Skip to content

The EU AI Act and worker-built apps

For a US or Canadian business, the EU AI Act matters when you place an AI system on the EU market or its output is used in the EU. Code written with AI isn't an AI system. If you have an EU establishment, or the tool's output is used in the EU (Art. 2(1)), using an AI coding tool makes you a deployer of that tool, which is where the softened Article 4 AI-literacy measure comes from; building internal apps with it creates almost no other duty. Duties begin when an app contains an AI feature: Article 50 transparency has applied since 2 August 2026, and Annex III high-risk duties (hiring, credit and similar uses) apply from 2 December 2027. These dates are as of October 2026, after the Digital Omnibus changes.

Who this is for

Compliance leads, IT managers and execs at North American businesses with EU customers, staff or operations. About 8 minutes.

Not legal advice

Not legal advice. This page summarizes laws as of October 2026 for a general audience. It was written with an AI legal-research persona and hasn't been reviewed by a lawyer for your situation. Ask your counsel.

Stop and call counsel before you build if any of these apply

These are the items that turn on the EU AI Act. The full stop-and-call-counsel list, which applies to every app, also covers the consent gate, decisions about people, Q4 (d1) and audit scope (whose requirements the compliance owner sets at any tier, with no tier floor).

  • The jurisdiction flag: the app handles information about people in Quebec, the EU or the UK, or about staff who work in the EU or UK, or an AI feature's output is used in the EU. If you don't know, answer yes. This includes being, or possibly being, the provider of an AI system whose output is used in the EU, including one a worker built.
  • Annex III with the flag: an AI feature works in an Annex III area (hiring, worker management, credit scoring, life or health insurance pricing, education) and the jurisdiction flag is yes.

Does it reach a North American business?

Article 2(1) reaches you in three ways, wherever you're established:1

  1. You're a provider placing an AI system on the EU market or putting it into service there, such as an AI feature offered to EU customers.
  2. You're a deployer established or located in the EU, such as your EU subsidiary using an AI tool.
  3. You're a provider or deployer outside the EU, and the system's output is used in the EU, such as a US-built AI screening tool used on applicants for an EU role.

Don't: imply the Act applies to every US business with a website

A website EU residents can visit doesn't, on its own, bring you under the Act; reach needs one of the three routes.1

Is an app built with AI an "AI system"?

Usually not. An AI system is a machine-based system that "infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions" (Art. 3(1)).2 The Commission's guidelines draw the edges: basic statistical methods and simple prediction are out, while machine learning and logic- or knowledge-based inference are in.3

  • Code an AI tool wrote is ordinary software once it runs. A form, a dashboard or a fixed formula doesn't infer, even a statistical one.
  • An app with an AI feature contains an AI system, whether it calls a hosted model at runtime or ships a model you trained inside the app.
  • The AI coding tool itself is an AI system, which the business deploys.

The AI feature is modifier M1 in the tier model. Every worker-built app sits in one of four risk tiers (Sandbox, Team, Important or Critical), set by the highest answer to six questions about its data, users, internet reach, dependence, decisions about people and actions, and two floors apply at every tier.

Don't: invent a logging duty for AI involvement in code

The Act doesn't require you to record which code an AI tool wrote, and AI-assisted building doesn't make an app high-risk; that attaches to an AI system's use.5

What are the dates?

Fast-moving

As of October 2026. Check the review date.

Date What applies
1 Aug 2024 The Act enters into force
2 Feb 2025 Prohibited practices (Art. 5); AI literacy (Art. 4)
2 Aug 2025 General-purpose AI model provider duties (Chapter V, Arts. 53 and 55); governance; penalties
2 Aug 2026 Most remaining rules, including Article 50 transparency, and enforcement
2 Dec 2026 New prohibitions (non-consensual intimate imagery, child sexual abuse material); the Art. 50(2) marking grace period ends for systems already on the market
2 Dec 2027 Annex III stand-alone high-risk duties (previously 2 Aug 2026)
2 Aug 2028 Annex I high-risk duties for AI in regulated products (previously 2 Aug 2027)

The Digital Omnibus on AI (adopted 8 July 2026, in force 27 July 2026) moved the high-risk dates.11 Its number, 2026/1744, rests on secondary sources (see below).

