EU Tech Compliance: AI Act, GDPR & DMA for Software Teams
By Shivam Singh, Founder — WiseGuyXL Technologies · Updated 21 July 2026 · ~16 min read
Why compliance is now a build requirement, not an afterthought
For years, “compliance” in European software meant a cookie banner and a privacy policy someone copied from a template. That era is over. The EU has moved from regulating data to regulating systems and behaviour — how your AI features talk to users, how your models are trained, and how large platforms shape who gets discovered. For a European software team, this means the cost of ignoring the rules has shifted from a theoretical fine to concrete product decisions you have to make before you ship.
The backdrop is a market that is investing heavily and fast. Gartner expects European software spending to reach $335.4 billion in 2026, up 15.6% year on year, and spending on generative-AI models to grow 78.2% in the same year (Gartner, 2026). More AI in production means more code that touches the AI Act and GDPR at once. The teams that treat compliance as an architecture concern — solved once, in the design — move faster than the teams that discover it in a security review two weeks before launch. This guide is the map: what the three rulebooks require, the deadlines in order, and how to build so you are not scrambling.
The three EU rulebooks every software team must know
Start with the shape of the landscape. Three regulations do most of the work for a typical software or SaaS product sold in Europe. They overlap — an AI chatbot that processes customer data and is surfaced through a gatekeeper platform touches all three — but each answers a different question.
| Rulebook | What it governs | Who it hits | Key 2026–27 date |
|---|---|---|---|
| EU AI Act | AI systems, by risk tier: banned uses, high-risk duties, and transparency for user-facing AI | Providers and deployers whose AI is placed on the EU market or whose output is used in the EU | Art.50 transparency: 2 Aug 2026 |
| GDPR | Processing of personal data — lawful basis, purpose limitation, rights, security | Anyone processing EU residents’ personal data, wherever established | In force since 2018; new EDPB AI guidance |
| DMA | Conduct of large “gatekeeper” platforms (search, app stores, marketplaces) | Designated gatekeepers directly; everyone else via changed discovery | Google search-data sharing: Jan 2027 |
The rest of this guide takes each in turn, then pulls them into one checklist. If you are choosing an engineering partner to help you ship into this environment, our guide on the custom software development in Europe and the criteria for picking a software company in Europe both weight EU compliance posture heavily — for good reason.
The EU AI Act: a risk-based rulebook with staggered deadlines
The AI Act is the world’s first comprehensive law on artificial intelligence, and it works by sorting AI systems into risk tiers rather than regulating the technology uniformly. A handful of uses are banned outright (for example, social scoring and certain biometric practices). A defined set of “high-risk” uses — AI in hiring, education, credit, insurance, essential services and similar — carries heavy obligations around risk management, data governance, human oversight and documentation. Below that sit “limited-risk” systems, which mainly carry transparency duties, and “minimal-risk” systems, which are largely unregulated.
For most software teams shipping a product with an AI chatbot, an AI writing feature or AI-generated media, the tier that matters day to day is the transparency one — Article 50 — not the high-risk regime. But you have to know which tier your feature falls into, because the difference is the gap between a disclosure label and a full conformity assessment. Misclassifying a hiring or credit-scoring feature as “limited risk” is the expensive mistake.
What lands on 2 August 2026: Article 50 transparency
From 2 August 2026, the AI Act’s transparency obligations under Article 50 start applying, and they are the rules most software products will feel first. In short: people must be told when they are interacting with an AI system unless it is obvious; AI-generated or manipulated audio, image, video and text must be marked in a machine-readable way; and deepfakes and AI-generated content presented as real must be labelled. The European Commission published its official guidelines on these obligations on 20 July 2026, alongside a Code of Practice on the transparency of AI-generated content.
“The Commission adopted these guidelines to offer practical guidance to competent authorities, as well as providers and deployers of AI systems. The aim is to ensure compliance with the transparency obligations under Article 50 of the AI Act in a consistent, effective, proportionate and uniform manner.” — European Commission, Guidelines on transparency obligations for providers and deployers of AI systems (published 20 July 2026)
The guidelines make clear that regulators will look not only at whether a disclosure exists but at whether it is clear, accessible and effective in context — a grey “AI” watermark buried in a footer will not do. For a practical, deadline-focused walkthrough of exactly what to change in a chatbot or AI-creative workflow before the date, see our detailed how-to on the August 2026 transparency rules. That spoke turns this section into a checklist you can action this month.
