Sovereignty · Updated 10 November 2026 · 9 min read

The EU AI Act for developers shipping AI features in 2026

Provider or deployer, chatbot disclosure, labels for generated content, high-risk uses and the dates the AI Omnibus moved, read from the Commission and the legal text.

View as Markdown

For most teams adding a chatbot, a summariser or an image generator to a product, the AI Act boils down to transparency: since 2 August 2026, people must be told when they're talking to an AI system, and generated content must be marked or labelled. The heavy obligations, such as risk management, logging and human oversight, apply only to high-risk uses like hiring, credit or education, and the AI Omnibus pushed those to 2 December 2027. A small set of practices is banned outright, and that ban already applies.

What follows is a developer's reading of the regulation and the Commission's guidance, not legal advice. Whether a rule bites depends on what your feature does in practice.

What applies to you at a glance

What you ship	Your likely role	Main duty	Applies from
A chatbot or assistant that talks to users	Provider of the AI system	Tell people they're interacting with AI, unless it's obvious	2 August 2026
A feature that generates text, images, audio or video	Provider of the AI system	Mark output in a machine-readable way so it can be detected as generated	2 August 2026, or 2 December 2026 for systems already on the market before 2 August 2026
Deepfake-style media or AI-written text published on matters of public interest	Deployer	Disclose that the content was generated or manipulated	2 August 2026
AI used for hiring, exams, credit or other Annex III areas	Provider or deployer of a high-risk system	Risk management, documentation, human oversight, logs	2 December 2027
Your own general-purpose model released to others	Provider of a general-purpose AI model	Technical documentation, copyright policy, training content summary	2 August 2025
Spam filters, recommendations in a game, search ranking	Provider or deployer of a minimal-risk system	AI literacy for your staff only	2 February 2025

Dates follow the Commission's timeline after the AI Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026.

Provider or deployer: which one are you

The Act assigns duties by role, so start here. A provider develops an AI system or model, or has one developed, and places it on the market or puts it into service under its own name or trademark, paid or free. A deployer uses an AI system under its authority.

If you wrap a model API in your own product and offer it to users under your brand, you're very likely the provider of that AI system, even though someone else trained the model. The company that trained the model is the provider of the general-purpose model, which is a separate set of duties. Your customers who use your feature at work are deployers.

Roles can shift. Under Article 25, a deployer or other party becomes the provider of a high-risk system if it puts its own name on one, substantially modifies one, or changes the intended purpose of an ordinary AI system so that it becomes high-risk.

Rules you already have to follow

Prohibited practices have applied since 2 February 2025. They include social scoring and untargeted scraping of facial images, among others. From 2 December 2026, the Omnibus adds a ban on AI systems that generate non-consensual intimate content or child sexual abuse material. If your image or video feature could produce either, you need controls that stop it.

AI literacy under Article 4 also started on 2 February 2025. The Omnibus softened the wording: providers and deployers now take measures to support the AI literacy of their staff, and the duty doesn't require a guaranteed level for any individual.

Transparency: the part most developers meet

Article 50 has applied since 2 August 2026 and splits its duties between the two roles.

Chatbots and assistants, provider duty. Design the system so people know they're dealing with AI. You can skip it where that's obvious to a reasonably well-informed person in context.
Generated content, provider duty. Systems that generate synthetic audio, images, video or text must mark their output in a machine-readable format, as far as technically feasible. Tools that only assist standard editing or don't substantially alter the input are exempt. Certain systems already on the market before 2 August 2026 have until 2 December 2026.
Emotion recognition and biometric categorisation, deployer duty. Tell the people exposed to it how the system works, and handle the data under GDPR.
Deepfakes and public-interest text, deployer duty. Disclose that image, audio or video resembling real people, places or events was generated or manipulated. AI-written text published to inform the public needs disclosure unless a person or entity reviewed it and holds editorial responsibility.

High-risk uses come later, and cost more

Annex III lists areas where AI counts as high-risk, such as critical infrastructure, education, employment, access to essential services, law enforcement, migration and justice. Providers there carry risk management, data quality, logging, documentation and human oversight duties. Deployers must follow the instructions for use, assign trained people to oversee the system, monitor it, keep the logs under their control for at least six months, tell workers before using it at the workplace, and tell people when a high-risk system helps make decisions about them.

After the Omnibus, these rules apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI built into products already covered by EU safety law under Annex I.

If you build on someone else's model

Calling a hosted model through an API doesn't make you a general-purpose model provider. Those duties, covering documentation for downstream developers, a copyright policy and a public summary of training content, have applied to model providers since 2 August 2025. Models placed on the market before that date have until 2 August 2027. If you modify a model yourself, the Commission's guidelines say only significant modifications bring the model provider obligations, and minor changes don't.

What you do need from your model vendor is the information to meet your own duties: whether its output carries a machine-readable mark, what its terms say about your data, and where it processes prompts. That last point is a GDPR question rather than an AI Act one, and it's covered in the GDPR hosting checklist and subprocessors explained.

What to check before you ship an AI feature

Your role. Write down whether you're the provider, the deployer or both for each feature, and who supplies the model.
The disclosure. Make sure a user can see they're talking to AI before they rely on its answer.
Output marking. Check whether your model vendor marks generated media and text, and keep that mark intact through your own processing.
The use case. Compare what the feature decides against the Annex III areas. A support bot isn't high-risk; a bot that pre-screens job candidates may be.
Banned output. Add filters for content the prohibitions cover, especially for image and video generation.
Personal data. Check where prompts and outputs are stored and who receives them. The AI Act doesn't replace the GDPR; both apply at once.

Fines for breaching Article 50 or operator duties reach €15 million or 3% of worldwide annual turnover, whichever is higher; for prohibited practices, €35 million or 7%. For SMEs and start-ups, the lower of the two figures applies.

Where hosting fits

The AI Act doesn't say where your app or model must run; location is a GDPR and contract question.

If you want the app around your AI feature hosted in Europe, Eurobase is one option: a business registered in Warsaw, Poland, whose platform runs on European infrastructure from Scaleway, a French provider. It doesn't supply AI models: your app calls the model provider you choose, and that provider becomes a recipient of the prompts you send. Apps on V8 isolates can stream a model's reply, since an outbound fetch may keep streaming for up to 5 minutes as long as bytes arrive at least every 55 seconds; Python or Node.js servers can run as containers instead. API keys go in environment variables, as explained in environment variables and secrets. Eurobase doesn't hold ISO 27001 or SOC 2 yet; both are in progress. Connecting GitHub or GitLab Inc. adds that US company to your subprocessor list.

Frequently asked questions

Does the EU AI Act apply to my chatbot?

Yes, if you offer it in the EU or its answers are used there. A customer support bot usually isn't high-risk, so telling users they're dealing with AI is normally the main duty.

Do I have to label AI-generated text on my website?

It depends on what the text is for. Providers of systems that generate text must mark output in a machine-readable way. Deployers must visibly disclose AI-generated text published to inform the public on matters of public interest, unless it went through human review with someone holding editorial responsibility.

Does the AI Act apply to companies outside the EU?

Yes. It covers providers placing AI systems on the EU market and providers or deployers outside the EU whose system's output is used in the EU.

Were the AI Act deadlines postponed?

Partly. The AI Omnibus moved the high-risk rules to December 2027 and August 2028 and gave existing generative systems until 2 December 2026 for output marking. The rest of the transparency rules and the prohibitions weren't delayed.

Do I need to host my AI app in Europe to comply?

No. The AI Act has no hosting location rule. Where data is processed is a GDPR matter, and your customers' contracts may ask for European hosting, which data residency vs data sovereignty explains.