Ask HN: How are you handling EU AI Act compliance as a developer?
10 comments
The practical answer is: start with classification. Most developers jump straight to "what documentation do I need?" but the first question is whether your system is even high-risk under Annex III.
If it is, you're looking at Annex IV technical documentation — which covers everything from training data governance to accuracy metrics to human oversight mechanisms. It's roughly equivalent to producing a detailed design document for a regulatory audience. A few approaches I've seen teams take: - DIY with the regulation text (free but slow — the Act is 144 pages) - Hire a compliance consultant (thorough but expensive, €200-500/hr) - Use tooling — EuConform is open source and does risk classification. Annexa (https://annexa.eu) parses your actual code files and generates draft Annex IV documentation for €49/month. Credo AI is the enterprise option if budget isn't a constraint. The biggest gap I see is that most teams haven't even done the classification step. If you haven't, that's where to start, it's free on most tools and takes 5-10 minutes.
If it is, you're looking at Annex IV technical documentation — which covers everything from training data governance to accuracy metrics to human oversight mechanisms. It's roughly equivalent to producing a detailed design document for a regulatory audience. A few approaches I've seen teams take: - DIY with the regulation text (free but slow — the Act is 144 pages) - Hire a compliance consultant (thorough but expensive, €200-500/hr) - Use tooling — EuConform is open source and does risk classification. Annexa (https://annexa.eu) parses your actual code files and generates draft Annex IV documentation for €49/month. Credo AI is the enterprise option if budget isn't a constraint. The biggest gap I see is that most teams haven't even done the classification step. If you haven't, that's where to start, it's free on most tools and takes 5-10 minutes.
The biggest challenge I've seen is the gap between "classification" and "documentation." Most teams can figure out whether they're high-risk (Annex III has 8 clear categories), but then they stare at Annex IV's 9 sections of required documentation and don't know where to start.
Practically, I'd recommend: (1) inventory what you already have scattered across design docs, model cards, and Jupyter notebooks — most teams have more than they think, (2) start with Section 2 (development process) and Section 5 (risk management) since those have the biggest gaps, and (3) use the AESIA practical guides from Spain's AI supervisory agency as a reference — Guide 15 specifically covers Annex IV documentation.
For tooling, there's a range: EuConform is open-source and offline-first, Credo AI targets enterprises, and Annexa (annexa.eu) does the full workflow from classification to dossier generation for €49/month. Depends on your budget and how much you want to automate vs. write yourself.
We're building in this space so I'll share what we've learned rather than what we sell.
The fundamental problem with Article 50 compliance isn't knowing the obligations — it's operationalizing them continuously. You can read Article 50 once and understand you need to: (1) notify users they're interacting with AI, (2) mark AI-generated content machine-readably, (3) disclose how decisions are made, and (4) maintain audit trails.
The hard part is proving you actually did all four, consistently, across every agent interaction, in a way a regulator can independently verify. Documentation gets stale the moment you deploy. Logs can be edited. Self-attestation is just a trust claim.
What we've found developers actually need:
157 days isn't a lot of runway.
The fundamental problem with Article 50 compliance isn't knowing the obligations — it's operationalizing them continuously. You can read Article 50 once and understand you need to: (1) notify users they're interacting with AI, (2) mark AI-generated content machine-readably, (3) disclose how decisions are made, and (4) maintain audit trails.
The hard part is proving you actually did all four, consistently, across every agent interaction, in a way a regulator can independently verify. Documentation gets stale the moment you deploy. Logs can be edited. Self-attestation is just a trust claim.
What we've found developers actually need:
Fail-closed defaults. If your compliance check fails or times out, the agent shouldn't silently continue. That's the gap most teams miss.
Machine-readable marking that's actually machine-readable. Not a disclaimer in the chat window — structured metadata a regulator's tooling can parse programmatically.
Tamper-evident audit trails. Append-only, hash-chained, so you can prove nothing was deleted or reordered after the fact. This is the difference between "we logged it" and "we can prove we logged it."
Cross-regulation awareness. If you're in fintech, DORA and AI Act overlap. If you handle personal data, GDPR and AI Act overlap. The compliance surface is the union, not the intersection.
157 days isn't a lot of runway.
Great breakdown. The fail closed point is underappreciated. Are you seeing anyone actually implement hash-chaining in production, or is this still theoretical for most teams? The regulation requires record-keeping but doesn't specify the technical standard, yet.
The cross-regulation surface is what made me build what I built. DORA Article 19 incident reporting (4 hours) + GDPR Article 33 breach notification (72 hours) + AI Act Article 14 human oversight — hitting all three during a live incident with manual lookups is not realistic. That's an API problem, not a legal review problem.
Curious what stack you're using for the audit trail side.
Do share if you want. Dont mind