---
title: "EU AI Act for Product Managers in 2026"
description: "EU AI Act for product managers: the four risk tiers, provider vs deployer, Article 50 disclosure, fines up to 7 percent, and high-risk dates moved to 2027."
canonical_url: "https://builderscamp.com/guides/other/eu-ai-act-for-product-managers"
date_published: "2026-10-19"
date_modified: "2026-10-19"
author: "Andre Albuquerque"
publisher: "Builders Camp"
guide_class: "other"
---

# EU AI Act what product managers need to know

**TL;DR:** Your first decision under the EU AI Act is which of the four risk tiers your feature falls into, because that tier decides whether the law asks for nothing, a disclosure, or a full high-risk compliance programme. The general rules have applied since 2 August 2026, including the Article 50 transparency duties, while the Digital Omnibus on AI, in force since 27 July 2026, moved most high-risk obligations to 2 December 2027 and 2 August 2028.

The EU AI Act sorts AI by what it is used for, and that sorting is a product decision before it is a legal one. The European Commission's [AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) states that "The AI Act defines 4 levels of risk for AI systems", and the tier your feature lands in sets everything that follows: banned, heavy obligations, a disclosure duty, or no new rules at all.
Regulation (EU) 2024/1689, the [Artificial Intelligence Act on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2024/1689/oj), backs the tiers with fines of up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices.

The dates moved in 2026. Regulation (EU) 2026/1744, the [Digital Omnibus on AI](https://eur-lex.europa.eu/eli/reg/2026/1744/oj), was signed on 8 July 2026, published in the Official Journal on 24 July 2026, and entered into force on 27 July 2026. Under the original 2024 text, the Annex III high-risk rules would have applied from 2 August 2026; under the amended text, they do not. This page is a product manager's reading of the regulation and the Commission's own guidance, not legal advice. Use it to ask better questions of your legal team, not to replace them.

## What are the four risk tiers, and which one is your feature in?

The four tiers in the Commission's [regulatory framework page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) are unacceptable risk, high risk, transparency risk, and minimal or no risk. Each one maps to a different amount of work for your team.

| Tier | Examples from the Act and the Commission | What applies | Applies from |
|---|---|---|---|
| Unacceptable (banned) | Social scoring, emotion recognition in workplaces and schools, untargeted scraping to build facial recognition databases | Prohibited outright (Article 5) | 2 February 2025; two new bans from 2 December 2026 |
| High risk (Annex III use cases) | Recruitment screening, credit scoring, life and health insurance pricing, exam proctoring, emergency call triage | Risk management, data quality, logging, documentation, human oversight, conformity assessment | 2 December 2027 |
| High risk (Annex I products) | AI used as a safety component of, or as, a product covered by EU product safety law, such as lifts or toys | Same requirements, through product safety rules | 2 August 2028 |
| Transparency | Chatbots, AI-generated images, audio, video and text, deepfakes | Disclosure and machine-readable marking (Article 50) | 2 August 2026 |
| Minimal or no risk | Spam filters, AI in video games | No new rules under the Act | Not applicable |

Most features land in the bottom two rows. The [Commission's AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) says of the minimal tier that "The vast majority of AI systems currently used in the EU fall into this category." That does not make the exercise pointless: the cost of a wrong answer is asymmetric. Treating a minimal-risk feature as high-risk wastes a quarter. Treating a recruitment screener as minimal risk ships an unregistered high-risk system.

## How does an Annex III use case make a feature high-risk?

A feature is high-risk under Annex III when its intended purpose falls in one of eight areas listed in [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj): biometrics, critical infrastructure, education and vocational training, employment and workers' management, access to essential private and public services, law enforcement, migration and border control, and the administration of justice and democratic processes. The word that matters is "intended". A general chat assistant is not high-risk because someone could paste a CV into it; a feature you build and market to rank job applicants is.

Article 6(3) gives an exit. An Annex III system is not high-risk when it does not pose a significant risk of harm, for example when it performs a narrow procedural task, improves the result of a human activity already completed, or performs a preparatory task for a human assessment. Two limits stop that exit from becoming a loophole. A system that profiles people is always high-risk, and a provider using the exception has to document the assessment before launch and register the system in the EU database. If your team is debating the exception, write the reasoning down the way you would write a PRD decision, and get legal to sign it.

