EU AI Act: What companies need to consider when choosing an AI gateway
Compliance & Data Protection
Dominik Keller
Founder, Kontinent
The EU AI Act (Regulation (EU) 2024/1689) is the EU's first comprehensive AI law. It classifies AI systems by risk and also places obligations on companies that only deploy AI. This checklist shows what you should look out for when choosing an AI gateway to ensure that the decision is AI Act-compliant.
Key Takeaways
The EU AI Act (Regulation 2024/1689) applies in stages; bans, GPAI, and transparency obligations are already applicable.
The Digital Omnibus (Regulation 2026/1744, in force since July 27, 2026) postpones high-risk obligations to December 2, 2027 (Annex III) and August 2, 2028 (Annex I).
The transparency obligations under Art. 50 were not postponed – they have applied to most gateway use cases since August 2, 2026.
A gateway is the most cost-effective place to centrally fulfill labeling, logging, and model provenance.
This moment happens in almost every company wanting to introduce AI: Someone from the legal department asks, "Is this actually AI Act compliant?" – and the room goes silent. The EU AI Act is no longer a distant future prospect, but applicable law with staggered deadlines. Anyone choosing an AI gateway now should not only think about model quality and price, but also ask: Will this still stand up to an audit in two years?
What the AI Act means specifically for gateway deployment
The AI Act classifies AI systems according to risk levels – from minimal to unacceptable. For most business use cases (customer service chatbots, internal assistants, document analysis), you usually end up in the "limited risk" or "high risk" category, depending on the area of application. Crucially, the responsibility lies not only with the model provider, but also with you as the company deploying the technology.
An AI gateway sits at a strategically important point – it is the central pass-through point for all AI requests. This makes it the ideal place to technically implement compliance requirements, instead of retrofitting them individually in ten different applications.
The AI Act entered into force on August 1, 2024, and applies in stages: Prohibited practices have been banned since February 2, 2025, obligations for general-purpose AI (GPAI) models have applied since August 2, 2025, and transparency obligations under Art. 50 since August 2, 2026. Violations of prohibited practices can be punished with fines of up to 35 million euros or 7% of worldwide annual turnover (Art. 99, Regulation (EU) 2024/1689).
Important since July 2026: The Digital Omnibus postpones high-risk deadlines
Anyone still planning with August 2, 2026, as the deadline for high-risk systems is working with an outdated date. Regulation (EU) 2026/1744 ("Digital Omnibus on AI", adopted on July 8, 2026, published in the Official Journal on July 24, 2026, in force since July 27, 2026) has postponed the obligations for high-risk AI systems. The reason given is that the harmonized technical standards are not yet ready and the designation of notified bodies is lagging behind.
Scope of Obligations | Originally | Currently Valid |
|---|---|---|
Prohibited practices (Art. 5) | February 2, 2025 | unchanged |
GPAI obligations (Art. 53) | August 2, 2025 | unchanged |
Transparency obligations (Art. 50) | August 2, 2026 | unchanged |
High-risk under Annex III (Art. 6 Para. 2) | August 2, 2026 | December 2, 2027 |
High-risk under Annex I (Art. 6 Para. 1) | August 2, 2027 | August 2, 2028 |
For gateway selection, this means two things. First: The time pressure for high-risk applications is lower than is still being communicated in many places. Second – and this is often overlooked: The transparency obligations under Art. 50 were not postponed. Anyone who operates a chatbot or displays AI-generated content has been obliged to do so since August 2, 2026, regardless of the risk class. What this specifically requires – including ready-made wording for chatbots, images, and video – is detailed in AI Labeling Obligation under Art. 50. This is precisely the obligation that affects the vast majority of gateway use cases.
The Checklist: What to look for when choosing a gateway
AI Act Requirement | What the gateway must be able to do |
|---|---|
Transparency obligation | Label and document which model responds and when |
Traceability | End-to-end logging of every request and response |
Model provenance | Clarity on which model is actually responding – no silent model swapping |
Data processing location | EU server location (GDPR applies in parallel) |
Human oversight | Interventions, approvals, and escalation technically possible |
Are transparency obligations fulfillable?
