The EU AI Act Is Here: A Practical Guide for Product Teams

The EU AI Act, the world's first comprehensive AI regulation, is no longer on the horizon. It's here. With the first prohibitions active since February 2025, and broader obligations rolling out through 2026 and 2027, product teams can no longer treat AI compliance as a future concern.

This guide breaks down the regulation into practical, actionable steps for teams building or integrating AI features.

What the AI Act Covers

The regulation applies to any organisation that places on the market, puts into service, or uses AI systems within the EU, regardless of where the provider is based. If your product serves EU users and includes AI features, you are in scope.

Key definitions:

• AI system: A machine-based system that generates outputs such as predictions, recommendations, decisions, or content
• Provider: The entity that develops an AI system or has one developed and places it on the market
• Deployer: The entity that uses an AI system under its authority (i.e. most SaaS customers)

The Risk Classification Framework

The AI Act uses a four-tier risk framework. Understanding where your AI features sit is the essential first step.

Unacceptable Risk (Prohibited, Active Since Feb 2025)

These AI practices are banned outright:

• Social scoring by public authorities
• Real-time biometric identification in public spaces (with narrow exceptions)
• Emotion recognition in workplaces and educational institutions
• Manipulative techniques that exploit vulnerabilities or subvert decision-making
• Untargeted facial image scraping from the internet or CCTV

High Risk

AI systems that significantly affect health, safety, or fundamental rights:

• Biometric identification and categorisation
• Critical infrastructure management (energy, water, transport)
• Education and vocational training (exam scoring, admissions)
• Employment (CV screening, interview evaluation, task allocation)
• Essential services access (credit scoring, insurance pricing)
• Law enforcement and border control
• Legal interpretation and judiciary assistance

Obligations: Conformity assessments, risk management systems, data governance, technical documentation, transparency, human oversight, accuracy and robustness testing.

Limited Risk

AI systems with specific transparency obligations:

• Chatbots: Must disclose that the user is interacting with AI
• Deepfakes / synthetic content: Must be labelled as artificially generated
• Emotion recognition / biometric categorisation: Users must be informed

Minimal Risk

Most AI applications fall here: recommendation engines, spam filters, AI-assisted search, content generation tools. No specific obligations beyond general EU law, though voluntary codes of practice are encouraged.

Practical Steps for Product Teams

Step 1: Audit Your AI Features

Create an inventory of every AI-powered feature in your product:

• What does it do? (classification, generation, prediction, recommendation)
• What data does it process? (personal data, sensitive categories, public data)
• Who is affected by its outputs? (employees, consumers, vulnerable groups)
• What decisions does it influence? (informational, advisory, automated)

Step 2: Classify Each Feature by Risk Level

Map each AI feature to the Act's risk tiers. Be conservative: if a feature sits near a boundary, classify it at the higher tier. Pay special attention to:

• Features involving personal data of EU residents
• Features that influence access to services (insurance, credit, employment)
• Features involving biometric data of any kind

Step 3: Implement Transparency Requirements

Even for minimal-risk AI, good practice (and limited-risk obligations) demands:

• Disclosure: Tell users when they're interacting with AI
• Labelling: Mark AI-generated content as such
• Explainability: Provide meaningful information about how AI features work
• Opt-out: Where feasible, let users choose non-AI alternatives

Step 4: Build Your Documentation

For high-risk systems, the AI Act requires extensive technical documentation:

1. System description: Purpose, intended use, limitations
2. Risk assessment: Identified risks and mitigation measures
3. Data governance: Training data sources, quality measures, bias testing
4. Performance metrics: Accuracy, robustness, cybersecurity measures
5. Human oversight: How humans can intervene, override, or shut down the system
6. Post-market monitoring: Ongoing performance tracking and incident reporting

Step 5: Establish Human Oversight

High-risk AI systems must include meaningful human oversight:

• Humans must be able to understand the system's capabilities and limitations
• Humans must be able to correctly interpret outputs
• Humans must be able to override or reverse the system's decisions
• A stop mechanism must be available

Timeline: What's Due When

• February 2025: Prohibited AI practices banned ✅
• August 2025: Codes of practice for general-purpose AI
• August 2026: Full obligations for high-risk AI systems, general-purpose AI rules apply
• August 2027: Rules for AI systems embedded in regulated products (medical devices, machinery, etc.)

Impact on AI Provider Selection

The AI Act creates a new dimension for vendor evaluation. When choosing AI providers, product teams should ask:

• Where is inference performed? EU-hosted inference simplifies compliance
• Is training data governance documented? Providers must be transparent about data sources
• Can you access model documentation? Needed for your own compliance documentation
• Is there a human override mechanism? Required for high-risk applications
• Does the provider offer an AI Act compliance package? Forward-thinking providers already do

Why EU AI Providers Have an Advantage

European AI providers are building compliance into their architecture from day one:

• Mistral AI (France) offers open-weight models that can be self-hosted on EU infrastructure
• Aleph Alpha (Germany) provides enterprise AI with full sovereignty and compliance guarantees
• DeepL (Germany) offers translation AI with EU data processing and no training on customer data

Choosing EU-based AI providers reduces your compliance burden, ensures data stays under EU jurisdiction, and aligns with the Act's emphasis on transparency and accountability.

Common Pitfalls to Avoid

1. "We just use an API": Deployers have obligations too. Using OpenAI's API doesn't exempt you from transparency or risk assessment requirements
2. "It's just a recommendation": If your AI influences decisions about employment, credit, or service access, it may be high-risk regardless of whether the final decision is automated
3. "We'll deal with it in 2027": Prohibited practices are already banned, and high-risk obligations arrive in August 2026. Documentation and processes take time to build
4. "Our US provider handles compliance": The AI Act applies to deployers in the EU. You cannot outsource your compliance obligations

Getting Started Today

The most impactful thing you can do right now:

1. Complete your AI feature audit: You can't classify what you haven't inventoried
2. Add AI disclosure to your product: Transparency is low-effort, high-value
3. Start documenting: Even informal documentation now saves significant effort later
4. Evaluate your AI providers: Ask the hard questions about data governance and hosting
5. Join industry working groups: The codes of practice are still being shaped

The EU AI Act is the beginning of a global trend toward AI regulation. Product teams that build compliance into their processes now won't just satisfy European regulators. They'll be prepared for whatever comes next.