Am I a provider or a deployer?

Role Definition (Art. 3) When a worker-built app makes you one
Deployer Uses an AI system under its authority, except for personal non-professional use2 Your staff use an AI coding tool, an AI app builder or a chat assistant at work, if you have an EU establishment or the tool's output is used in the EU (Art. 2(1))
Provider Develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark2 A builder adds an AI feature to an app, and the business puts it into service in the EU, or its output is used in the EU (Art. 2(1))

Deployer of the tool you build with. If you have an EU establishment, or the tool's output is used in the EU (Art. 2(1)), that brings Article 4, as amended: "measures to support the development of AI literacy" of staff, without "any specific level of AI literacy of any individual".4 Your training tracks can show those measures.

Provider of the feature you built. An internal AI feature used only in the US isn't reached. Where the Act reaches one, most owe only Article 50; a high-risk use brings provider duties (Article 16, Chapter III Section 2) and a conformity assessment.

Don't: put provider duties on deployers

Articles 9 to 15 are provider duties; a deployer of a high-risk system has the Article 26 duties instead.6

What does Article 50 require?

Article 50 has applied since 2 August 2026.9

  • 50(1), provider: a system that interacts directly with people must tell them they're dealing with AI, unless that's obvious. It's a design duty, for internal and external users alike.
  • 50(2), provider: synthetic audio, image, video or text must be marked in a machine-readable way, with exceptions such as assistive editing.
  • 50(3) and 50(4), deployer: disclosure for emotion recognition, biometric categorization, deepfakes and some public-interest text; rare in worker-built apps.

For a worker-built chat feature, a standard "you're talking to an AI" line covers 50(1). The same line meets the disclosure duty in the US state chatbot laws (California, Maine, Utah), but Colorado's HB 26-1263 also requires age estimation, protections for minors and a self-harm protocol for public chatbots from 1 January 2027 (see chatbot disclosure laws). If a feature generates content that leaves the company, ask counsel whether 50(2) marking falls on you or is covered by the model provider.

When is a worker-built AI feature high-risk?

  • Annex III (stand-alone uses), from 2 December 2027. The areas include education, employment and worker management (recruitment, promotion and termination, task allocation, performance monitoring), and essential services, including credit scoring and life and health insurance pricing.10 Credit scoring is high-risk on its own, not "inherited" from a larger system.
  • Annex I (products), from 2 August 2028. Safety components of regulated products; rare for worker-built apps.

The Article 6(3) derogation. An Annex III system isn't high-risk if it poses no significant risk of harm, for example because it performs a narrow procedural or preparatory task. It's always high-risk if it profiles people, and almost every hiring, credit or worker-management app does, so the derogation is rarely available for them. A provider relying on it must document its assessment before use.5

Deployers of high-risk systems owe Article 26 duties, including human oversight, six-month logs and informing workers.6 Deployers using credit scoring or life and health insurance pricing must also carry out a fundamental-rights impact assessment (Art. 27),7 and people affected by a significant decision can ask the deployer for an explanation of the system's role (Art. 86).8

What should intake screen for?

The AI Act adds no new tier question. It rides on answers you already give at intake, using the six tier questions:

Intake answer AI Act question it raises What happens
Jurisdiction flag: the app handles information about people in Quebec, the EU or the UK, or about staff who work in the EU or UK, or an AI feature's output is used in the EU (if you don't know, answer yes) Does Art. 2(1) reach this app, including Art. 2(1)(c) for output used in the EU? Route to counsel before building (a gate; the tier is unchanged)
M1: the app calls an AI model Are we the provider? Does Art. 50(1) or 50(2) apply? The AI-disclosure check; the AI-feature controls from Team up
M2: customer-facing AI with no person approving each output Art. 50(1) at minimum Critical under the tier model
Q5 (b) or (c) plus the jurisdiction flag Is it an Annex III use, and does the Art. 6(3) derogation apply? Counsel decides the role and duties; Q5 sets the tier

If counsel concludes you'd be the provider of a high-risk system, we recommend graduation (IT co-owns the app); provider duties need engineering a builder can't run alone. That's our recommendation, not a legal rule or a tier. GDPR rules usually apply first: see apps that make decisions about people.

