Introduction: the EU AI Act and impact on your code

The Artificial Intelligence Act (AI Act) of the European Union represents the first global normative framework dedicated to AI governance. Published on June 13, 2023, the regulation will enter a phased enforcement period between 2024 and 2027, with direct implications for any developer building AI systems for European users.

Unlike soft guidelines (such as ethical AI principles), the AI Act is a hard law with criminal penalties. It is not a recommendation: it is a legal obligation involving accountability, transparency, documentation, and mandatory testing.

The risk-based model of the AI Act

The cornerstone of the AI Act is the risk-based approach: not all AI systems are regulated in the same way. The regulation stratifies requirements based on potential harm.

AI systems are classified into four risk categories:

• Minimal Risk: customer service chatbots, personal assistants, code generation tools (Copilot, for example).
• Limited Risk: systems that interact with people (e.g., emotion recognition, interactive information systems). Require transparency about purposes and notice to the user.
• High Risk: systems that impact rights and safety. Examples: credit scoring, hiring automation, facial recognition, traffic surveillance systems. Require conformity assessment, ex-ante testing, continuous monitoring.
• Prohibited Risk: systems that are completely banned. E.g., psychological manipulation, authoritarian social scoring, real-time mass facial recognition in public spaces.

Identifying the risk level of your AI system

The first step is self-assessment. The EU Commission provides a public methodology (impact assessment template). Ask yourself these questions:

• Does the system make autonomous decisions that impact legal rights or people's lives (credit, employment, health, justice)?
• Does the system perform profiling or potential discrimination (gender, race, disability, orientation)?
• Does it collect biometric data or have access to sensitive data?
• Does it require explainability / human intervention for critical decisions?

If the answer is yes to one or more questions, you are in High Risk and must apply rigorous controls.

Obligations for High-Risk systems: the compliance checklist

If your system is classified as High-Risk, the law requires:

• Risk Management System (RMS): identify, assess, and mitigate risks ex-ante and in production.
• Data Quality & Governance: training data must be robust, free from bias, documented (provenance, characteristics, limitations).
• Registration and Logging: record all predictions and input data. Maintain trace for 6-12 months (immutable audit trail).
• Continuous Monitoring: detect anomalies, drift, performance degradation. Setup automated alerts.
• Significant Human Intervention: a human operator (not AI) must review critical decisions before deployment.
• Ex-ante Assessment: before launching the system, perform independent assessment (audit) on conformity, bias testing, adversarial robustness.
• Technical Documentation: detailed technical file with architecture, training data, test results, performance metrics, known limitations. Must be available to authorities on request.

Practical scenario: AI for credit scoring (High-Risk)

Suppose you are building a system for loan approval using machine learning. Here are the concrete steps:

# Risk Assessment Framework (pseudocode)
class CreditScoringSystem:
    def __init__(self):
        self.risk_level = "HIGH"  # Classification: impacts legal rights (credit)
        self.audit_trail = LogStore()  # Immutable log for 12 months
        self.human_review_queue = Queue()

    def score_applicant(self, applicant_id: str, financial_data: dict) -> CreditDecision:
        """
        High-Risk obligations:
        1. Log the input
        2. Data validation and bias check
        3. AI prediction
        4. Human intervention before approval
        5. Log the decision
        """
        # Step 1: Audit trail entry
        self.audit_trail.log("input_received", {
            "applicant_id": applicant_id,
            "timestamp": datetime.utcnow().isoformat(),
            "features": financial_data,
            "data_provenance": "bank_system_v2.1"
        })

        # Step 2: Bias check (fairness validator)
        bias_metrics = self.fairness_check(financial_data)
        if bias_metrics.disparate_impact_ratio > 1.25:
            # Flag for human review
            self.human_review_queue.add({
                "applicant_id": applicant_id,
                "reason": "potential_disparate_impact",
                "score": bias_metrics.ai_score
            })
            return CreditDecision.REQUIRES_MANUAL_REVIEW

        # Step 3: AI scoring
        ai_score = self.model.predict(financial_data)

        # Step 4: Human approval (mandatory for High-Risk)
        human_decision = self.wait_for_human_review(
            applicant_id=applicant_id,
            ai_score=ai_score,
            timeout_hours=24
        )

        # Step 5: Final decision with audit
        decision = CreditDecision(
            approved=human_decision.approved,
            ai_confidence=ai_score.confidence,
            human_reviewer_id=human_decision.reviewer_id,
            decision_rationale=human_decision.explanation
        )

        self.audit_trail.log("decision_made", {
            "decision": decision,
            "timestamp": datetime.utcnow().isoformat()
        })

        return decision

    def fairness_check(self, data: dict) -> BiasMetrics:
        """Ex-ante validation for protected attributes."""
        protected_attrs = ["gender", "age_group", "ethnicity"]