What moved to 2027: the high-risk regime and the Digital Omnibus
Here is the good news for teams that were bracing for the full high-risk regime in 2026: it moved. The EU’s Digital Omnibus — a package intended to simplify and streamline the digital rulebook — reached final agreement and the final act was signed on 8 July 2026, deferring the application of the Annex III high-risk system obligations to 2 December 2027. That is a genuine reprieve for anyone building AI into hiring, education, credit or similar regulated flows. It is not, however, a pass: the transparency rules still land on schedule in August 2026, and the extra runway on high-risk is best spent getting your data governance and GDPR-by-design foundations right, not procrastinating.
One more date to diarise: the obligations around marking synthetic content and watermarking are due to apply from 2 December 2026. If your product generates images, audio, video or substantial text, you will need a marking approach that survives copying and re-encoding — which is exactly the problem our watermarking deadline guide unpacks.
GDPR and AI features: shipping without breaking the law
The GDPR did not go anywhere when the AI Act arrived — it sits underneath it. Any AI feature that trains on, or processes, personal data needs a lawful basis, a clear purpose, and appropriate security, plus respect for people’s rights to access, correction and erasure. The hardest question in practice is the lawful basis for using personal data to build and run AI models, and here the European Data Protection Board (EDPB) has given the clearest steer to date.
In its December 2024 opinion, requested by the Irish Data Protection Authority to harmonise the approach across Europe, the EDPB set out how data protection authorities should assess when AI models can be treated as anonymous, whether legitimate interest can serve as a legal basis, and what happens when a model was trained on unlawfully processed data. The board framed the whole exercise around enabling responsible innovation rather than blocking it.
“AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” — EDPB Chair Anu Talus, EDPB opinion on AI models (18 December 2024)
If you rely on legitimate interest — the most common basis for building AI features on data you already hold — the EDPB’s three-step test is the frame to design against. First, identify a legitimate interest that is lawful, clearly articulated, and real and present rather than speculative. Second, run the necessity test: can you achieve the purpose with less data, or a less intrusive method? If so, you must. Third, run the balancing test: does your interest override the rights and reasonable expectations of the people whose data you are using? The opinion lists mitigating measures that tilt the balance in your favour — pseudonymisation, transparency about how data was collected, and technical controls that stop a model storing or regurgitating personal data. Build those in and document the assessment; that documentation is what a regulator will ask for.
A practical rule for product teams: treat “GDPR-by-design” as a first-class architecture requirement, the same way you treat authentication. Decide the lawful basis before you write the ingestion pipeline, minimise what you collect, and make data-subject rights (export, deletion) a feature you can actually execute — not a manual database query someone runs under pressure. For the deeper build patterns, our spoke on GDPR and AI features goes into ingestion, retention and consent design.
The DMA: how competition rules are reshaping discovery
The Digital Markets Act looks, at first glance, like someone else’s problem — it targets a small number of very large “gatekeeper” platforms, not the average software vendor. But its second-order effects reach every European software team, because the DMA is actively reshaping how buyers discover products. The clearest example landed in July 2026: under DMA specification proceedings, the European Commission ordered Google to share the anonymised ranking, query, click and view data it uses to improve its own search with eligible rival search providers, starting in January 2027. The Commission also ordered Google to give rival AI assistants better access to Android features, with those changes expected from July 2027.
Why does that matter to you? Because eligible recipients of that data could include the very answer engines your buyers increasingly use — the likes of OpenAI’s ChatGPT, Perplexity, Ecosia and DuckDuckGo. If challenger engines improve, discovery in Europe spreads across more surfaces, and optimising only for one search engine becomes a strategic risk. The defensive move is to build content and product information that any answer engine can find, quote and cite — which is the whole thesis of our pillar on programmatic SEO and generative engine optimisation. Compliance and discovery are converging: the same forces that regulate the platforms are opening the market you sell into.
Where the three laws collide: a worked example
Consider a concrete case, because that is where the overlap becomes real. Say a European B2B SaaS company adds an AI assistant that answers customer questions using the customer’s own account data, and it surfaces marketing content that appears in AI Overviews. That single feature touches all three rulebooks at once. Under the AI Act, the assistant must disclose that it is an AI (Article 50), and any AI-generated media in the marketing must be marked. Under the GDPR, the account data feeding the assistant needs a lawful basis, minimisation and a way to honour deletion. Under the DMA’s knock-on effects, the marketing needs to be citable across engines, not just ranked on one. Handle these separately and you will duplicate work and leave gaps; handle them as one design problem — transparency, data governance, and portable content — and you solve them once. That integrated view is what separates teams that ship smoothly from teams that stall in review.
