that threaten fundamental rights, safety, or democracy. With the Omnibus additions, the Act now lists nine prohibited practices:

• Manipulative or deceptive techniques: AI that distorts people’s behavior in ways that cause significant harm (Art. 5(1)(a)).
• Exploiting vulnerabilities: AI that takes advantage of people’s age, disability, or social or economic situation (Art. 5(1)(b)).
• Social scoring: AI that ranks people based on behavior or personal traits, leading to unjustified or disproportionate treatment. The ban applies to public and private organizations (Art. 5(1)(c)).
• Individual crime prediction: AI that assesses or predicts a person’s risk of committing a crime based solely on profiling or personality traits (Art. 5(1)(d)).
• Untargeted facial image scraping: Building facial recognition databases by scraping images from the internet or CCTV footage (Art. 5(1)(e)).
• Emotion recognition at work and in education: Inferring emotions of employees or students, except for medical or safety reasons (Art. 5(1)(f)).
• Biometric categorization of sensitive traits: Using biometric data to infer things like race, political opinions, or sexual orientation (Art. 5(1)(g)).
• Real-time remote biometric identification for law enforcement: In publicly accessible spaces, with narrow exceptions like searching for victims, preventing imminent threats or terrorist attacks, and locating suspects of serious crimes (Art. 5(1)(h)).
• AI-generated child sexual abuse material and non-consensual intimate content: Systems that generate this material, or sexual content depicting identifiable people without their consent (added by the Omnibus, applies from 2 December 2026).

Almost no one will build a social scoring system. But I can easily see a well-meaning team cross the line by accident.

An HR tool that reads candidates’ emotions from video interviews is emotion recognition in the workplace. A sales flow that uses AI to pressure vulnerable users into purchases can count as manipulation. Check your features against this list early.

How to classify your AI system

If you’re developing AI software, you should classify it early to avoid compliance issues later.

A good tip is if your AI system automates critical decisions, you should assume it’s high-risk and prepare accordingly.

The Commission’s guidelines on high-risk classification under Art. 6 are still in draft form, published in May 2026. They’re worth reading now, even though the final version may change.

For official help, the Commission runs the AI Act Service Desk and Single Information Platform.

The EU AI Act compliance checker on artificialintelligenceact.eu is handy for a first pass, though it predates the Omnibus changes.

You need to take this classification seriously.

Getting it wrong can mean late, expensive rework, a product you can’t sell in the EU, or multimillion-euro fines.

How the EU AI Act impacts AI software development

Next, I’ll break down the key ways the EU AI Act will change AI software development in Europe.

Transparency is now a legal requirement

TTransparency is a core principle of the EU AI Act.

The Act mandates transparency at multiple levels, from AI-generated content to high-risk decision-making systems.

The transparency obligations in Art. 50 have applied since 2 August 2026, and they split into separate duties for providers and deployers:

• Tell people they’re talking to AI: If your system interacts directly with people, you have to inform them they’re interacting with AI, unless it’s obvious from the context (Art. 50(1)).
• Mark synthetic content: Providers of systems that generate images, audio, video, or text must mark outputs in a machine-readable way so they can be detected as AI-generated (Art. 50(2)).
• Disclose deepfakes and AI-written public interest text: Deployers must disclose deepfakes. They must also disclose AI-generated text published to inform the public on matters of public interest, unless a human reviewed it and someone holds editorial responsibility (Art. 50(4)).

If your system was already on the market before 2 August 2026, you have until 2 December 2026 to add the machine-readable marking.

For the “how,” the Commission’s final Code of Practice on marking and labeling AI-generated content (June 2026) is voluntary, but it’s the clearest guide available.

It expects multi-layer marking, e.g. watermarking combined with metadata, rather than a single technique.

For chatbots, I’d include a disclaimer at the start of conversations anyway, e.g. “I’m an AI-powered assistant. Let me know if you’d like to speak with a human.” It costs nothing and removes any doubt about whether it’s “obvious.”

This applies to chatbots, virtual assistants, and other transparency-risk AI applications, not just high-risk systems.

For high-risk AI, transparency also extends to regulators.

If you’re building a high-risk AI product, you’ll need to document:

• How your AI models were designed and trained (including data sources)
• How your AI makes decisions (explainability reports)
• How you monitor for errors and biases

You’ll need to maintain detailed records to prove compliance with the Act.

Data handling and bias mitigation must be built-in

The EU AI Act enforces strict data governance and bias mitigation requirements for high-risk AI systems.

These rules ensure that AI models don’t discriminate, are trained on high-quality data, and provide fair and reliable outputs.

