The EU AI Act regulates AI systems by risk. For a product manager, the first job is to classify each AI feature against four levels, check it is not a prohibited practice, and find out whether you are a provider or a deployer. Dates have shifted, so verify them against the Commission's current material.
What are the four levels?
The European Commission describes four levels of risk: unacceptable, high, limited and minimal. Unacceptable-risk systems are banned. The Commission lists nine prohibited practices, including harmful manipulation, social scoring, untargeted scraping of facial images, emotion recognition in workplaces and education, and certain biometric uses. Prohibitions 1 to 8 became effective in February 2025, and the Commission says the ninth, added by the AI Omnibus, takes effect in December 2026.
High-risk use cases include AI in recruitment and worker management, access to essential services such as credit scoring, education, critical infrastructure safety components and certain law enforcement and migration uses. Most AI systems, the Commission says, pose limited or no risk.
Where do your features land?
A constructed example: a SaaS company has three AI features. A chat assistant for help articles is likely limited risk, mostly a transparency question. A tool that ranks job applicants is in the high-risk area for employment. A sentiment feature that infers employee emotions from video calls collides with the prohibition on emotion recognition in workplaces. The third needs to be dropped or redesigned, not documented.
Classification is a legal judgment. Treat your product view as a first pass for counsel to confirm.
Provider or deployer?
Obligations differ by role. A provider develops a system and places it on the market. A deployer uses it under its own authority. If you build a feature on a third-party model and ship it under your name, you may be a provider of that system even though you did not train the model. Check this explicitly.
What changes in the backlog?
For high-risk systems, expect requirements around risk management, data governance, technical documentation, logging, human oversight, accuracy and resilience to errors. For limited-risk systems, transparency duties such as telling users they are interacting with AI or labelling synthetic content may apply.
On timing, a community-maintained timeline lists 2 August 2026 as the date the remainder of the Act starts to apply unless specified otherwise, and references 2 August 2027 for some legacy cases. The Commission's page indicates the AI Omnibus changed some elements. Confirm dates with the Commission's AI Act Service Desk and your counsel before you commit a plan.
What if a feature sits on the line?
Borderline cases are common. A tool that summarizes employee performance notes may support a manager's decision without making it, yet employment is a high-risk area. Document your reasoning, including how much human review there is and whether the output influences decisions about people. If you cannot argue clearly that a feature stays outside the high-risk list, plan as if it is inside and have counsel confirm.
Keep a simple AI register with one row per feature: purpose, inputs, model source, users, provisional class, role and review date. It becomes the evidence that you looked, and it is the quickest way to answer a customer who asks which of your features use AI and how they are governed.
How to check or apply this
- List every AI feature, internal and customer-facing, with its purpose and inputs.
- Screen each against the prohibited practices.
- Assign a provisional risk level and flag high-risk candidates for counsel.
- Decide for each whether you are provider, deployer or both.
- For high-risk features, plan logging, human oversight and documentation work.
- Add transparency notices where users interact with AI or see generated content.
- Track current dates on the Commission's pages each quarter.
Safeguard's AI-related inventory and compliance automation can help keep a register of AI components, but the legal classification belongs to counsel.
Quick check
Does the AI Act apply to non-EU companies?
It can, when AI systems are placed on the EU market or their outputs are used in the EU. Counsel should confirm for your case.
Is a chatbot high risk?
Usually not. It is more often a transparency matter, unless its use case falls in a listed high-risk area.
Sources
- European Commission, AI Act regulatory framework
- AI Act implementation timeline (artificialintelligenceact.eu, non-official)
Last reviewed: 18 October 2026.