Don't: cite the wrong articles

GPAI provider duties are in Articles 53 and 55 (Article 51 only classifies systemic-risk models), and high-risk requirements are in Chapter III, not "Title III".13

What's still uncertain?

  • The Omnibus text. We couldn't open Regulation 2026/1744 on EUR-Lex; its number and dates come from the Service Desk and secondary sources.12
  • The Article 50 grace period rests on a single secondary source.
  • Article 6(3) registration. The Omnibus proposal would have dropped the duty to register derogation systems; the Service Desk still shows it.
  • The GDPR omnibus (which would recast Article 22) hasn't been adopted.

Questions to ask your counsel

  1. Do any of our AI features produce output used in the EU, or are any used by our EU establishments?
  2. Are we a provider of anything we built ourselves?
  3. Do any AI features fall in an Annex III area, and if so, does the Article 6(3) derogation apply?
  4. Which AI features fall under Article 50?
  5. What AI-literacy measures should we document?
  6. As a deployer of a high-risk system, how do we meet Article 26, and do we owe an Article 27 impact assessment?
  7. Do GDPR rules apply to the same apps first?

Assumptions and evidence

  • No adoption assumptions. The Omnibus regulation number is corroborated by secondary sources only.
  • Evidence: the Act's text and guidelines on the Commission's Service Desk, read on 2026-10-21, plus secondary sources for the Omnibus. No enforcement decisions exist yet.
  • Facts on this page are as of October 2026.

  1. Regulation (EU) 2024/1689, Article 2, European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-2 [statute], accessed 2026-10-21. ↩↩

  2. Regulation (EU) 2024/1689, Article 3, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-3 [statute], accessed 2026-10-21. ↩↩↩

  3. European Commission, Guidelines on the definition of an artificial intelligence system established by Regulation (EU) 2024/1689, 6 Feb 2025, https://ai-act-service-desk.ec.europa.eu/sites/default/files/2025-08/commission_guidelines_on_the_definition_of_an_artificial_intelligence_system_established_by_regulation_eu_20241689_ai_actenglish_nf2skcqfrtjdfggjavcodopcwz4_112455.PDF [regulator; non-binding], accessed 2026-10-21. ↩

  4. Regulation (EU) 2024/1689, Article 4 (as amended), https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4 [statute], accessed 2026-10-21. ↩

  5. Regulation (EU) 2024/1689, Article 6, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6 [statute], accessed 2026-10-21. ↩↩

  6. Regulation (EU) 2024/1689, Article 26, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26 [statute], accessed 2026-10-21. ↩↩

  7. Regulation (EU) 2024/1689, Article 27, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27 [statute], accessed 2026-10-21. ↩

  8. Regulation (EU) 2024/1689, Article 86, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-86 [statute], accessed 2026-10-21. ↩

  9. Regulation (EU) 2024/1689, Article 50, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50 [statute], accessed 2026-10-21. ↩

  10. Regulation (EU) 2024/1689, Annex III, https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3 [statute], accessed 2026-10-21. ↩

  11. European Commission AI Act Service Desk, Timeline for the implementation of the EU AI Act, https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act [regulator], accessed 2026-10-21. ↩

  12. ERTICO, Digital Omnibus on AI enters into force, https://ertico.com/digital-omnibus-on-ai-enters-into-force [secondary]; ECIJA, The European Parliament and the Council approve the Digital Omnibus package on AI, https://www.ecija.com/en/news-and-insights/the-european-parliament-and-the-council-approve-the-digital-omnibus-package-on-ai/ [secondary], accessed 2026-10-21. ↩

  13. Regulation (EU) 2024/1689, Articles 51 and 53, European Commission AI Act Service Desk, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-51 and https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53 [statute], accessed 2026-10-21. ↩