According to Article 10 of the Act, training, validation, and testing datasets for high-risk AI systems must be “relevant, sufficiently representative, and to the best extent possible, free of errors and complete in view of the intended purpose.”

The idea is to maintain transparency in data collection, processing, and governance to prevent bias and discrimination.

This means your AI models have to:

• Be trained on relevant and sufficiently representative datasets to avoid bias
• Use reliable, well-documented data sources
• Be examined for possible biases, with measures to detect, prevent, and reduce them

The Act explicitly requires AI developers to detect and correct biases in their data before they place high-risk AI systems on the market.

After launch, ongoing monitoring comes from other parts of the Act. Providers need a post-market monitoring system (Art. 72), and systems that keep learning after deployment must be designed to reduce biased feedback loops (Art. 15(4)).

The Omnibus also gives you more room to test for bias.

It allows processing sensitive personal data for bias detection beyond high-risk systems, but only where it’s strictly necessary and with safeguards.

Also, all high-risk AI models must be auditable. Regulators can request documentation on how AI systems process data, and you’ll need to hand it over.

In short, the EU AI Act ensures AI systems on the EU market are built on fair, unbiased, and explainable foundations.

And that’s exactly how you should approach AI development, anyway.

Human oversight is mandatory for high-risk AI

The EU AI Act makes human oversight a legal requirement for all high-risk AI systems.

The goal is to ensure humans remain in control and can intervene when necessary. Article 14 puts it like this:

High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which they are in use.

EU AI Act, Article 14

The oversight measures have to be commensurate with the risks, level of autonomy, and context of use. So an AI screening loan applications needs more hands-on oversight than one sorting internal documents.

But, why is this so important?

When used right, AI is highly efficient.

But, if left unchecked, it can also make serious mistakes. Here are a few common issues:

• Automated decisions can be biased, especially when training data is biased
• AI systems don’t always account for real-life nuances
• Over-reliance on AI, i.e. automation bias, can lead to blind trust in flawed outputs

The EU AI Act addresses these issues by ensuring humans can intervene and override AI decisions.

Essentially, it mandates a human-in-the-loop system for high-risk AI applications.

source: Miquido

In practice, this means:

• People assigned to oversight must be able to “disregard, override or reverse the output” of the system (Art. 14(4)(d))
• They must be able to intervene or interrupt the system “through a ‘stop’ button or a similar procedure that allows the system to come to a halt in a safe state” (Art. 14(4)(e))
• Deployers must assign oversight to people with the necessary competence, training, and authority (Art. 26(2))
• For remote biometric identification, a match can’t be acted on until at least two people have verified it (Art. 14(5))

Limits on fully automated decisions about people mostly come from the General Data Protection Regulation (GDPR) (Art. 22), which applies alongside the AI Act.

In short, for high-risk AI, a human must always be able to step in and have the final say.

How to ensure compliance with the EU AI Act

Next, I’ll give you some tips on how to meet these requirements.

Compliance can’t be an afterthought anymore.

The EU AI Act mandates that compliance and risk management must be embedded into every stage of AI development.

According to Article 9, all high-risk AI systems must have a continuous risk management system that runs throughout the AI’s lifecycle.

You’ll have to integrate risk assessments and fairness testing from the first line of code all the way to post-deployment monitoring.

And you’ll need to document everything, too.

Compliance is an ongoing, iterative process, which requires:

• Risk identification and mitigation at every stage
• Regular updates and audits throughout your AI system’s lifecycle
• Post-deployment monitoring to detect new risks

So, the key here is continuous risk evaluation and monitoring.

You’ll have to identify and mitigate common risks before deployment and implement safeguards against known risks.

A good tip to avoid trouble later is to do risk assessments before you even train your AI model(s).

That’s the best way to ensure your AI model functions safely and fairly over time.

Implement AI governance frameworks

Under the EU AI Act, AI governance is a must-have.

You’ll need clear frameworks for compliance, risk management, and ethical AI deployment to stay ahead.

A strong governance framework will help you keep AI development on track and make sure it meets regulatory and ethical standards without slowing innovation down.

But, what exactly does an AI governance framework look like? It should include:

• AI ethics and compliance policies: Defining acceptable AI use and risk thresholds.
• Accountability: Assigning responsibility for AI decisions and failures.
• Risk management: Regularly assessing AI impact and mitigating risks.
• Transparency: Ensuring AI decisions can be explained and audited.
• Bias detection: Implementing ongoing monitoring of AI models for biases in outputs.
• AI literacy: Training the people who build, run, and use your AI systems. The Omnibus softened this duty to taking measures to support AI literacy, but I’d still train everyone who touches the system.

