August 2, 2026. The EU AI Act’s first major compliance deadlines take effect. If your application uses GPT-5.5, Claude, Gemini, or any other LLM API —and your application is accessible in the European Union —this law applies to you. The full text of the EU AI Act is 458 pages. The penalties for non-compliance reach €35 million or 7% of global annual revenue —whichever is higher.
This is not the full legal text. It’s the developer’s translation: what applies to API users specifically, what you must do before the deadline, and a 12-point checklist to prove compliance. For legal advice specific to your product and jurisdiction, consult a qualified lawyer. For understanding what the law requires of your API integration, read on.
Does the EU AI Act Apply to Your API Usage?
The Act classifies AI systems into four risk categories —the European Commission’s AI Act website provides the official regulatory framework and compliance timeline.
Unacceptable risk —prohibited entirely. Social scoring by governments. Real-time biometric surveillance in public spaces. AI systems that manipulate human behavior to cause harm. These don’t apply to typical API usage —if your application falls here, you have larger problems than API compliance.
High risk —strict compliance required. AI systems used in: healthcare (diagnosis, treatment recommendations), hiring and employment (resume screening, candidate evaluation), credit and insurance (loan decisions, risk assessment), law enforcement, education (exam scoring, admissions), and critical infrastructure. If your API-powered application touches any of these domains, you have full compliance obligations.
Limited risk —transparency obligations only. Chatbots, content generation tools, AI-powered search, coding assistants. Users must know they’re interacting with AI. AI-generated content must be labeled. These are the minimum requirements —and they apply to almost every LLM API integration.
Minimal risk —voluntary codes of conduct. AI-powered spam filters, video game AI, inventory management. No mandatory requirements, but voluntary adherence to codes of conduct is encouraged.
Quick self-assessment. Is your application used in healthcare, hiring, credit, law enforcement, education, or critical infrastructure? Yes —high risk, full compliance. No —does a user interact with AI-generated content without clear disclosure? Yes —limited risk, transparency obligations. No —minimal risk, no mandatory requirements.
The GPAI provider angle. OpenAI, Anthropic, Google, and other model providers are classified as “general-purpose AI” (GPAI) providers under the Act. They have their own obligations —documentation, risk assessment, content moderation. Your obligations as a downstream deployer are separate from theirs. Using a compliant provider doesn’t make your application compliant automatically.
What the EU AI Act Requires from API Users
These five requirements apply to high-risk systems. Limited-risk systems only need #1 (transparency).
1. Transparency (Articles 50, 52). Users must know they’re interacting with AI —not a human. AI-generated content must be labeled as such. Implementation: add a visible “AI-powered” label to your chatbot. Tag AI-generated text, images, and audio with machine-readable metadata. For API responses displayed to end users, include a disclosure in the UI. For common implementation questions —what counts as clear disclosure, whether API responses need labeling —see TokSpan’s AI compliance FAQ for practical guidance.
2. Data Governance (Article 10). Training and input data must be relevant, representative, and free from errors to the extent appropriate. In practice for API users: document your prompt design process. Test for bias —does your prompt produce systematically different outputs for different demographic groups? Validate that your input data (the content you send to the API) is appropriate for your use case. This is a documentation and testing requirement, not a training-data requirement —you’re using a pre-trained model via API, not training one.
3. Human Oversight (Article 14). High-risk systems must allow human intervention. Implementation: build an override mechanism. When your AI system makes a recommendation —a candidate to interview, a loan to approve —a human must be able to review and override it. Set confidence thresholds below which the system escalates to a human automatically.
4. Record-Keeping (Article 12). High-risk systems must automatically log: inputs (what was sent to the API), outputs (what the model returned), model version, timestamp, and the rationale for the output where feasible. Retention: minimum 6 months. This is essentially production-grade API logging —something you should be doing anyway for debugging and cost tracking. The TokSpan security guide covers audit logging implementation, including request attribution, cost tracking, and compliance-grade retention policies.
5. Accuracy & Robustness (Article 15). High-risk systems must achieve an “appropriate level of accuracy” and be resilient to errors. In practice: define accuracy metrics for your use case. Test against a representative dataset. Document the error rate. Implement fallback behavior for when the model returns low-confidence or anomalous outputs. This is standard ML engineering practice —the Act makes it a legal requirement.
Compliance Cost Calculator: What Each Risk Tier Actually Costs
These are operational estimates from teams that have already gone through compliance preparation —not legal quotes, which vary by jurisdiction and counsel. All figures in EUR.
