What we tell clients about the EU AI Act
Most AI features companies are shipping are not high-risk. The documentation burden still applies, and it is easier to produce while you build than afterwards.
Every client conversation about the AI Act starts in one of two places: total panic, or total dismissal. Both are wrong, and the correction is the same in each case — find out which risk tier your feature actually sits in before deciding how worried to be.
Most of what companies are shipping is limited-risk: a support assistant, a summarisation feature, a classifier that routes tickets. The obligations there are transparency ones. Tell people they are interacting with a machine, label synthetic content, and be able to explain what the system does.
High-risk is narrower than the headlines suggest, but it is not exotic. Anything touching recruitment, creditworthiness, access to essential services or worker management lands there, and that catches a lot of ordinary HR and fintech software.
The practical work is the same either way, which is why we do it by default. A model card describing what the system is for and what it is not. A record of the data it was evaluated against. Human oversight documented as a mechanism, not a sentence. Logging that lets you reconstruct a decision months later.
None of that is exotic engineering. It is the evaluation harness and trace logging we build anyway, written up. The difference between a compliant system and a non-compliant one is usually not the model — it is whether anyone wrote down what was already true.
Our advice is unromantic: assume you will have to evidence it, produce the evidence as a by-product of building, and get a lawyer to confirm your tier. We do the technical half; we do not give legal advice, and neither should your AI vendor.