The EU AI Act Is Live: A Technical Compliance Roadmap for Product Teams

The EU AI Act is no longer a draft regulation on a slide deck. Its tiered requirements are now applying to systems across healthcare, financial services, recruitment, and critical infrastructure. If you're shipping AI in or to Europe, compliance is an engineering problem — not just a legal one.

The Risk Tier Framework: What Actually Applies to You

The Act defines four risk tiers. Most enterprise AI systems will land in the 'high-risk' category — meaning they're subject to mandatory conformity assessments, technical documentation requirements, and human oversight mechanisms. The definition is broader than most teams expect.

• Unacceptable risk: banned entirely — social scoring, subliminal manipulation, real-time biometric surveillance in public spaces
• High risk: mandatory compliance — AI in hiring, credit decisions, medical devices, critical infrastructure, law enforcement
• Limited risk: transparency obligations — chatbots must identify as AI; deepfakes must be labelled
• Minimal risk: no obligations — spam filters, AI in video games, recommendation systems without personalisation

What High-Risk Compliance Actually Requires You to Build

If your system is high-risk, you need to implement six concrete technical requirements — not policies, but working systems:

• Risk management system: documented and maintained throughout the AI system's lifecycle
• Data governance: training data must meet quality criteria; dataset bias must be assessed and mitigated
• Technical documentation: model architecture, training procedures, performance metrics — in a format regulators can audit
• Logging and record-keeping: automatic logs sufficient to enable post-hoc review of any consequential decision
• Human oversight mechanisms: technical measures enabling users to understand, monitor, and override AI outputs
• Accuracy, robustness, and cybersecurity: documented testing across input variations and adversarial conditions

The Conformity Assessment Process

For most high-risk AI systems, self-assessment is permitted — you don't need a third-party auditor. But self-assessment requires genuine documentation, not a checklist. Regulators are looking for evidence that you built safety measures into the system, not bolted them on afterwards.

Systems in 'critical' sub-categories — certain medical devices, biometric systems, and AI used in law enforcement — require third-party conformity assessment from a notified body. Check the annexes carefully; the product team may not know which bucket their system falls into.

Practical Engineering Priorities for Q3–Q4 2026

If you're starting from scratch on EU AI Act compliance, the highest-leverage engineering work in priority order: implement decision logging first (everything else depends on your ability to reconstruct what happened), then build human override UX into any consequential output screen, then document your data lineage. The paperwork comes last — build the systems first.

The fines under the EU AI Act reach 3–7% of global annual revenue for the most serious violations. That's a board-level number, not a legal department budget line. Engineering teams who build compliance into the system architecture will spend a fraction of what teams who treat it as documentation.