Limited risk —transparency only. One-time: €2,000–5,000 for UI updates (AI disclosure labels, content watermarking, metadata tagging). Ongoing: €500–1,000/month for periodic review of disclosures as your UI evolves and new AI features ship. The real cost is engineering time, not legal fees. One senior frontend developer, one sprint. If you already have a design system with reusable components, the UI changes take under a week.
High risk —full compliance. First-year total: €50,000–200,000. Breakdown: legal review and classification opinion (€5,000–20,000), fundamental rights impact assessment (€10,000–50,000), logging infrastructure and audit trail implementation (€15,000–50,000 in engineering time), documentation and registration (€10,000–30,000), bias testing and accuracy benchmarking (€10,000–25,000), AI compliance officer allocation —either a new hire or 30–50% of an existing legal/engineering lead’s time (€50,000–100,000/year). Ongoing annual cost: €20,000–50,000 for monitoring, re-assessment when models or use cases change, and audit preparation. Organizations with existing SOC 2 or ISO 27001 infrastructure may face significantly lower costs, as roughly 40-60% of the compliance work overlaps with existing frameworks.
Minimal risk —near zero mandatory spend. Voluntary codes of conduct have no enforcement teeth. The main “cost” is the 15 minutes it takes to document why your use case qualifies as minimal risk. Do it anyway —if a regulator ever questions your classification, that one-page memo is your first line of defense.
The aggregation platform discount. Using a unified API gateway with built-in EU data residency, audit logging, and provider compliance passthrough cuts the infrastructure portion of high-risk costs by roughly 40–60%. You still pay for legal review, impact assessments, and use-case-specific testing. But the logging infrastructure, data-governance tooling, and multi-provider documentation burden shrink to one integration instead of N.
The 12-Point Compliance Checklist
Classification & Documentation (1–4):
- Classify your AI system’s risk category (unacceptable / high / limited / minimal). Document the classification rationale.
- If high-risk: register the system in the EU database (once operational).
- Maintain technical documentation —system architecture, model used, prompt design, testing methodology.
- Conduct a fundamental rights impact assessment for high-risk systems.
Transparency & Data (5–8): 5. Implement AI disclosure in your UI —users must know they’re interacting with AI. 6. Label AI-generated content —text, images, audio, video —as AI-generated. 7. Document your data sources and prompt design process. 8. Implement bias testing —run your prompts against demographic-varied inputs and check for systematic output differences.
Operations & Oversight (9–12): 9. Implement human override for high-risk decisions. 10. Configure automatic logging —inputs, outputs, model, timestamp, cost —with minimum 6-month retention. 11. Establish an incident response plan —what happens when the AI system produces harmful or erroneous output. 12. Appoint an AI compliance officer if your organization deploys high-risk systems.
How Aggregation Platforms Simplify Compliance
The infrastructure-level security practices covered in our security architecture overview —scoped keys, audit logging, gateway architecture —form the technical foundation that makes compliance logging and data governance practical at scale.
Unified logging for record-keeping. One platform = one log format across all models. Built-in retention. Automated compliance exports. Instead of stitching together logs from five provider dashboards, you have one audit trail that covers Baselines 10 and 4 in the checklist.
Data residency. Choose where your prompts and responses are processed —EU-only data centers for GDPR alignment. Contractual data-processing agreements that cover all underlying providers —one agreement instead of five.
Provider compliance passthrough. When OpenAI or Anthropic update their EU AI Act compliance status —new documentation, new data-use policies —the platform propagates those updates to you. You track one platform’s compliance status, not five providers’ individually.
One caveat: using a compliant platform doesn’t automatically make your application compliant. Your use case, your prompt design, your testing, your transparency disclosures —these are your responsibility. The platform simplifies the infrastructure compliance. The application compliance is still yours.
