AI Regulation for Builders
What the EU AI Act and other rules mean in practice for small teams: risk tiers, transparency duties, and the documentation worth keeping anyway.
Most AI regulation was written with someone else in mind: the companies training frontier models, or banks and governments making decisions about people. So it's tempting for a small team to assume none of it applies. Some of it doesn't. But a few obligations land squarely on ordinary product teams, often on features that look harmless, and your customers' procurement teams will ask about all of it whether the law requires it or not.
This lesson is a builder's map, not legal advice. You'll learn how the EU AI Act sorts AI uses into risk tiers, how to tell where your features fall, which transparency duties you'll actually implement in code, what's happening outside the EU, and the small set of records that make every future compliance question cheaper to answer. When a decision matters, talk to a lawyer for your situation.
Why rules attach to the use, not the model
The single most useful idea in AI regulation is that obligations follow the use case, not the technology. The same model call can be unregulated in one feature and heavily regulated in another.
Take Deskmate, the help-desk app we use as a running example. All three of these features could run on the same model with nearly the same code:
| Feature | What it does | Likely regulatory weight |
|---|---|---|
| Ticket summaries | Summarizes threads for support agents | Light: internal productivity tool |
| Help-center chat | Answers customers' questions on your site | Moderate: people must know they're talking to an AI |
| "Hiring mode" add-on | Ranks job applicants who email a careers inbox | Heavy: hiring is a high-risk use in the EU |
That third row is the trap. Nobody sets out to build a regulated system; a customer asks for a new use of an existing feature, sales says yes, and the product quietly changes category. Knowing which uses carry weight is how you catch that before it ships.
This also explains why you can't outsource compliance to your model provider. They have obligations as a model provider. You have obligations for what you build with the model, because only you decide the use.