The EU AI Act, Decoded: What It Means for Product Managers and Delivery Leads

ISSUE 06: This Week: what applies, who it applies to, and what changes in your roadmap and your release process.

The EU AI Act is now in force, enforceable, and partly postponed, all at once. For product managers and delivery leads, the most useful way to read it is as a set of product requirements and delivery practices, with dates attached. This issue walks through what applies, who it applies to, and what changes in your roadmap and your release process.

Where things stand in October 2026

The Digital Omnibus on AI, Regulation (EU) 2026/1744, was adopted on 8 July, published in the Official Journal on 24 July and entered into force on 27 July 2026. It pushed back the high-risk rules and left most of the timetable unchanged

Enforcement has started quietly. On 2 August 2026, the Commission's AI Office and national authorities began enforcing the Act. In late August, the AI Office sent information requests to more than 30 AI providers about safety, security and training practices. No fines have been issued so far. You may see websites claiming tens of millions of euros in "first AI Act fines". I could find no official source for them, and the high-risk rules they describe do not apply until December 2027.

First, Let’s answer the following three questions

Before anyone writes a compliance plan, a product manager can answer three questions about each AI feature.

1. Does the Act reach you? It also covers providers and deployers outside the EU. Article 2(1)(c) brings in "providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union." A team in Pune or Dubai whose system scores, ranks, or advises people in Europe is in scope.

2. Is it high-risk? Annex III lists eight areas: biometrics, critical infrastructure, education, employment, access to essential services such as credit and some insurance, law enforcement, migration, and justice and democratic processes. A system that profiles people "shall always be considered to be high-risk", and a provider using the exception must document its reasoning before release and still register the system.

3. Are you the provider or the deployer? The provider develops the system, or has it developed, and puts it on the market "under its own name or trademark". The deployer is the organization "using an AI system under its authority". Most product companies are providers of what they sell and deployers of what they buy. Each role carries its own list of duties, so answer the question per system.

Building on foundation models

Most AI features today are built on a model from OpenAI, Anthropic, Google, Mistral, or an open-weight family. The Act splits responsibility between the company that trains the model and the team that builds the product.

OpenAI, Anthropic, Google, Mistral, and other model providers have carried these obligations since August 2025. A model is presumed to carry systemic risk, and its provider must also run evaluations, adversarial testing, and incident reporting. A voluntary Code of Practice published in July 2025 sets out how to meet these duties. The Commission lists 21 signatories, including Amazon, Anthropic, Google, IBM, Microsoft, Mistral AI and OpenAI. Meta declined to sign.

Two points that matter for product teams are listed below:

You are owed information. Article 53 and Annex XII require model providers to give downstream builders documentation covering, among other things, intended tasks, acceptable use policies, input and output formats, context limits, and the type and provenance of training data. Put these items on your vendor-selection checklist and ask for them in procurement.

You can become the provider of a high-risk system without training anything. Article 25(1)(c) makes a deployer or other third party the provider when "they modify the intended purpose of an AI system, including a general-purpose AI system" so that it becomes high-risk. Point a general chat model at CV screening or credit decisions and your team takes on the provider duties for that use. Fine-tuning is treated more lightly: the Commission's guidelines say you become a provider of the model itself only in exceptional cases, when the modification uses more than one third of the original model's training compute.

For PRODUCT MANAGERS

The product manager will need to understand the “intended purpose” in "promotional or sales materials and statements", as well as in the instructions for use and technical documentation. Agree on the intended purpose with legal, document it, and keep marketing copy consistent.

For DELIVERY LEADS

Delivery leads will recognize most of what the Act asks of providers, because it describes a disciplined delivery system.

Quality management (Article 17). Providers need a “documented quality management system” covering thirteen aspects, from design control and test procedures to data management, post-market monitoring, incident reporting and an accountability framework. If your teams already run explicit policies, a Definition of Done and regular reviews, you have the skeleton of one.

Technical documentation (Article 11 and Annex IV). You must prepare the documentation before release and keep it up to date. Treat it as a living artifact that each release updates.

Change control. A "substantial modification" after release triggers a new conformity assessment (Article 43(4)). Changes that were pre-determined and documented at the initial assessment do not count. This rewards teams that plan their model-update strategy up front and document it.

Conformity assessment. For most Annex III systems, it is internal control: the provider assesses itself, with no notified body (Article 43(2)). Biometrics is the main exception. Self-assessment puts the burden of evidence on your own records.

Monitoring and incidents. Providers must collect and analyze performance data over the system's lifetime (Article 72). Providers must report serious incidents to the market surveillance authority no later than 15 days after becoming aware.

NIST AI Risk Management Framework 1.0 (January 2023) is voluntary and organized around four functions: Govern, Map, Measure, and Manage.

ISO/IEC 42001 sets out an AI management system. Certification alone does not show conformity with the Act.

EN 18286:2026 is the standard written specifically for the Act. CEN-CENELEC calls it "the first standard in support of the implementation of the AI Act", covering the quality management system for AI Act purposes. Until it appears in the Official Journal, it carries no formal presumption of conformity, but it is the closest thing to an official blueprint for Article 17. More standards on risk, logging, cybersecurity, data and bias are still in progress.

Can the Act slow products down?

Companies expect the Act to be a burden. In Bitkom's September 2026 survey of 603 German companies, 66% said the AI Act brings more disadvantages than advantages, up from 56% a year earlier. Among companies affected or still checking, 89% expected high implementation effort. Littler's November 2025 survey of more than 400 European executives found just 18% saying their organization was very prepared to comply, while 20% said they were not prepared at all.

The evidence on product launches is more nuanced. GovAI studied 375 model releases from Meta, Google, OpenAI and Anthropic between 2018 and May 2026. It found 11% were delayed or not released in the EU, and concluded that "Data protection regulation appears to be the main regulatory barrier". On the AI Act specifically: "We find no strong evidence of other regulations, including the EU AI Act, causing delays or non-releases." The best-known EU delays, such as Apple Intelligence and Meta AI, were tied to the Digital Markets Act and GDPR.

The view from India

Neither country has an AI law like the EU's, and both have chosen lighter, principle-based approaches.

India. MeitY released the India AI Governance Guidelines on 5 November 2025, built on seven principles including trust, people first, accountability and "understandable by design". The guidelines say plainly that "a separate law to regulate AI is not needed given the current assessment of risks", while calling for consistent enforcement of existing laws. The Digital Personal Data Protection Rules, notified on 14 November 2025, bring in an 18-month phased compliance timeline.

What to do this quarter

• List every AI feature and every AI tool you buy, with its intended purpose in one sentence
• Mark which ones produce output used in the EU
• Check each against the eight Annex III areas with your legal team, and record the reasoning
• Decide, per system, whether you are provider, deployer or both
• Ask your model vendors for the Annex XII documentation you are entitled to
• Ship AI interaction notices and content marking before 2 December 2026
• Add AI checks to Definition of Done
• Plan role-based AI literacy, which has been a legal duty since February 2025

Where ProvCraft fits

At ProvCraft I work alongside legal advisers on the delivery side: building an inventory of AI systems, turning the requirements into backlog items and release checks, and coaching the product managers and delivery leads who own them. For role-based AI literacy and for SAFe, Kanban and ICAgile certification, we work with our training partner EasyLearningTre.

If you would like to talk through your own systems, write to vikas@provcraft.com or visit provcraft.com.

Over to you: in your organization, who owns the intended purpose of each AI feature today?