The EU AI Act sorts AI systems into risk tiers and pins enforceable obligations on each. High-risk systems — those affecting fundamental rights or safety — must produce documentation, traceability, human oversight, and meaningful explanations of their decisions. The deadlines have arrived. The compliance posture you ship in 2026 is the one regulators will measure.
The four risk tiers in plain language
| Tier | Examples | Obligations |
|---|---|---|
| Unacceptable | Social scoring, real-time biometric surveillance | Banned |
| High-risk | Hiring, credit scoring, medical devices, critical infra | Conformity assessment, registration, oversight, XAI |
| Limited risk | Chatbots, deepfake generators | Transparency disclosures |
| Minimal risk | Spam filters, game AI | No specific obligations |
Building explainability into the lifecycle
- Data lineage — every training and evaluation dataset versioned, scoped, and consented.
- Model cards — documented intended use, limitations, performance by demographic slice.
- Decision logging — for high-risk inferences, retain inputs, outputs, model version, and contributing features.
- Local explanations — SHAP, integrated gradients, or rule extraction surfaced to the affected user where applicable.
- Human oversight — a meaningful path to contest and review automated decisions.
The provider / deployer split
The Act distinguishes the provider (the entity that builds or substantially modifies the system) from the deployer (the entity that puts it to use). Both have obligations, and they are not interchangeable. If you fine-tune a foundation model and integrate it into a credit-scoring product, you are likely both — and need to document accordingly.
Working on an AI feature that touches high-risk territory under the Act? Reach out via the contact section.
Frequently asked questions
- If your system is placed on the EU market or its output is used in the EU, yes. Extraterritorial reach is similar in spirit to GDPR.
- Yes. GPAI models have their own obligations around technical documentation, copyright disclosures, and (for systemic-risk models) safety evaluations.
- Fines scale with severity, up to 7% of global annual turnover for the most serious infringements. The reputational cost typically arrives faster than the regulator.
