EU AI Act
The Act sets obligations. Interfaces are where they get met.
The EU AI Act sets binding obligations for providers and deployers of high-risk AI systems: transparency to deployers, human oversight, record-keeping, and a right to explanation for people significantly affected by an AI-assisted decision. Most of these obligations are satisfied — or fail to be satisfied — at the interface, not in a policy document. Below is an article-by-article reference to the obligations most relevant to interface design, with the patterns in this library that address each one. Where no pattern currently addresses an article directly, that's shown too — this is a working map, not a compliance guarantee.
-
Article 9
Risk management system
Providers of high-risk AI systems must establish, implement, and maintain a continuous risk management process across the system’s lifecycle.
Read Article 9 →Explainability Task
Risk management is mostly an organizational and engineering process, not an interface. Where it touches the interface, it shows up as the limitation, confidence, and oversight patterns listed under the other articles below.
-
Article 10
Data and data governance
Training, validation, and testing data for high-risk AI systems must be relevant, representative, and examined for possible biases.
Read Article 10 →Explainability Task
Surface known bias and fairness considerations to the people relying on a system’s output, rather than leaving data governance as an internal-only concern.
-
Article 11
Technical documentation
Providers must draw up technical documentation before a high-risk system is placed on the market, and keep it up to date.
Read Article 11 →Explainability Task
Documentation is primarily a regulator-facing artifact, but its content (intended purpose, performance metrics, known limitations) is the same material that should be translated into user-facing limitation and scope disclosures.
Patterns addressing this
-
Article 12
Record-keeping
High-risk AI systems must technically allow for the automatic logging of events over the system’s lifetime, to enable post-market monitoring and audit.
Read Article 12 →Explainability Task
Give people a visible, reviewable record of what the system did and when — a timeline or audit trail — not just a backend log invisible to the people affected.
-
Article 13
Transparency and provision of information to deployers
High-risk AI systems must be accompanied by instructions that let deployers understand and properly use the system, including its capabilities, limitations, and the data it was designed for.
Read Article 13 →Explainability Task
The core explainability article. Disclose what the system does, what data it used for a given output, what its known limitations are, and how confident it is — in language deployers and the people they serve can act on.
Patterns addressing this
-
Article 14
Human oversight
High-risk AI systems must be designed so natural persons can effectively oversee them, including the ability to understand, monitor, and override or stop the system, and to resist over-reliance on its output (automation bias).
Read Article 14 →Explainability Task
Give the human reviewer a real override control, not a rubber stamp — and design against automation bias by not making "accept" the only frictionless path.
-
Article 15
Accuracy, robustness and cybersecurity
High-risk AI systems must achieve an appropriate level of accuracy, robustness, and cybersecurity, and perform consistently across their lifecycle.
Read Article 15 →Explainability Task
Mostly an engineering requirement, but its outputs (accuracy metrics, known failure conditions) are exactly what a confidence indicator or limitation warning needs to communicate honestly.
-
Article 50
Transparency obligations for providers and deployers of certain AI systems
Four separate transparency duties, which can apply cumulatively to a single system: providers must disclose when people are interacting with an AI system (50(1)) and mark AI-generated content as machine-readable with detection available (50(2)); deployers must notify people exposed to emotion-recognition or biometric-categorization systems (50(3)) and label deepfakes and AI-generated public-interest text (50(4)). A horizontal rule (50(5)) requires this information to be clear, distinguishable, and accessible at first interaction or exposure.
Read Article 50 →Explainability Task
Disclosure must be in-context, not only in terms and conditions; specific to this system's actual outputs, not a generic site-wide notice; and free of human-like signals (an avatar, a human name, a natural voice) that contradict it. The Commission is explicit that interface choices — not just wording — can determine whether the "obvious interaction" exception is even available.
See the five disclosure techniques the Commission says aren't enough → -
Article 86
Right to explanation of individual decision-making
A person significantly affected by a decision based on the output of a high-risk AI system has the right to obtain, from the deployer, a clear and meaningful explanation of the role the AI system played and the main elements of the decision taken.
Read Article 86 →Explainability Task
Build an actual request-and-respond flow for explanations, with attributable, specific factors — not a generic FAQ about how the system works in general.
-
Annex IV
Technical documentation content
Specifies the detailed content required in the technical documentation referenced in Article 11: system description, development process, performance metrics, and more.
Read Annex IV →Explainability Task
A natural source for model transparency cards — the same information Annex IV requires for regulators is what a transparency card should surface to deployers and affected users.
Patterns addressing this
Timeline
When the obligations apply
The Act phases in over several years, and the EU’s AI Omnibus, in force from 27 July 2026, moved some dates. Below are the milestones that matter for interface design. The high-risk obligations of Articles 9 to 15 and the Article 86 right to explanation apply from 2 December 2027.
-
Entry into force
The Act takes effect, but none of its requirements apply yet.
-
Prohibitions and AI literacy
Banned AI practices and AI literacy obligations start to apply.
-
General-purpose AI and governance
Obligations for providers of general-purpose AI models and the governance rules start to apply.
-
Transparency obligations apply
People must be told when they interact with an AI system, and AI-generated content must be marked.
-
Grace period for content marking ends
Systems already on the market before August 2026 must now embed machine-readable markers in AI-generated content.
-
High-risk AI systems
Rules apply to high-risk systems listed in Annex III, such as credit scoring, hiring and access to public benefits.
-
High-risk AI in products
Rules apply to AI embedded in regulated physical products listed in Annex I, such as machinery, toys and lifts.