## Are you the provider or the deployer of your AI feature?

Article 3 of [the AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) defines a provider as the person or body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer is anyone using an AI system under its authority in a professional context. A company that builds a feature on a third-party model and ships it under its own brand is, on that reading, in provider territory for the feature, even though another company provides the model. Confirm your own role with counsel; a lot of obligations hinge on it.

The role can also change after launch. Article 25(1) makes a deployer or other third party the provider of a high-risk system when they put their name or trademark on it, make a substantial modification to it, or change the intended purpose of a system so that it becomes high-risk. That last one is a roadmap risk. Repositioning a general HR assistant as a candidate-ranking tool is a product decision that can move your company from deployer to provider overnight.

Deployers of high-risk systems carry their own duties under Article 26 of the [AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj): use the system according to its instructions for use, assign human oversight to people with "the necessary competence, training and authority", make sure input data they control is relevant and sufficiently representative, monitor the system, and suspend it and inform the provider and the market surveillance authority when it presents a risk.

## What changed when the Digital Omnibus on AI became law?

The Digital Omnibus on AI started as a Commission proposal adopted on 19 November 2025, reached political agreement on 7 May 2026, and entered into force on 27 July 2026, according to the [European Commission's AI Act page](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai). It is adopted law, not a pending proposal.
For product teams, five changes in [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/eli/reg/2026/1744/oj) matter most:

- **High-risk dates moved.** Annex III high-risk rules now apply from 2 December 2027 instead of the original 2 August 2026, and Annex I product rules from 2 August 2028 instead of 2 August 2027.
- **A grace period for generative output marking.** Providers of systems generating synthetic audio, image, video or text that were placed on the market before 2 August 2026 have until 2 December 2026 to comply with the machine-readable marking rule in Article 50(2).
- **Two new prohibitions.** AI systems that generate non-consensual intimate imagery of an identifiable person, or child sexual abuse material, are banned from 2 December 2026.
- **AI literacy rewritten.** Article 4, as replaced by the [omnibus](https://eur-lex.europa.eu/eli/reg/2026/1744/oj), now asks providers and deployers to "take measures to support the development of AI literacy of their staff", replacing the earlier duty to ensure a sufficient level of literacy.
- **Lighter treatment for small mid-caps.** Simplifications that applied to SMEs, such as simplified technical documentation and the lower-figure rule for the 15 million and 7.5 million euro fine tiers, now extend to small mid-cap companies.

None of the omnibus changes moves the Article 50 transparency date or the general date of application. If your feature is a chatbot or generates content, your obligations did not get a delay, apart from the marking grace period for systems already on the market.

## What does Article 50 transparency mean for a chatbot or generative feature?

Article 50 of [Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) sets four disclosure duties, and two of them land on the provider's product spec. Providers must design systems that interact directly with people so that "the natural persons concerned are informed that they are interacting with an AI system", unless that is obvious from the context. Providers of systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format so it is detectable as artificially generated or manipulated.

The other two land on deployers: anyone deploying emotion recognition or biometric categorisation has to inform the people exposed to it, and anyone publishing deepfakes, or AI-generated text meant to inform the public on matters of public interest, has to disclose that it was generated. The text disclosure does not apply where the content went through human review or editorial control and someone holds editorial responsibility.

For a PM, the practical translation is short. Disclosure copy goes in the PRD as a requirement, output marking goes in the engineering spec, and both get a test before launch. The [AI feature launch checklist](https://builderscamp.com/guides/other/ai-feature-launch-checklist) already carries disclosure as a launch gate, and [how to write a PRD for AI features](https://builderscamp.com/guides/templates/how-to-write-a-prd-for-ai-features) shows where to specify it.

## How big are the fines, and who can be fined?

Article 99 of the [AI Act](https://eur-lex.europa.eu/eli/reg/2024/1689/oj) sets three ceilings, and for a large company the higher of the fixed amount or the turnover percentage applies.

| Infringement | Maximum fine | Share of worldwide annual turnover |
|---|---|---|
| Prohibited AI practices (Article 5) | 35 million euros | 7 percent |
| Obligations of providers, deployers and others, including Article 50 transparency | 15 million euros | 3 percent |
| Incorrect, incomplete or misleading information to authorities | 7.5 million euros | 1 percent |

For SMEs and start-ups the lower of the two figures applies, and the omnibus extends that rule to small mid-caps for the second and third rows. The ceilings are maximums, not tariffs. Article 99 tells authorities to weigh the nature, gravity and duration of an infringement, and Member States set the national penalty rules. Treat the table as a measure of how seriously the EU ranks each failure, which is also the right order for your own risk review.