Enforcement Timeline: What Happens at Each Deadline
| Date | What Happens | What You Should Have Done |
|---|---|---|
| August 2, 2026 | Prohibited practices banned immediately. GPAI provider rules begin —OpenAI, Anthropic, Google must publish training-data summaries and implement content-moderation policies. Limited-risk transparency obligations take effect for all deployers. | Classification complete. AI disclosure labels live in your UI. AI-generated content tagged with machine-readable metadata. If any use case touches a prohibited category, it must be shut down or reconfigured —no grace period. |
| February 2, 2027 | GPAI provider obligations fully enforceable. EU Commission finalizes codes of practice for GPAI providers. These codes become the de facto compliance standard that regulators audit against. | Verify your API providers have published their compliance documentation. If you use multiple providers, confirm each one individually —a missing code-of-practice filing from one provider creates a gap in your compliance chain. |
| August 2, 2027 | High-risk system obligations fully effective for Annex III systems (healthcare, hiring, credit, education, law enforcement, critical infrastructure). Registration in EU database required before deployment. | Full technical documentation filed. Fundamental rights impact assessment complete. Human oversight mechanisms operational. Audit logging running with at least 6 months of retained data. AI compliance officer appointed and onboarded. |
Penalties. Up to €35 million or 7% of global annual turnover for prohibited practices. Up to €15 million or 3% for most other violations —including failing to meet transparency obligations or high-risk requirements. Supplying incorrect, incomplete, or misleading information to regulators: up to €7.5 million or 1%. The EU has confirmed that penalties stack: if your system violates both transparency and high-risk obligations, fines are calculated per violation, not per system.
What to do this month. Classify your use case —this determines everything else. Implement transparency disclosures —the requirement that applies to almost everyone. Start logging —record-keeping takes time to accumulate the required retention period. Open a dialogue with your API providers about their GPAI compliance timeline. You have until August 2027 for full high-risk compliance, but the classification, transparency, and logging foundations need to be in place now.
FAQ
Does the EU AI Act apply to non-EU companies?
Yes —if your AI system’s output is used in the EU. The Act has extraterritorial scope. If you have EU users, it applies to you regardless of where your company is incorporated.
Is using GPT-5.5 via API automatically compliant?
No. The provider (OpenAI) has GPAI obligations. You, as the downstream deployer, have your own obligations based on your use case. Transparency —telling users they’re interacting with AI —is always your responsibility, regardless of what the provider does.
What if I’m just using AI for internal tools?
Internal use is still covered if the tool qualifies as high-risk —HR screening, employee monitoring, workplace safety systems. General productivity tools (coding assistants, writing aids, internal chatbots) are limited-risk or minimal-risk. The transparency requirement applies if the output is surfaced to humans who might reasonably believe it was human-generated.
How do aggregation platforms help with compliance?
Unified logging, EU data residency, contractual data processing, and one compliance dashboard instead of five. They don’t make you compliant automatically. They make compliance manageable. A platform reduces the infrastructure compliance burden. Your application compliance —use-case classification, transparency, testing, oversight —is still yours.
What about the UK after Brexit?
The UK is not subject to the EU AI Act. Instead, the UK has its own “pro-innovation” AI regulatory framework —a principles-based approach distributed across existing regulators (ICO for data, Ofcom for online safety, FCA for financial services). There is no single UK AI statute with penalties comparable to the EU AI Act. However, if your application serves users in both the UK and the EU —which most do —you must comply with the EU AI Act for your EU users regardless of where your company is based. The practical outcome: UK companies serving the EU market still need full EU AI Act compliance. The UK framework adds a separate set of regulator-specific expectations, but the EU obligations are the ones with teeth.
How does this interact with GDPR?
The EU AI Act and GDPR are separate regulations that can apply to the same system simultaneously. GDPR governs personal data —how you collect, process, and store it. The AI Act governs the AI system itself —its risk classification, transparency, and oversight. They overlap in two key areas: data governance (Article 10 of the AI Act requires data quality; GDPR Article 5 requires data minimization and purpose limitation) and transparency (GDPR Articles 13–15 require you to inform individuals about automated decision-making; the AI Act requires AI disclosure). A GDPR-compliant data pipeline doesn’t automatically satisfy AI Act data-governance requirements. If your AI system makes automated decisions about individuals (loan approvals, hiring), GDPR Article 22 gives those individuals the right to human review —which aligns with the AI Act’s human oversight requirement but is enforced separately. Practical advice: run your GDPR and AI Act compliance assessments in parallel. They share enough documentation and process requirements that doing them sequentially doubles the work.
What happens if I don’t comply?
Fines scale with severity and company size. Most first offenses result in corrective action orders —fix the problem by this date —not maximum fines. But the reputational damage of a public enforcement action is often worse than the financial penalty. The EU publishes enforcement actions. “Your AI system violated EU law” is not the press coverage you want.
Step one: open your application’s UI and add a single line of text —“Powered by AI” —visible wherever users interact with model-generated content. That one change satisfies the transparency requirement that applies to nearly every LLM-powered application under the EU AI Act. From there, work through the remaining checklist items in priority order. Classification before logging. Logging before oversight. The deadline is here, but the path is linear.
Secure and comply —EU data residency, unified audit logs, and one compliance dashboard instead of five.