Does the EU AI Act apply to teams using AI coding assistants?

Using Copilot or Claude Code to write ordinary software is generally not itself a high-risk AI use under the Act. But the Act reaches engineering teams indirectly: if AI-assisted code ships inside products the Act classifies as high-risk, if your enterprise customers flow oversight requirements down through procurement, or if your organisation adopts the Act's human-oversight and logging standards as internal policy — which most regulated enterprises are doing.

What does the EU AI Act require for human oversight?

Article 14 requires that high-risk AI systems be designed so humans can effectively oversee them: understand outputs, intervene, and override or halt the system. For delivery teams the practical translation is policy-routed human approval of consequential AI-driven changes, with the ability to stop a release, and records proving oversight happened.

What records does the EU AI Act require?

Article 12 requires automatic logging of events relevant to identifying risks and tracing how outputs were produced, retained for appropriate periods. In delivery terms: an immutable log of what the AI changed, what checks it passed, who approved it, and when — generated continuously, not reconstructed at audit time.

Compliance guide

The EU AI Act for Software Delivery Teams

By Suralal S, VP of Technology · Updated July 2026

This guide is practical engineering context, not legal advice. The Act's application to your organisation depends on facts only your counsel can assess — use this to arrive at that conversation prepared.

For software delivery teams, the EU AI Act matters through three articles: Article 14 (humans must be able to effectively oversee, intervene in, and halt AI systems), Article 12 (automatic logging that makes AI behaviour traceable), and Article 9 (continuous risk management). If AI writes and ships a large share of your code, the practical translation is: policy-routed human approvals, an always-on evidence log, and risk scoring of AI-driven changes.

Most engineering leaders have heard two versions of the EU AI Act: "it doesn't apply to us" and "it changes everything." Both are wrong in interesting ways — and the truth arrives on a schedule.

The timeline that matters

Aug 2024

Act entered into force.The clock started; nothing enforced yet.

Feb 2025

Prohibited practices banned; AI literacy obligations began.Rarely relevant to delivery teams directly.

Aug 2025

Obligations for general-purpose AI models began.Mostly affects model providers — the tools you buy, not you.

Aug 2026

High-risk system obligations apply.Human oversight, logging, risk management, conformity assessment — the articles this guide covers. This is next month.

Aug 2027

Extended transition ends for high-risk AI embedded in regulated products.

Does this actually apply to your team?

Honest answer: using Copilot or Claude Code to write ordinary software is not, by itself, a high-risk AI use. The Act's high-risk categories (Annex III) cover AI in things like credit scoring, hiring, medical devices, and critical infrastructure — not AI that helps write a web app.

But the Act reaches delivery teams through three side doors, and at least one probably applies to you:

Your product is the high-risk system. If AI-assisted code ships inside software the Act classifies as high-risk (fintech decisioning, health, HR tech, infrastructure), the traceability and oversight obligations attach to how that code was produced and maintained.
Procurement flows it down. Enterprise customers subject to the Act are already adding AI-oversight clauses to vendor contracts. "Show us how AI-generated code is reviewed and logged" is becoming a security-questionnaire staple, next to the SOC 2 request.
Your own governance adopts it. Most regulated enterprises are applying Article 14/12-style standards internally to all AI use — because maintaining two standards is more expensive than maintaining one.

The three obligations, translated to delivery

Article 14 — Human oversight

The Act requires that humans can effectively oversee AI systems: understand what they produce, intervene, and override or stop them. Note the word effectively — a human rubber-stamping 400 AI PRs a week is oversight in name only, and regulators have said as much. The compliant pattern is the one that also happens to scale: policy decides which AI-driven changes require human judgment, those changes route to a named person with evidence attached, and that person can hold the release.

Article 12 — Logging and traceability

Automatic recording of events sufficient to trace how outputs were produced and identify risk. In delivery terms: what did the AI change, what gates did it pass, who approved it, when, and on what basis — logged as it happens. If your answer today is "we could reconstruct that from GitHub if we had to," you don't have Article 12 logging; you have archaeology.

Article 9 — Risk management

A continuous, iterative process — not an annual review. For delivery: risk scoring on changes (AI-authored ones scored separately, since their failure modes differ), monitored trends, and gates that tighten automatically where risk accumulates.

The implementation checklist

Attribute AI-authored changes at commit time — traceability starts with knowing which changes were AI's. (Policy 1 in our policy playbook.)
Define oversight routing — write down which changes require a named human's approval, and enforce it mechanically, not socially.
Prove the override works — you need to be able to show a human can halt a release. A gate that has never blocked anything is hard to defend as effective oversight.
Run the evidence log from today — every gate result, approval, and override recorded immutably. Retention aligned with your framework.
Score AI-authored risk separately — and keep the trend line; Article 9 wants a process, not a snapshot.
Prepare the procurement answer — a one-page description of the above, ready for the next security questionnaire that asks.

Teams that already run AI delivery governance will notice this checklist is just… their pipeline. That is the quiet convergence happening in 2026: what the regulator calls human oversight and logging, engineering calls policy gates and an evidence log. Build it once, and it serves the auditor, the enterprise customer, and your own sleep equally.

Oversight and evidence, running by next week

DryDock's agents enforce oversight routing, log every decision as exportable evidence, and score AI-authored risk continuously — the Article 14/12/9 pattern, as a working pipeline instead of a compliance project.

Request early access