AI engineering for EU teams — and what the AI Act actually asks of you
Last verified: July 2026· regulatory detail
The AI Act timeline, as amended
A lot of the AI Act commentary online is out of date, including some widely-cited trackers still showing the original schedule. The Digital Omnibus amended it: the high-risk obligations everyone was bracing for in August 2026 were pushed back, but the transparency rules were not. If you are planning against a 2026 high-risk deadline, you are planning against the wrong date — and if you assumed everything slipped, you are about to miss one.
The obligations that are already live: the prohibitions on certain practices and the AI-literacy duty have applied since February 2025, and the general-purpose AI model rules, governance and penalties provisions have applied since August 2025.
The one that lands imminently is Article 50 — transparency. In engineering terms it means a person must be told when they are interacting with an AI system, and synthetic content must be machine-readably marked as artificially generated. That is a product and pipeline change: disclosure in the interface, and provenance marking on generated output.
The high-risk regime is where the heavy lifting sits — risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness. It now bites in December 2027 for standalone Annex III systems and August 2028 for AI embedded in regulated products. That is not a reason to wait: the artefacts it demands (evals, traces, versioned prompts, documented human oversight) take quarters to build and are exactly what you would build anyway to keep quality under control.
This is a summary for engineers, not legal advice. Scope and classification are genuinely hard, the Omnibus is recent, and implementing guidance is still landing — confirm your specific obligations with counsel.
Timeline, as it currently stands
- 2 Feb 2025
Prohibited practices and the AI-literacy obligation start to apply. Already live.
- 2 Aug 2025
General-purpose AI model rules, governance, confidentiality and penalties start to apply. Already live.
- 2 Aug 2026
Article 50 transparency obligations apply — disclose AI interaction, mark synthetic content. Not delayed by the Omnibus.
- 2 Dec 2026
Grace period ends for marking generative AI output as artificially generated; new prohibition on non-consensual intimate imagery tools.
- 2 Dec 2027
Standalone high-risk (Annex III) obligations apply — delayed from August 2026 by the Digital Omnibus.
- 2 Aug 2028
High-risk AI embedded in regulated products (Annex I) — delayed by the Digital Omnibus.
Where your data can sit
- EU regions on the major clouds (AWS eu-central-1 / eu-west-1, Azure West Europe, GCP europe-west) where processing must stay in-region.
- Not every model provider offers EU-only processing on every model. We check that per route rather than assuming, because it decides your architecture.
- We are a UK company, so where we process personal data on your behalf the transfer sits under the UK adequacy decision, with a DPA and SCCs where required.
- For data that cannot leave your environment, self-hosted open-weight inference keeps the whole path inside your perimeter — which is also the cleanest answer to residency questions.
What European Union teams come to us for
Article 50 in the next fortnight
The immediate work is unglamorous and concrete: make AI interaction disclosure real in the product, and mark generated output as synthetic in a machine-readable way. Both are pipeline changes, and both are due 2 August 2026.
Evidence, not intentions
Every part of the high-risk regime assumes you can show what happened — which input, which prompt version, which model, what came out. Teams that already run evals and tracing find compliance is mostly documentation. Teams that do not are rebuilding under a deadline.
Residency closing the easy path
For health, finance, and public-sector data, the hosted-API route is often simply unavailable. Self-hosted inference plus retrieval over in-region data is the standard answer, and it is a build, not a procurement exercise.
How working together works
- Contracting
- With Neul Labs Limited (Scotland). DPA as standard; SCCs where the transfer requires them. Invoiced in GBP or EUR.
- Overlap
- One hour off CET — effectively a full working-day overlap with EU teams.
- Language
- We work in English. Documentation and handover artefacts are written for your engineers, not for a compliance binder.
- On-site
- Remote by default; on-site in the EU for kickoff or an architecture review where it earns the travel.
Frequently asked questions
When does the EU AI Act actually apply to us?
In phases, and the schedule changed. Prohibitions and AI literacy have applied since February 2025; GPAI model rules, governance and penalties since August 2025. Article 50 transparency applies from 2 August 2026 and was not delayed. The high-risk obligations were pushed back by the Digital Omnibus — standalone Annex III systems to 2 December 2027, and AI embedded in regulated products (Annex I) to 2 August 2028. Several popular trackers still show the old dates. Verified July 2026; confirm your specific classification with counsel.
Does the AI Act apply to us if we are not established in the EU?
Very possibly. The Act reaches providers and deployers based on the EU market and on where output is used, not on where the company is registered. A UK or US company placing an AI system on the EU market, or whose system output is used in the EU, can be in scope. Being outside the EU is not an exemption.
What does Article 50 mean in engineering terms?
Two concrete things. People must be told when they are interacting with an AI system rather than a human — that is a product/UX change. And synthetic content must be marked, machine-readably, as artificially generated — that is a pipeline change on every generation path. Both are due 2 August 2026, with a grace period on marking generative output running to 2 December 2026.
Can you help us actually comply, or just build?
We build the engineering half and we are explicit about the boundary. Disclosure, content marking, eval harnesses, tracing, prompt and model versioning, human-oversight hooks, and residency architecture are engineering — we ship those. Classification, legal risk assessment, and sign-off belong with your counsel and compliance function. We give them artefacts to point at rather than assurances.
Should we wait until 2027 to start on high-risk?
No, but not for compliance-theatre reasons. The artefacts the high-risk regime demands — evals, logs, documented oversight, versioned prompts — take quarters to build and are the same things that keep quality and cost under control day to day. Teams that already have them will find December 2027 mostly a documentation exercise. Teams that start in 2027 will be rebuilding production under a deadline.
Regulatory detail on this page was verified in July 2026 and is a summary for engineers, not legal advice. Rules change — confirm your specific obligations with counsel before relying on them.