For certain applications, the AI Act requires that users know they are interacting with an AI. A good gateway should allow you to implement this in a clean technical manner and document which model generated which response and when.
Traceability and logging
In case of doubt, can you prove which request led to which response, with which model, at what time? Without end-to-end logging, any subsequent audit becomes a blind flight.
Model selection and provenance transparency
Do you know which model is actually responding behind your gateway? Silent model swapping without notice is common among some providers – for compliance purposes this is a problem because risk assessment and model behavior differ depending on the provider.
Data processing location
Even though the AI Act primarily targets the AI system itself, the GDPR remains in force in parallel. A gateway without an EU server location creates two construction sites at the same time instead of one. We have broken down the ways to operate US models legally in Europe in detail in Using OpenAI, Claude, and Gemini in Europe.
Possibility for human oversight
For higher-risk classified use cases, the AI Act requires mechanisms for human control. Your gateway should technically allow for the integration of interventions, approvals, or escalations – not as a late-stage custom development.
Why this matters for the gateway decision today
The most common mistake: Companies choose a gateway based on price and model selection, and compliance questions only arise as the staggered AI Act deadlines approach. Then you are faced with the choice of either rebuilding the entire system or continuing to operate with a compliance risk that was actually avoidable.
A gateway that is built in Europe from the ground up and designed for European regulations saves you precisely this second rebuild. kontinent.ai was developed with this premise: EU hosting, end-to-end traceability logging (metadata), transparent model provenance, and a DPA that matches the GDPR – not as an afterthought, but as a core framework. How this compares to other EU routers is shown in our Comparison of GDPR-compliant LLM routers.
Frequently Asked Questions
Does the EU AI Act also apply to small businesses?
Yes, in principle it applies regardless of company size. The specific obligations depend on the risk class of the AI application used, not on the size of the company.
From when do I have to comply with the AI Act?
In stages, depending on the risk category. Prohibitions have applied since February 2, 2025, GPAI obligations since August 2, 2025, and transparency obligations under Art. 50 since August 2, 2026. For high-risk systems under Annex III, the deadline since the Digital Omnibus is December 2, 2027, and under Annex I, August 2, 2028. Anyone introducing AI systems now should still keep these requirements in mind from the start, rather than retrofitting them later.
Is GDPR compliance not already enough?
No. The GDPR regulates the handling of personal data – this includes a proper data processing agreement for AI tools. The AI Act additionally regulates the AI system itself – such as transparency obligations, risk classification, and oversight mechanisms. Both frameworks apply in parallel.
Do I have to check AI Act compliance for each model individually?
A central gateway can bundle this check instead of performing it separately for every single application – which is one of the practical advantages of a well-configured gateway.
What are the penalties for violations of the EU AI Act?
Staggered fines apply depending on the violation. For prohibited practices, it is up to 35 million euros or 7% of worldwide annual turnover (Art. 99). For other violations, lower but still significant limits apply – a reason to think about compliance early on.
Is a gateway with a US server location automatically non-compliant with the AI Act?
Not automatically, but it complicates matters: alongside AI Act obligations, the GDPR applies in parallel, and a data processing location outside the EU creates additional assessment and documentation efforts. An EU location reduces two construction sites to one.
Sources
Regulation (EU) 2024/1689 (Artificial Intelligence Act) – EUR-Lex
Regulation (EU) 2026/1744 (Digital Omnibus on AI) – EUR-Lex, in force since July 27, 2026
EDPB, Opinion 28/2024 on AI models (December 18, 2024)
Regulation (EU) 2016/679 (GDPR) – EUR-Lex
As of August 27, 2026 · kontinent.ai. Legal status checked against EUR-Lex; no legal advice.