        # Verify that the model does not correlate with protected attributes
        for attr in protected_attrs:
            if attr in data:
                correlation = self.correlation_with_outcome(attr)
                if correlation > FAIRNESS_THRESHOLD:
                    return BiasMetrics(
                        disparate_impact_ratio=calculate_4_5_rule(data[attr]),
                        recommendation="FLAG_FOR_REVIEW"
                    )
        return BiasMetrics(disparate_impact_ratio=1.0, recommendation="PROCEED")

    def generate_technical_file(self) -> TechnicalDocumentation:
        """Mandatory AI Act documentation (Art. 26)."""
        return TechnicalDocumentation(
            system_name="CreditScoringAI v1.2",
            model_architecture="GradientBoosting + XGBoost ensemble",
            training_data_description={
                "size": 50000,
                "collection_period": "2023-2024",
                "geographic_scope": "EU-27",
                "data_sources": ["bank_internal", "credit_bureau_verified"],
                "limitations": "Underrepresented gig workers, high-risk geos",
            },
            testing_results={
                "accuracy": 0.897,
                "fairness_audit_date": "2026-05-15",
                "adversarial_robustness": "Tested vs 100k perturbations",
                "performance_by_subgroup": {...}
            },
            known_limitations=[
                "Model drift in >3% APR markets",
                "Female applicants age 25-35: +0.3% default rate delta",
            ],
            monitoring_plan={
                "frequency": "daily",
                "metrics": ["prediction_drift", "accuracy_by_subgroup", "human_override_rate"],
                "alert_thresholds": {...}
            }
        )
    

Privacy by Design and GDPR alignment

The AI Act and GDPR overlap. Every High-Risk system requires:

• Data Minimization: collect only the technical data necessary for the model and audit trail (not everything).
• Purpose Limitation: the same model trained for credit scoring cannot be reused for employment screening without new assessment.
• Retention Policy: delete training data after compliance period (usually 2-3 years after system dismissal).
• Data Subject Rights: technical data (input predictions) must be accessible upon request from the person to verify AI decisions.

Continuous monitoring and drift detection

The monitoring obligation does not end at deployment. You must detect deviations (data drift, prediction drift, performance degradation). Here's a minimalist pattern:

import json
from datetime import datetime, timedelta

class AIMonitoringSystem:
    def __init__(self, model, alert_email="compliance@company.com"):
        self.model = model
        self.baseline_metrics = {
            "accuracy": 0.897,
            "false_positive_rate": 0.05,
            "pred_mean": 0.65,
        }
        self.alert_email = alert_email
        self.drift_log = []

    def daily_monitor(self, predictions_batch: list, ground_truth: list):
        """Run daily drift detection."""
        current_metrics = self.compute_metrics(predictions_batch, ground_truth)

        # Drift detection: compare with baseline
        drifts = {}
        for metric_name, current_val in current_metrics.items():
            baseline_val = self.baseline_metrics[metric_name]
            change_pct = abs(current_val - baseline_val) / baseline_val * 100

            if change_pct > 5.0:  # 5% threshold
                drifts[metric_name] = {
                    "baseline": baseline_val,
                    "current": current_val,
                    "change_pct": change_pct
                }

        if drifts:
            self.alert_drift_detected(drifts)
            self.drift_log.append({
                "timestamp": datetime.utcnow().isoformat(),
                "drifts": drifts,
                "action_taken": "MANUAL_REVIEW_QUEUED"
            })

    def compute_metrics(self, preds, ground_truth):
        from sklearn.metrics import accuracy_score, confusion_matrix
        cm = confusion_matrix(ground_truth, preds)
        tn, fp, fn, tp = cm.ravel()
        return {
            "accuracy": accuracy_score(ground_truth, preds),
            "false_positive_rate": fp / (fp + tn) if (fp + tn) > 0 else 0,
            "pred_mean": sum(preds) / len(preds) if preds else 0,
        }

    def alert_drift_detected(self, drifts):
        """Alert AI compliance team."""
        alert_msg = json.dumps({
            "alert_type": "PERFORMANCE_DRIFT",
            "timestamp": datetime.utcnow().isoformat(),
            "drifts": drifts,
            "action_required": "Review model and retrain if needed",
            "sla_hours": 24  # Compliance requirement: triage within 24h
        }, indent=2)

        print(f"ALERT: {alert_msg}")
        # In production: send email, create Jira ticket, log to centralized system
    

Managing technical documentation

The AI Act requires a "technical file" (Article 26) available to EU authorities on request. It must contain:

• Description of system architecture and decision flowchart.
• Training data: provenance, size, characteristics, documented limitations.
• Test results: accuracy for each demographic subgroup, adversarial testing, robustness testing.
• Performance baseline and fairness metrics.
• Monitoring plan: traceable metrics, frequency, alert thresholds.
• Incident log: anomalies, model recalls, remediations applied.