If you’re a high-risk provider, you’ll also need a quality management system (Art. 17). The first harmonized standard under the Act, EN 18286:2026 on AI quality management systems, was published in July 2026. More standards are still in development, so build your processes around this one first.

And keep in mind that AI governance is an organization-wide commitment.

The goal of AI governance is that you stay in control of your AI systems, not just react when something goes wrong.

And with the right framework, you’ll reduce risk and build AI that both users and regulators can trust.

Adopt AI transparency best practices

The EU AI Act mandates strict transparency requirements for AI systems, especially high-risk ones.

AI providers have to clearly document how their models work and ensure users understand AI-driven decisions.

The goal is to ensure that AI decision-making is explainable, traceable, and accountable.

And the best way to get there is to proactively adopt AI transparency best practices and go beyond just the letter of the law. Some of the practices below aren’t legal requirements, but they’ll make compliance much easier.

Here’s what you should do:

• Allow opt-outs: Give users the choice to opt out of AI features and switch to a human wherever you can. The Act doesn’t require this, but it builds trust and gives you a fallback when the AI gets it wrong.
• Train your team to interpret AI outputs: Make sure your team can accurately interpret AI outputs and recognize errors.
• Regularly test AI models for fairness and bias: Unchecked bias is a lawsuit waiting to happen. Regularly test your AI models and training data for potential bias before deployment.
• Be transparent about AI limitations: Overpromising and underdelivering will backfire. Set clear expectations for what your AI can and can’t do from the start.
• Hire external auditors: A second set of eyes is always good. External auditors can spot risks you might’ve missed. This is voluntary for most systems. Most Annex III high-risk systems go through an internal-control conformity assessment (Annex VI), and a notified body is mainly required for some biometric systems and Annex I products.

In a nutshell, the EU AI Act is all about building AI systems that users can trust.

Transparency is how you earn that trust.

Use third-party compliance tools

Many businesses lack the resources to fully manage complex compliance processes in-house.

And that’s where third-party AI compliance tools come in.

These tools will help you meet the EU AI Act’s requirements without breaking the bank.

So, which tools should you use?

You should start with bias detection and model analysis tools to analyze your AI models and their training data, like:

• AI Fairness 360: Open-source toolkit that analyzes datasets for fairness and potential bias.
• Learning Interpretability Tool (LIT): Google PAIR’s open-source tool for visually exploring how models behave on text, image, and tabular data, including large language models (LLMs). It’s the actively maintained successor to Google’s What-If Tool, which is no longer updated.
• Fairlearn: Helps data scientists and AI developers improve the fairness of AI systems.

This way, you’ll prevent bias from affecting your AI model from the start.

Next, you should integrate AI explainability tools and models, like:

• SHAP (SHapley Additive exPlanations): Provides detailed explanations for AI decisions.
• LIME (Local Interpretable Model-agnostic Explanations): Helps users understand how AI models make predictions.
• AIX360: Open-source library with diverse algorithms to help you understand and interpret AI model outputs.

Finally, you should invest in continuous monitoring and MLOps tools like:

• Fiddler AI: An enterprise “AI control plane” for monitoring, guardrails, and governance, including for agentic AI.
• Arize AI: Observability and evaluation for LLMs, agents, and machine learning (ML) models through its Arize AX platform and open-source Phoenix. Dynatrace announced plans to acquire Arize in August 2026.
• Evidently AI: An open-source AI evaluation framework for testing and monitoring LLMs, retrieval-augmented generation (RAG) systems, agents, and ML models.
• MLflow or Weights & Biases: Platforms to track, manage, and compare model experiments and runs in one place, which gives you an audit trail for your documentation.

Using these tools will help you improve accountability and ensure you’re always on top of your AI model’s outputs.

And that’s the best way to avoid regulatory risk.

EU AI Act: FAQs

Need help building compliant AI software?

The EU AI Act already applies in stages, and the high-risk deadlines are coming, even after the Omnibus delay.

If you’re building AI into a product for the EU market, the decisions you make now on data, documentation, and oversight will decide how painful compliance gets later.

Getting it right is an absolute must. And that’s why you need a reliable AI development partner.

Our senior teams have built AI software for regulated fields, like an AI health platform for Supplentia with AI-assisted clinical notes, and we’ve spent more than five years building mobile solutions for leading banks.

We’re ISO 27001 certified, and each team works on one project at a time, so the people building your product know it inside out.

That means we design compliance into your product from the first sprint.