14 Oct 2026 The EU AI Act for software teams: what you must be able to show
In short: The EU AI Act asks software teams to prove that their AI works as it should, and keeps working. For high-risk systems that means a risk analysis, tested data, documentation, logs, human oversight, accuracy and security tests, and monitoring after go-live. Most of that proof comes from testing. The rules for high-risk systems in areas like hiring and credit apply from 2 December 2027.
Most articles about the EU AI Act are written by lawyers, for lawyers. They explain risk groups and fines. That helps, but a software team still has one question. What do we have to build, test and keep? The answer is evidence, and most of it comes from testing. What follows is not legal advice. Your legal team decides if your system is high-risk. Your testers make the proof once it is.
What is the EU AI Act?
The EU AI Act is a European law that sets rules for AI systems based on their risk. It is Regulation (EU) 2024/1689 and it entered into force on 1 August 2024. The law sorts AI into four groups. Unacceptable risk is banned, like social scoring by governments. High risk is allowed, but with strict rules, like AI that screens job applicants or scores loan applications. Limited risk mostly means you must be open about it, like telling people they talk to a chatbot. Minimal risk, like a spam filter, has no extra duties. Most duties fall on the provider. That is the company that builds the AI system, or has it built, and offers it under its own name. Companies that use a high-risk system are called deployers. They have their own, lighter duties.
Does the AI Act apply to your software?
The AI Act applies to your software when it has an AI system inside that is used in the EU. The real question is how much. Three checks give you a first answer. First, is your use case on the high-risk list in Annex III? That list includes biometrics, critical infrastructure, schools, hiring and staff, credit and insurance, police, migration and courts. AI that is a safety part of a product with its own EU rules, like a medical device or a machine, is high-risk too. Second, does your AI talk to people or create content? Then people must be told they are dealing with AI. Third, are you the provider or the deployer? If you build a chatbot on top of a model from a large vendor, you are usually the provider of that chatbot. The vendor has its own duties for its model.
What must you be able to show?
For a high-risk system you must be able to show that you know the risks, tested against them, and keep checking. The table translates the main articles into the evidence a team produces. Almost every row depends on testing.
| Obligation | What you must be able to show | Who in the team produces it |
|---|---|---|
| Risk management (Art. 9) | A list of risks, and tests that show each risk is under control | Product owner and testers |
| Data and data governance (Art. 10) | Checks on the quality of training and test data, including possible bias | Data team and testers |
| Technical documentation (Art. 11) | How the system works, how it was tested, and the results | Developers and testers |
| Record-keeping (Art. 12) | Automatic logs of what the system did, and proof that logging works | Developers |
| Human oversight (Art. 14) | A person can understand, stop or overrule the system, and you tested that | Product owner and testers |
| Accuracy, robustness, cybersecurity (Art. 15) | Measured accuracy, tests with wrong or unexpected input, security tests such as prompt injection | Testers and security |
| Post-market monitoring (Art. 72) | A monitoring plan and its results, for the whole lifetime of the system | Testers and operations |
| Transparency (Art. 50) | People are told they are dealing with AI; AI-generated content is marked | Product owner and testers |
A lawyer can tell you which rows apply. The proof for each row comes from your tests, your logs and your results over time.
When do the obligations apply?
The rules apply in steps, and some dates moved in 2026. The bans on unacceptable AI and the duty to promote AI literacy have applied since 2 February 2025. Rules for general-purpose AI models have applied since 2 August 2025. The transparency rules, such as telling people they are talking to AI, apply from August 2026. Then came the AI Omnibus, which entered into force on 27 July 2026. It moved the rules for high-risk systems in the Annex III areas, such as hiring, credit and education, to 2 December 2027. High-risk AI built into regulated products follows on 2 August 2028. It also simplified the AI literacy duty for companies. Check the European Commission’s AI Act page for the current timeline before you plan.
What does this mean for your testing?
December 2027 sounds far away, but proof takes time. You can’t make a year of test results in the month before a deadline. Start with the parts that help you anyway. Write down the risks of your AI system. Turn each risk into test questions with clear criteria. Run them on a schedule and keep the results. That is the same loop we describe in our five-step model for testing AI after go-live.
Testing AI is ongoing work, and the law now expects you to show it. That is why we built VeritasAI, our in-house tool for testing AI applications. We use it to test your AI application as a service. It runs your test questions continuously and links every failed answer to the law, regulation or framework it relates to, with a priority score. A management dashboard shows how your AI application does over time. That is the overview a compliance officer asks for. An operational dashboard shows your team which questions fail, with the prompt and the answer. Read more on our AI Compliance Testing page.
Build the evidence the AI Act asks for while you build the product.
Frequently asked questions
Is AI literacy mandatory?
The AI Act has asked organisations to promote AI literacy among staff who work with AI since February 2025. The AI Omnibus of July 2026 simplified this duty for companies and gave the Commission and member states a bigger role. Training the people who use your AI is still wise.
What is a high-risk AI system?
An AI system is high-risk when it is used in an area listed in Annex III. Examples are hiring, credit, education and critical infrastructure. AI that is a safety part of a regulated product also counts. Some systems in those areas are left out when they only do a small task that prepares a decision.
Does the AI Act apply to a chatbot on our website?
Usually only one rule applies: people must know they are talking to AI. If the chatbot makes or prepares decisions in a high-risk area, such as credit or job applications, the high-risk rules apply as well.
What are the fines under the AI Act?
Fines go up to 35 million euros or 7% of worldwide annual turnover for banned AI practices. Most other breaches can cost up to 15 million euros or 3%. Giving wrong information to a regulator can cost up to 7.5 million euros or 1%. Small companies have lower caps.