Minimal template in JSON:

{
  "technical_file": {
    "system_id": "credit_scoring_v1.2",
    "classification": "HIGH_RISK",
    "ai_act_article_reference": "Article 26, Article 8-9 (Risk Management)",
    "created_date": "2026-06-14T10:00:00Z",
    "last_updated": "2026-07-01T15:30:00Z",
    "responsible_entity": "Company Name",
    "model_type": "Gradient Boosting (XGBoost ensemble)",
    "training_data": {
      "sample_size": 50000,
      "collection_period": "2023-01 to 2024-12",
      "geographic_scope": "EU-27 + UK",
      "data_sources": ["Bank A internal ledger v2.1", "Credit Bureau X (verified)"],
      "features_count": 47,
      "protected_attributes": ["gender", "age", "nationality"],
      "data_documentation": "See annex_training_data.md",
      "known_limitations": [
        "Underrepresented: self-employed gig workers (2% of dataset)",
        "Geographic bias: lower coverage Eastern EU",
        "Temporal: trained on 2023-24 data; may drift in high-inflation periods"
      ]
    },
    "performance_metrics": {
      "overall_accuracy": 0.897,
      "test_dataset_size": 12000,
      "testing_date": "2026-05-20",
      "accuracy_by_subgroup": {
        "male": 0.902,
        "female": 0.889,
        "age_25_35": 0.885,
        "age_36_50": 0.905
      },
      "fairness_audit": {
        "disparate_impact_ratio_gender": 1.08,
        "disparate_impact_ratio_age": 1.12,
        "status": "MARGINAL - requires monitoring"
      }
    },
    "risk_mitigation": {
      "human_review_gate": "All HIGH-RISK decisions require human approval (24h SLA)",
      "monitoring_frequency": "daily",
      "drift_alert_threshold": "5% deviation from baseline",
      "data_retention_months": 12
    },
    "incident_history": [
      {
        "date": "2026-07-05",
        "incident": "3.2% accuracy drop detected in age_25_35 subgroup",
        "root_cause": "New credit bureau data format change",
        "resolution": "Retrained model; deployed v1.2.1",
        "time_to_fix_hours": 8
      }
    ]
  }
}
    

Communication to users and explainability

The AI Act requires that end users know they are interacting with an AI system and understand the decisions. For high-risk systems, you must provide:

• Clear disclosure: "This credit decision was made by an AI algorithm + human review".
• Accessible reasoning: not "black box"; indicate the top 3-5 factors that influenced the decision.
• Right of appeal: the user has the right to challenge the decision and request human review.

// Frontend: show AI Act-compliant explanation
interface AIDecisionExplanation {
  decision: "APPROVED" | "DENIED" | "MANUAL_REVIEW";
  ai_confidence: number;
  top_contributing_factors: Array<{
    factor: string;     // e.g., "income_to_debt_ratio"
    weight: number;     // 0-1
    impact: "positive" | "negative";
  }>;
  human_reviewer_id: string;
  decision_timestamp: string;
  right_to_appeal: string;  // "You have 30 days to appeal this decision..."
}

// Vue template
<div class="ai-decision-explanation">
  <h3>Your Credit Decision</h3>
  <p v-if="decision.decision === 'APPROVED'" class="approved">
    ✓ Your application has been <strong>approved</strong>.
    This decision was made by an AI system with human review.
  </p>

  <h4>Key factors in your decision:</h4>
  <ul>
    <li v-for="factor in decision.top_contributing_factors">
      {{ factor.factor }}: <strong>{{ factor.impact }}</strong> impact
    </li>
  </ul>

  <p class="appeal">
    <strong>Right to Appeal:</strong> {{ decision.right_to_appeal }}
    <a href="/support/appeal-decision">Submit an appeal</a>
  </p>
</div>
    

Compliance timeline: when to act

The AI Act will enter into force with this phased timeline:

• August 2024: Immediate application (Art. 5 - banned systems).
• February 2, 2025: High-Risk obligations (Art. 8-15).
• February 2, 2026: Full compliance (Art. 49 - transparency requirements).
• February 2, 2027: Full enforcement.

Implication: If you are in the EU and shipping AI systems in 2025-2026, you must already be compliant with High-Risk obligations. Don't wait until 2027.

Exceptions and SME simplifications

The Commission recognizes that startups and SMEs have limited resources. Some simplifications are provided:

• SMEs can delegate technical compliance to a third party (e.g., AI compliance consultant, audit firm).
• Documentation can be simplified for low-stakes or low-volume systems.
• Progressive penalties: first warning, then fine, then system blocking.

However, the principle remains: accountability is yours, as the responsible technical party for the choice.

Tools and best practices

Some open-source tools and frameworks can help:

• ONNX + MLflow: Model traceability and versioning.
• Fairness libraries: AIF360 (IBM), Scikit-fairness (di-test), Ethical AI Toolkit (understand bias).
• Monitoring: Evidently AI (drift detection), WhyLabs (model monitoring SaaS).
• Audit: Third-party AI audit service (EY, Deloitte, specialized startups like Mozilla Foundation).

Final considerations

The AI Act is not the enemy of AI development: it is a framework for responsible AI. The obligations (testing, monitoring, documentation) protect both users and you: they demonstrate that your system is credible, tested, and safe. It is a competitive advantage, not an obstacle.

Start today:

1. Classify your AI system by risk level.
2. If High-Risk, start a Risk Management System.
3. Document: training data, test results, limitations.
4. Setup monitoring: drift, bias, performance.
5. Implement human-in-the-loop for critical decisions.
6. Prepare the technical file for audit.