The EU AI Act in plain English: a build checklist for data & AI teams

The EU AI Act is the world's first comprehensive law on artificial intelligence, and if you build or deploy AI touching the EU, it applies to you. The headlines make it sound daunting. In practice, for most teams shipping analytics and AI features, it comes down to a handful of sensible engineering habits, most of which overlap with simply building AI responsibly.

Here's the plain-English version, and a checklist you can actually work from.

It's built on risk tiers

The Act sorts AI systems by how much risk they pose, and your obligations follow from where you land:

• Unacceptable risk — a small set of practices (e.g. social scoring, certain manipulative or biometric uses) that are simply banned.
• High risk — systems used in sensitive areas like employment, credit, essential services, or critical infrastructure. These carry the heaviest obligations.
• Limited risk — systems like chatbots or generated media, which mainly require transparency (tell people they're dealing with AI, label AI-generated content).
• Minimal risk — most everyday analytics and tooling, with little to no specific obligation.

General-purpose AI models (the big foundation models) also have their own separate obligations, relevant if you build or provide them.

The build checklist

Whatever your tier, these practices keep you on the right side of the Act, and make your systems better anyway:

• Know your tier. Classify each AI system by use case, this decides everything else.
• Be transparent. Disclose when users interact with AI, and label AI-generated or manipulated content.
• Keep humans in oversight. Design meaningful human review and override, especially for consequential decisions.
• Govern your data. Document data sources, quality, and representativeness, poor data governance is a compliance and quality problem.
• Log and document. Keep records of how the system works, how it was tested, and what it does in production, traceability is central to the Act.
• Manage risk continuously. Identify, test for, and mitigate foreseeable harms, then keep monitoring after launch.
• Mind the GDPR overlap. If you process personal data, GDPR still applies in full alongside the AI Act.

Compliance and good engineering are the same work

Here's the reassuring part: transparency, human oversight, data governance, logging, and risk management aren't foreign bureaucracy, they're exactly what makes AI reliable and trustworthy in the first place. Teams that already build with discipline are most of the way there. The Act mostly asks you to document and formalize practices a good engineering team would want anyway.

Where to start

Inventory your AI and analytics systems, classify each by risk tier, and close the gaps for anything high-risk or user-facing first. Build the transparency, oversight, and logging in from the design stage rather than bolting them on later, retrofitting compliance is far more expensive than designing for it.