Most coverage of the EU AI Act reads like a legal brief. That's useful for counsel and useless for the engineers who have to actually build the controls. Stripped of the jargon, the Act is a fairly concrete engineering checklist. Here's the version your team can act on this sprint.
1. Classify every AI system you ship
The Act sorts systems into four tiers: prohibited, high-risk, limited-risk, and minimal-risk. Most SaaS AI features land in limited or high-risk. The trigger for high-risk is usually use case (employment, credit, education, critical infrastructure), not model size. Maintain a registry. If you can't list every AI system in your product in under five minutes, you have a problem.
2. Build the audit trail before you need it
High-risk systems require automatic logging of inputs, outputs, and decisions for the lifetime of the system. Retrofitting this onto a year-old feature is painful. Add it as middleware now, even for systems you think are limited-risk, since the classification can change with a single use-case expansion.
3. Human oversight is a code path, not a policy
"A human can override the model" doesn't mean a line in your policy doc. It means a UI affordance, an audit-logged action, and a feedback loop into the model. If the override isn't in the product, regulators will assume it isn't real.
4. Data governance is non-negotiable
Training data needs documented provenance, bias evaluations, and a process for handling subject-access requests. If you fine-tune on customer data, you need a way to prove what went in and a way to take it out. Model cards are a good way to keep that documentation from going stale, see our post on automating AI model cards.
5. Transparency for users
Users interacting with AI must know they are. Generated content needs to be marked. It's a legal obligation under Article 50, not just a UI nicety. And the deadline is sooner than you think.
The deadline math
Prohibited-practice rules have applied since February 2025 and general-purpose AI obligations since August 2025. (Updated September 2026: under the Digital Omnibus, Regulation (EU) 2026/1744, the Annex III high-risk obligations now apply from 2 December 2027, and those for AI in products covered by Annex I from 2 August 2028.) If you're a SaaS team selling into the EU, the runway to retrofit is shorter than a normal roadmap cycle, especially on a startup budget (we wrote a guide for that). Start now, ship incrementally, automate the evidence, and check our pricing to see what's available today.