AI Act

For a while, adding an AI feature was purely an engineering question. You called a model, wired it into a screen, and the only thing anyone argued about was whether the output was good enough. Rules about personal data already existed, but those rules covered where information was stored and how long it was kept. They said nothing about a machine making a judgment in place of a person.

So the discussion kept stalling at the same point. Theo would say that handing resume screening to a model would cut review time in half, Grace would ask whether that was legal, and with nobody able to answer, the meeting would end on "let's be careful with it." Careful has no threshold, so inside one company some teams were pasting customer documents into a model while other teams were not allowed to start at all.

The AI Act is a government writing the answer down. How it writes that answer defines the law's character: it sorts features by what they do to a person, not by which technology produced them. Two features calling the same model can end up carrying completely different obligations.

The law assigns a risk level to each use and attaches a different set of duties to each level. What sets the level is not how capable the model is but how far the feature reaches into someone's life. Two buildings made of the same brick face different fire codes depending on whether one is a warehouse and the other a daycare. The material is not the test; what happens inside is.

The duties usually fall into three tiers.

1. Uses that are simply off the table — secretly reading people's emotions, or scraping faces from across the internet to assemble a lookup list of identities. There is no set of conditions that unlocks these, so redesigning around them does not help.
2. Uses allowed only under conditions — hiring, lending, and academic admissions, where a judgment decides one person's opportunity. You document what data the system was built on, keep a human in the loop so a person reviews and approves the result, and retain records of which input produced which output.
3. Uses that only need disclosure — summarizing meeting notes, drafting text, anything where the output is light. A model transparency notice saying the text came from AI rather than a person is the whole requirement.

The line between tiers sits closer than teams expect. A feature that compresses ten pages of notes into five lines is tier three. Feed applications to the same model and ask it to pick the top 20 candidates and you are in tier two. Same model, similar code, but one ships with a single label and the other needs a data inventory, a review step, and stored records.

Tier two carries the heavy duties because tier two is where things actually go wrong. AI bias — training data skewed one way, so results land unfavorably on one group — is the classic failure. Disputes over training data rights, meaning the copyright and permitted use of the material a model learned from, break in the same tier. The requirement to list your data sources exists so that someone can trace the cause after a failure instead of guessing.

Europe wrote this kind of law first and other countries are following. If you sell into several markets, building one version against the strictest one usually means less rework later than maintaining a different answer per country.

It surfaces first when a team decides which tier a feature belongs to, before the feature is built. The spec gets a line naming what the feature decides, and if the answer is a judgment that shapes someone's opportunity, the review step and the record keeping go into the schedule from the start. Ask the question after the build and you have to stop something that is already running on its own.

The second place it appears is in enterprise contracts. Security questionnaires now include items asking for the risk level of your AI features and how they are disclosed, and a contract stops at that item when nobody can answer it. This is where Sofia comes looking for Theo.

It comes up once more in the pre-launch check: whether the disclosure text is on the screen, whether the sources are shown alongside the output so users can catch hallucination — a confident answer that happens not to be true — and whether the records are really accumulating. Building the feature is the job of AI engineering; this law decides whether what was built is allowed out the door.

"If this lands as high risk, launch slips a month. Can we make it recommend instead of decide?"

A proposal to lower the tier by narrowing what the feature does, rather than meeting the full set of conditions.

"A European customer asked for this feature's risk level. Do we have a company-wide answer?"

A request for a written classification standard so the answer doesn't change from deal to deal.

"Summaries just need the label. Automatic rejection doesn't."

Same model, different effect on a person, different obligations.

At Pagedeck the term came up in earnest over a feature that pulled owners and due dates out of meeting notes and assigned the work automatically. Mia read it as the same shape as the summary feature until Grace asked whether the person assigned could undo that decision. Assigning work touches performance reviews, which made it hard to keep in the same tier as a summary.

The team didn't drop the feature; they changed its role. Proposing candidates and letting a lead confirm them took the whole regulatory review off the table.

The easiest mistake is assuming that using someone else's model puts the responsibility on whoever built it. You didn't train anything and you are calling an interface the way the documentation says to, so the reasoning feels sound. But the duties attach to the use, and the company that chose the use is the one shipping the feature. Carrying this assumption means that when something breaks, time goes into waiting for an answer from the model provider while the feature keeps running exactly as before.

The other common read is that a European law has nothing to do with a company based elsewhere. In practice it applies once you sell to users in Europe, and the enterprise security questionnaire asks about it before the law ever does. The General Data Protection Regulation (GDPR), Europe's rule set for personal data, already reshaped signup screens and privacy notices for companies that never opened a European office.