A practical EU compliance checklist for software teams
Turn the law into engineering tasks. This is the short list we walk clients through before an AI feature ships into Europe; adapt the weighting to your product and confirm specifics with counsel.
- Classify every AI feature by AI Act risk tier before building. Banned, high-risk, limited-risk or minimal? If it touches hiring, credit, education, insurance or essential services, assume high-risk until proven otherwise.
- Implement Article 50 transparency by 2 August 2026. Clear “you are talking to an AI” disclosure; machine-readable marking of AI-generated content; deepfake labelling. Make the disclosure obvious, not buried.
- Plan synthetic-content marking for 2 December 2026. Choose a marking method that survives copying and re-encoding, and test it.
- Fix the lawful basis before the pipeline. Document your GDPR basis, run the EDPB three-step test if you rely on legitimate interest, and record the assessment.
- Make data-subject rights executable. Build export and deletion as real product functions, and minimise what you collect in the first place.
- Add mitigating measures the EDPB rewards: pseudonymisation, transparency about data sources, and controls that stop models storing or regurgitating personal data.
- Design content for portability, not one engine. Structure information so any answer engine can cite it, ahead of the DMA-driven search shake-up in 2027.
- Keep the paper trail. Risk classifications, DPIAs, and design decisions are what regulators ask for — write them as you go, not after the fact.
Frequently asked questions
Does the EU AI Act apply to my software if my company is outside the EU?
Often, yes. The AI Act applies to providers and deployers whose AI systems are placed on the EU market or whose outputs are used in the EU, regardless of where the company sits. If you sell to EU customers or your AI features reach EU users, plan for it.
What EU AI Act deadline should software teams focus on first?
2 August 2026 — when the Article 50 transparency obligations start applying. Users must be told when they are interacting with an AI, and AI-generated or manipulated content, including deepfakes, must be marked and labelled. The heavier high-risk (Annex III) rules were deferred to 2 December 2027 by the 2026 Digital Omnibus.
Can I use personal data to build AI features under GDPR?
Yes, with a lawful basis. Where you rely on legitimate interest, you must pass the EDPB’s three-step test — a genuine interest, a necessity test, and a balancing test against people’s rights — and apply mitigating measures such as pseudonymisation and transparency. The EDPB’s December 2024 opinion sets out how authorities will assess it.
What is the DMA and why should a software team care?
The Digital Markets Act regulates large “gatekeeper” platforms. It matters because it is reshaping European discovery: the Commission has ordered Google to share anonymised search data with rivals from January 2027, which will strengthen alternative answer engines your buyers may use to find vendors.
Is this guide legal advice?
No. It is a practical engineering-and-product overview to help you scope compliance and ask the right questions. For decisions with legal consequences, confirm specifics with qualified counsel and your data protection officer, and rely on the primary sources cited.
References
- European Commission — Guidelines on transparency obligations under Article 50 of the AI Act (published 20 July 2026; transparency obligations apply from 2 Aug 2026): digital-strategy.ec.europa.eu
- EU AI Act service desk — implementation timeline (Art.50 transparency from 2 Aug 2026): ai-act-service-desk.ec.europa.eu
- White & Case — EU agrees Digital Omnibus deal; high-risk (Annex III) deferred to 2 Dec 2027; final act signed 8 Jul 2026: whitecase.com
- Legalnodes — EU AI Act 2026 updates (watermarking / synthetic-content marking due 2 Dec 2026): legalnodes.com
- EDPB — Opinion on AI models: GDPR principles support responsible AI (Chair Talus; three-step legitimate-interest test), 18 Dec 2024: edpb.europa.eu
- Search Engine Land — EU orders Google to share anonymised search data with rivals from Jan 2027 (DMA): searchengineland.com
- Gartner — European IT spending to grow 11% in 2026 (software $335.4B, +15.6%; GenAI model spend +78.2%): gartner.com
Written by Shivam Singh, Founder of WiseGuyXL Technologies (IIM Indore alumnus). This guide was drafted with AI assistance and edited for accuracy against the primary sources cited above. It is general information for software and marketing teams, not legal advice. — Shivam