EU AI Act Engineering Guide: Prohibited Practices, High-Risk Systems and Transparency

This guide maps all four EU AI Act Matrix controls: prohibited-practice guards (eu-ai-1), high-risk classification (eu-ai-2), Article 50 transparency (eu-ai-3), and lower-risk and shadow-AI inventory (eu-ai-4). The Act has staged application dates; confirm the obligation and timeline for your role and deployment with counsel. The primary source is Regulation (EU) 2024/1689.

1. Block prohibited use cases before deployment (eu-ai-1)

Require a product owner to classify a proposed use case before model credentials are issued.

const prohibitedPurposes = new Set(['social-scoring', 'workplace-emotion-recognition']);
export function approveAiUseCase(input: { purpose: string; owner: string }) {
  if (prohibitedPurposes.has(input.purpose)) throw new Error('Use case requires legal review; deployment blocked');
  return { ...input, approvedAt: new Date().toISOString() };
}

The guard is a routing control, not a legal classification engine. Preserve its review decision and evidence.

2. Classify and govern high-risk candidates (eu-ai-2)

Maintain a versioned assessment covering intended purpose, affected people, Annex III relevance, human oversight, data governance, evaluation evidence, and change history. A model update, new deployment context, or new data source should reopen review.

3. Make AI interaction and generated content transparent (eu-ai-3)

Design the disclosure into the interface and API contract instead of relying on documentation.

export function withAiDisclosure<T>(output: T) {
  return { output, generatedByAi: true, disclosureVersion: '2026-09' };
}

Store whether a disclosure was shown, not the user’s complete conversation by default. Article 50 governs transparency obligations in defined cases; confirm scope for each feature.

4. Inventory approved AI and detect shadow AI (eu-ai-4)

Use an allowlist with owner, vendor, purpose, data classification, approval date, and review date. Couple it to egress controls so unapproved AI endpoints fail closed or enter a review queue.

export const approvedAiServices = new Map([
  ['approved.example', { owner: 'security', dataClass: 'no-personal-data', reviewDue: '2027-01-01' }]
]);

Verification checklist

• No production key exists without an inventory entry and accountable owner.
• Release review captures model/version, intended purpose, and human-oversight evidence.
• AI disclosure is covered by UI and API contract tests.
• Unapproved egress is blocked or logged without sending prompt content to telemetry.