## What should a product manager do this quarter?

A risk classification you can defend beats a compliance programme you cannot explain. Four moves cover most product teams:

- **Inventory every AI feature and its intended purpose.** Write one sentence per feature on what it is for and who it affects, then map it to a tier. Features near an Annex III area get a written Article 6(3) assessment.
- **Settle provider or deployer per feature.** Include vendor contracts in the review: the role you hold decides which articles you read next.
- **Ship Article 50 disclosures now.** Chatbot disclosure and output marking are live obligations since 2 August 2026, so they belong in the current sprint, not the 2027 plan.
- **Use the high-risk delay to build evidence, not to wait.** The obligations the Commission lists for high-risk systems, including risk management, dataset quality, logging and human oversight, are things your evals and monitoring either already produce or do not.

The fourth point is where product craft and regulation meet. Teams that already run evals, log decisions and test outcomes by user group, as [ethical considerations in AI product management](https://builderscamp.com/guides/other/ethical-considerations-in-ai-product-management) and [how to write evals for AI products](https://builderscamp.com/guides/tools/how-to-write-evals-for-ai-products) describe, will find most of the high-risk evidence trail is a documentation job. Teams that do not will find it is a rebuild, and December 2027 is closer in sprint terms than it looks.

## Frequently asked questions

### Does the EU AI Act apply to my product if my company is not based in the EU?

It can. Article 2 of Regulation (EU) 2024/1689 covers providers placing AI systems on the EU market whether or not they are established in the EU, and providers and deployers outside the EU where the output of the system is used in the EU. If you have EU users, assume the question applies to you and get a legal answer for your specific product.

### Were the high-risk deadlines delayed, or is that still only a proposal?

The delay is adopted law. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moves the Annex III high-risk rules to 2 December 2027 and the rules for AI in products covered by Annex I to 2 August 2028.

### Do I have to tell users they are talking to a chatbot?

Article 50(1) requires providers to design AI systems that interact directly with people so those people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed person from the context. The European Commission says the transparency rules come into effect in August 2026, so treat the disclosure as a product requirement now.

### What are the maximum fines under the EU AI Act?

Article 99 sets three ceilings: up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices, up to 15 million euros or 3 percent for breaches of obligations such as those of providers, deployers and the Article 50 transparency rules, and up to 7.5 million euros or 1 percent for supplying incorrect or misleading information to authorities. For large companies the higher figure applies; for SMEs, and since the omnibus for small mid-caps on the lower two tiers, the lower figure applies.

### Is a feature that uses an LLM automatically high-risk?

No. Risk follows the use case, not the model. An LLM-powered writing assistant sits in a very different place from an LLM that screens job applications, which falls under the employment area of Annex III. The general-purpose AI model rules bind the model's provider, and they are a separate track from the risk tier of the feature you build on top.

### Can a product team decide on its own that an Annex III feature is not high-risk?

Article 6(3) allows an Annex III system to fall outside high-risk when it does not pose a significant risk of harm, for example when it only performs a narrow procedural task or a preparatory task. A system that profiles people is always high-risk, and a provider relying on the exception must document its assessment before launch and register the system. That is a decision to make with legal, with the reasoning written down.

### Does the AI Act require AI training for my team?

Article 4, as replaced by the Digital Omnibus on AI, requires providers and deployers to take measures to support the development of AI literacy of their staff and others operating AI systems on their behalf, taking into account their knowledge and the context of use. The original wording, applicable since 2 February 2025, asked for a sufficient level of AI literacy; the amended text is softer but still an obligation.

## Sources

- [Regulation (EU) 2024/1689, the Artificial Intelligence Act (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)
- [Regulation (EU) 2026/1744, the Digital Omnibus on AI (EUR-Lex)](https://eur-lex.europa.eu/eli/reg/2026/1744/oj)
- [European Commission: AI Act, regulatory framework for AI](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai)

## How this guide was made

Researched from Builders Camp's bootcamp, track and masterclass material and the sources listed on this page, drafted with AI, and fact-checked against every source cited.