EU AI Act Compliance Checklist for App Developers (2026 Update)

Updated October 2026: this guide reflects the EU AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026. It is general information, not legal advice.

The EU AI Act is no longer a future problem. Its bans on certain AI practices have applied since February 2025, the rules for general-purpose AI models since August 2025, and on 2 August 2026 the regulation's general provisions, including the transparency duties that affect most consumer apps, started to apply.

What didn't start in August 2026 is the heaviest part: the obligations for high-risk AI. In July 2026 the EU adopted the Digital Omnibus on AI, which moved those deadlines to fixed later dates. If you read an older guide that promised "full enforcement on 2 August 2026," it's out of date.

The fines are real: up to €35 million or 7% of global annual turnover, whichever is higher, for prohibited practices. For comparison, GDPR's maximum is €20 million or 4%.

Like GDPR, the AI Act reaches beyond Europe. It applies to providers who place AI systems on the EU market or put them into service there, to deployers located in the EU, and to providers and deployers outside the EU whose AI output is used in the EU. A company in San Francisco serving European users can be just as bound as one in Berlin.

At iHux we build AI apps for ourselves and for clients, so we track this closely. Here's what matters for app developers, in plain language.

The Risk Classification System: Where Does Your App Fall?

Your obligations depend on the risk tier your AI system falls into. Getting the classification right is the most important step.

Unacceptable Risk (Banned)

These practices have been prohibited since 2 February 2025. They include:

• social scoring that evaluates people based on their behavior or personal characteristics;
• manipulative or deceptive techniques, and AI that exploits vulnerabilities linked to age, disability or economic situation;
• untargeted scraping of facial images to build facial-recognition databases;
• emotion recognition in workplaces and educational institutions (with limited exceptions);
• biometric categorization that infers sensitive traits such as ethnicity, political opinions or sexual orientation;
• predicting that an individual will commit a crime based solely on profiling;
• real-time remote biometric identification in publicly accessible spaces for law enforcement purposes, with narrow exceptions.

From 2 December 2026, the Digital Omnibus adds a new ban: AI systems that generate non-consensual intimate imagery or child sexual abuse material.

If your app does any of these things, stop. There is no compliance pathway.

High Risk (Heavy Regulation)

High-risk AI includes systems used in critical infrastructure, education (admissions, assessment), employment (recruiting, performance evaluation), access to essential services (credit scoring, insurance), law enforcement, migration and the administration of justice, and AI that is a safety component of regulated products such as medical devices or machinery.

Requirements include risk management, data governance, technical documentation, record-keeping, transparency to users, human oversight, accuracy and cybersecurity, and a conformity assessment before the system is placed on the market.

New deadlines under the Digital Omnibus:

• 2 December 2027: stand-alone high-risk systems listed in Annex III (the areas above, such as employment and credit scoring).
• 2 August 2028: high-risk AI embedded in products covered by EU product legislation (Annex I).

These are fixed dates. They don't depend on when technical standards are published.

Limited Risk (Transparency Obligations)

This is where most consumer and business apps land, and these rules have applied since 2 August 2026. Under Article 50:

• People must be told they're interacting with AI (for example, a chatbot), unless it's obvious from the context.
• Providers of generative AI must mark synthetic output (text, images, audio, video) in a machine-readable way so it can be detected as AI-generated. Generative systems already on the market before 2 August 2026 have until 2 December 2026 to comply; newer systems have no grace period.
• People must be informed when emotion recognition or biometric categorization is used on them.
• Deepfakes must be disclosed, and AI-generated text published to inform the public on matters of public interest must be labeled, with some exceptions.

Plain recommendation engines are not covered by Article 50.

Minimal Risk (No Additional Requirements)

Spam filters, AI in video games, basic recommendation engines and similar low-impact uses face no additional AI Act requirements beyond existing law. Voluntary codes of conduct are encouraged.

General-Purpose AI Models: What Applies to You

If your app is built on a general-purpose AI model from a third-party provider, most model-level obligations sit with that provider. Since August 2025 they must provide technical documentation, respect EU copyright law and publish a summary of their training data. Models with systemic risk carry extra duties such as adversarial testing and incident reporting.

