EU AI Act Compliance for Shipping Teams: The 2026 Playbook

If you ship AI to EU users, the EU AI Act sorts your system into one of four risk tiers – unacceptable, high, limited, or minimal – and that classification decides everything you owe. The obligations that catch most product teams, Article 50 transparency labeling and general-purpose AI (GPAI) documentation, become applicable on 2 August 2026; GPAI provider duties have already been live since 2 August 2025. The Act is extraterritorial like GDPR, so a US or UK team whose output reaches the EU is in scope regardless of where its servers sit.

This matters because the penalties are not symbolic. According to Article 99 of the EU AI Act, 2024, deploying a prohibited AI practice can draw administrative fines of up to €35 million or 7% of total worldwide annual turnover, whichever is higher for a company. That makes AI classification a board-level decision, not a legal footnote – and the good news is that for most teams, compliance is a scoping exercise you can finish in days if you start before launch instead of after.

What are the four EU AI Act risk tiers?

The Act is risk-based: the heavier your system's potential to harm people's rights or safety, the heavier the obligations. Almost every product AI feature lands in the limited or minimal tier, but you cannot know that until you classify each feature deliberately. Here is the full map:

The single most valuable artifact you can produce this month is a one-page classification: list every AI feature, its intended purpose, and its tier. That document drives your entire obligation set, takes an afternoon, and is the thing an auditor, an enterprise buyer, or your own legal counsel will ask for first.

Are you a provider or a deployer – and why does it matter?

The Act splits duties by role, and most teams misjudge which one they are. A provider develops an AI system, or a GPAI model, and places it on the market under its own name. A deployer uses an AI system under its authority in a professional setting. If you build a product on top of a foundation model from OpenAI or Anthropic, you are a deployer of that model but a provider of the application you wrap around it – and the moment you fine-tune or substantially modify a system, you can become its provider, inheriting the full provider obligation set.

This distinction is where the biggest compliance surprises hide. Deployers of high-risk systems are not exempt: they must ensure human oversight, use the system according to its instructions, control the input data they feed it, keep logs, and monitor operation. Providers carry the far heavier load of conformity assessment, technical documentation, and post-market monitoring. Write down, per feature, which role you hold and against which model – because the answer changes your work by an order of magnitude, and it is not always the role you assumed.

What do the GPAI obligations require, and who do they hit?

General-purpose AI model obligations became applicable on 2 August 2025, a full year ahead of the main transparency rules. If you train or substantially fine-tune a general-purpose model, you are a GPAI provider and owe technical documentation, a summary of training-data sources, a copyright compliance policy, and information passed downstream to teams building on your model. Models designated as carrying systemic risk face additional model-evaluation and incident-reporting duties.

For the vast majority of product teams, this is inherited rather than original work: you consume a GPAI model, you do not build one. Your job is to confirm your model provider publishes the documentation you need to meet your own downstream obligations, and to keep that paperwork on file. If you are fine-tuning open-weights models heavily enough to shift their capabilities, revisit whether you have crossed into provider territory – a judgment call worth making with counsel rather than assuming.

What actually lands on 2 August 2026?

2 August 2026 is when the bulk of the Act becomes applicable, and two things bite product teams directly. First, the Article 50 transparency obligations: you must tell users when they are interacting with an AI system, label AI-generated or manipulated content such as deepfakes, and mark synthetic audio, image, and video as artificially generated in a machine-readable format. Second, the high-risk requirements for systems listed in Annex III come into force in full.

For a limited-risk product – which is where most chatbots, support agents, and generative features sit – meeting the transparency bar is genuinely modest engineering: a clear "you are chatting with an AI" disclosure and a content-labeling layer. Scoped into the build, that is a few days of work. Discovered the week before an enterprise security review, it is a scramble that stalls the deal. The date is fixed and public; the only variable is whether you plan for it or react to it.

What does a practical readiness checklist look like?

You do not need a compliance department to get this right – you need a disciplined sequence. Run these steps in order:

1. Inventory and classify. List every AI feature, its purpose, and its risk tier. Flag anything touching recruitment, credit, essential services, or biometrics for high-risk review immediately.

2. Assign roles. For each feature, record whether you are provider or deployer, and against which model. Note any fine-tuning that could reclassify you.

3. Build the transparency layer. Add AI-interaction disclosure and machine-readable labeling of synthetic content. This is your Article 50 baseline and applies to nearly everyone.

4. Document GPAI provenance. Keep on file the documentation your model provider publishes, so your downstream obligations are covered by paper you can produce on request.

5. If anything is high-risk, start the real program. Risk management, data governance, human oversight, logging, and technical documentation are a multi-week effort with legal review, not an afterthought. This overlaps heavily with the controls in our enterprise AI security checklist and with the structure in our AI governance framework for enterprises, so build them together rather than as separate initiatives.

The economics favor doing this during the build. A focused AI MVP runs roughly $50k–150k over a 30–45 day window, and folding classification, a transparency layer, and documentation into that scope adds days, not weeks. Retrofitting the same controls after launch – once the architecture has hardened and enterprise buyers are already asking – routinely turns into its own remediation project that can rival the cost of a new feature ($15k–50k) and delays revenue while you rebuild.

Compliance is not a tax on shipping AI to Europe; it is a design constraint you either honor early or pay for late. Classify your system, assign your roles, ship the transparency layer, and reserve the heavy program for the genuinely high-risk features that warrant it. If you want a partner who scopes the AI Act into the build instead of tacking it on at the end, see how we ship production AI on our services page – regulatory readiness included, not invoiced later.