EU AI Act Ship Kit

The problem

Since 2 August 2026 the transparency rules of the EU AI Act apply to every chatbot, agent and content generator used by EU users. The Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026) moved high-risk obligations to 2 December 2027 — but enterprise buyers already ask for the documentation, Italy just switched on its national sanctions regime (D.Lgs. 179/2026, 23 October 2026), and the AI Office sent its first information requests to OpenAI and Anthropic on 14 October 2026.

Engineering teams get a 144-article regulation, three codes of practice, draft guidelines and a lawyer's hourly rate. What they need is: which of our features are in scope, what applies today vs later, what strings go in the UI, and which documents must exist.

What it does

The kit makes your coding agent an AI-governance analyst for your repository:

Inventory — an offline script lists AI touchpoints: SDKs and models, routes and UI components that call a model, generated media, and keyword signals for Annex III areas (recruitment, credit, education, biometrics…), Art. 50 triggers and Art. 5 risks. The agent confirms each with you.
2.

Role — provider or deployer per system (most SaaS teams are providers of the features they wrap around an API), with the Art. 25 triggers and the GPAI one-third-compute rule applied.
3.

Classification — the full decision tree (prohibited → Annex I → Annex III → profiling override → Art. 6(3) filter → Art. 50 → GPAI → minimal), with

every branch and the facts relied on shown, and worked examples to calibrate against.
4.

Obligations matrix — what applies

now (Art. 4, 5, 50, Chapter V) vs

due (2 Dec 2026, 2 Dec 2027, 2 Aug 2028), status Done/Partial/Missing with evidence from the code, and an owner per item.
5.

Artefacts — generated into compliance/ on request: AI system register · Art. 6(3) assessment record · Art. 50 disclosure pack with UI strings in EN/IT/DE/FR/ES as i18n JSON, placement rules and a media-marking plan · deployer checklist (Art. 26) · FRIA outline (Art. 27) · vendor AI questionnaire with scoring · Annex IV technical-documentation skeleton · AI literacy plan (Art. 4) · gap report.
6.

Verdict —

READY / GAPS / STOP by fixed rules, with a VERIFY WITH COUNSEL list that states the exact legal question, so a lawyer reviews a draft instead of starting from zero.
7.

Italy add-on (--country IT) — Law 132/2025 and D.Lgs. 160/2026 + 179/2026: professional disclosure duty, worker information, human final decision in employment uses (art. 41), minors under 14, deepfake crime exposure (art. 612-quater c.p.), evidence-retention rules.

Why this beats prompting it yourself

Dates are versioned, not remembered. Every application date comes from one reference file (version 2026-10-16) that reflects the Omnibus. A model prompted from memory will still tell you high-risk duties started in August 2026. They did not.

Article numbers on every line. "You must disclose this" becomes "Art. 50(1) — provider duty — in force since 2 Aug 2026 — €15M/3% tier".

The profiling override is enforced. The most common mistake in self-assessments is using the Art. 6(3) filter on a system that profiles people. The tree forbids it.

Engineering outputs, not memos. i18n JSON for disclosures, logging fields for Art. 12, a questionnaire you can send to a vendor today, templates with TODO(owner) markers instead of lorem ipsum.

Honest about soft law. Final Code of Practice on AI-generated content (10 Jun 2026) and Art. 50 Guidelines are cited; high-risk classification guidelines are flagged as draft.

Use cases

• SaaS team adding a chatbot, agent or generator for EU customers — get the disclosure strings and the register before launch.
• HR-tech, fintech, ed-tech or insurtech products — find out early whether you are building a high-risk system and what to design in now (logging, oversight, documentation).
• Agencies and consultancies delivering AI features to EU clients — ship a gap report with the project.
• Procurement/engineering buying a third-party AI tool — send the vendor questionnaire, score the answers.
• Italian companies — one run covers both the EU and the national layer.

Known limitations

• Not legal advice; a lawyer must confirm classifications of high-risk candidates and any Art. 5 question (the kit marks exactly which).
• Classification depends on facts code cannot show (who decides, how outputs are used); the kit asks and records your answers as evidence.
• Covers the AI Act and the Italian framework; GDPR/DPIA drafting, consumer law, sector product-safety law and non-EU regimes are out of scope.
• Reference version 2026-10-16; check for updates after mid-2027.