As an app developer using these models, you should use the model within its documented intended purpose, add safeguards suited to your use case, meet the transparency duties above, and keep records of your risk assessment.

The Practical Compliance Checklist for App Developers

Priority 1: Classification and Assessment (Do This Now)

1. Audit every AI component in your application: every place where AI makes or influences decisions, including third-party AI services and embedded models.
2. Classify each component by risk tier, using the regulation's Annex III and the Commission's guidance. When in doubt, classify higher.
3. Document your reasoning. This record is your first line of defense in any regulatory inquiry.

Priority 2: Transparency (Already Required)

1. Tell users when they're interacting with an AI system, for example with clear labels in chatbot conversations.
2. If you provide a generative AI feature, make its output detectable as AI-generated with machine-readable marking, not just a visual label. For systems already on the market, the deadline is 2 December 2026.
3. Disclose deepfakes and AI-generated public-interest text where Article 50 requires it.
4. As best practice (and partly required under GDPR), explain in your privacy policy which AI features you use and what data they process.

Priority 3: Prepare for High-Risk Obligations (Before December 2027)

If any component is high-risk, use the extra time well:

1. Design human oversight: people must be able to understand, monitor and override AI decisions.
2. Build logging and audit trails that capture inputs, outputs and decision factors.
3. Test for bias and discriminatory impact continuously, as part of your development pipeline.
4. Define what a serious incident means for your product and how you'd report it.
5. Plan for the conformity assessment, which can take months.

The Fine Structure: What's Actually at Stake

Penalties are set out in Article 99 and have applied since 2 August 2025:

• Prohibited practices (any breach of Article 5): up to €35 million or 7% of global annual turnover, whichever is higher.
• Most other obligations, including the Article 50 transparency duties and the obligations of providers, deployers, importers and distributors: up to €15 million or 3%, whichever is higher.
• Supplying incorrect, incomplete or misleading information to notified bodies or authorities in response to a request: up to €7.5 million or 1%, whichever is higher.

For SMEs and start-ups, each fine is capped at whichever of the two amounts is lower, and the Digital Omnibus extends similar relief to small mid-cap companies. Separately, since 2 August 2026 the European Commission can fine providers of general-purpose AI models up to €15 million or 3%.

Beyond Compliance: The Strategic Opportunity

The AI Act's requirements (transparency, human oversight, bias testing, documentation) are also the hallmarks of well-built AI products. Users trust apps that are open about their AI. Enterprise buyers ask for audit trails and human oversight. Bias testing catches quality problems before they become PR problems.

Teams that treat the AI Act as a product-quality framework rather than a legal chore build better products and win more trust, especially in enterprise markets where compliance is part of the buying decision.

The Timeline at a Glance

• 1 August 2024: the AI Act enters into force.
• 2 February 2025: prohibited practices banned; AI literacy duties begin. (The Digital Omnibus has since softened the literacy duty to taking measures that support AI literacy.)
• 2 August 2025: rules for general-purpose AI models apply; governance and the penalty regime apply.
• 27 July 2026: the Digital Omnibus on AI enters into force.
• 2 August 2026: general application, including the Article 50 transparency duties and the Commission's fining powers for general-purpose AI models.
• 2 December 2026: machine-readable marking deadline for generative systems already on the market; ban on AI that generates non-consensual intimate imagery or child sexual abuse material.
• 2 December 2027: obligations for stand-alone high-risk systems (Annex III).
• 2 August 2028: obligations for high-risk AI in regulated products (Annex I).

Where to Start

Start your risk classification this week, make sure your transparency duties are covered (they apply to almost everyone and are already in force), and if you suspect any high-risk use, bring in legal counsel early. December 2027 sounds far away, but conformity work takes months.

At iHux we build AI Act considerations into the development process for every product we ship, because it costs far less than retrofitting compliance after launch. If you're building an AI-powered app and want a partner who thinks about this from day one, talk to us.