EU AI Act Checklist
The EU AI Act dates that bind a React Native app shipping AI features, and the questions to answer before you launch in the EU.
EU AI Act checklist for your React Native app
The EU AI Act, Regulation (EU) 2024/1689, applies by where your users are and not by where you are, which catches a lot of solo founders off guard. It sorts duties by what a system does: a few practices are prohibited outright, a narrow set of uses is treated as high risk, and a much broader set of systems that talk to people or generate media carries transparency duties. The Digital Omnibus, Regulation (EU) 2026/1744, amended it, entered into force on 27 July 2026, and moved several of the dates below.
This page is written for a solo founder or a small team shipping a React Native app. It maps the dates and the questions. It is not legal advice and it is not a substitute for a lawyer who has actually read your app.
The dates that matter
| Date | What starts |
|---|---|
| 2 February 2025 | The prohibited practices in Article 5 apply. The AI literacy duty in Article 4 applies. |
| 2 August 2025 | The governance and penalties provisions apply. |
| 27 July 2026 | The Digital Omnibus, Regulation (EU) 2026/1744, enters into force. |
| 2 August 2026 | The Article 50 transparency duties apply to new systems, under the second paragraph of Article 113. |
| 2 December 2026 | The narrow legacy window for Article 50(2) closes. The two practices the Omnibus inserted into Article 5 apply. |
| 2 December 2027 | High-risk classification under Annex III applies. |
| 2 August 2028 | High-risk classification under Article 6(1) and Annex I applies, for AI that is a safety component of a product already regulated under EU product law. |
Read the legacy window carefully
There is a grace period running to 2 December 2026, and it is far narrower than most summaries suggest. Article 111(4), as amended, grants it only for Article 50(2), and only to providers of systems that generate synthetic audio, image, video or text. Article 50(1) and Article 50(3) bind systems that were already on the market from 2 August 2026, with no grace period at all.
Check any timeline you read against the regulation text itself. Several widely linked AI Act timeline pages still publish the pre-Omnibus schedule, so they are wrong on exactly the dates that decide your deadline. The governance and penalties provisions started on 2 August 2025, not in 2026.
The checklist
Five questions. Each one is about your app, not about the boilerplate.
1. Do you have a chat-shaped surface?
Article 50(1) covers AI systems intended to interact directly with natural persons. A chat screen, an assistant, a voice agent, any surface where a person is talking to a model: the person has to be told they are dealing with an AI system, unless that is obvious to a reasonably well informed person from the context.
This binds from 2 August 2026, and for a system already on the market there is no grace period.
- The AI surface says a machine is answering, before the first exchange
- The disclosure survives a deep link that drops a user straight into the chat
- The disclosure is in the user's language, not only in English
2. Do you generate synthetic media?
Article 50(2) covers providers of systems that generate synthetic audio, image, video or text. The output has to be marked in a machine readable format and detectable as artificially generated or manipulated. The Act carves out systems that "perform an assistive function for standard editing or do not substantially alter the input data ... or the semantics thereof."
Whether one of your features sits inside that carve-out is a judgement call and not a settled fact. A grammar fixer that tightens a sentence the user wrote looks like assistive editing. A feature that writes the post for them, or generates a face, does not. If you are anywhere near the line, assume you are on the marking side of it and get advice.
This is the one duty with a legacy window. If your generator was already on the market, you have until 2 December 2026.
- You know which outputs your app generates and which it merely edits
- Generated media carries a machine readable marker
- The marker survives your export, your share sheet and your upload path
A note on mood features
Article 50(3) covers emotion recognition systems, and Article 3(39) defines those as inferring emotions "on the basis of their biometric data". Recital 18 keeps that to biometric signals: face, gesture, voice. A feature that reads text the user typed and guesses a mood is most likely outside that definition. Most likely is not certainly, and a camera-based or voice-based mood feature is a different question entirely, so treat this as a reason to check rather than a reason to relax.
3. Are you in an Annex III context?
Annex III lists the domains the Act treats as high risk: employment and worker management, credit scoring and access to essential private and public services, education and vocational assessment, biometrics, law enforcement, migration, asylum and border control, and the administration of justice and democratic processes.
Most consumer apps are nowhere near that list. If yours is, classification starts to apply on 2 December 2027, and what comes with it (risk management, data governance, technical documentation, logging, human oversight, post-market monitoring) is a programme of work rather than a checkbox. Talk to a lawyer before you build it, not after.
Where the AI is a safety component of a product already regulated under EU product law, Article 6(1) and Annex I, the date is 2 August 2028.
- You have written down, in one sentence, what your app decides about a person
- You have checked that sentence against the Annex III domains above
- If it lands in one of them, you have talked to a lawyer
4. Do you have an AI literacy measure?
Article 4 has applied since 2 February 2025. It asks providers and deployers to take measures to support the development of AI literacy among their staff and the people operating the system on their behalf. The Omnibus added a sentence that makes the ceiling explicit: this does not require them to guarantee any specific level.
For a two-person team this is small. A written note on what your models can and cannot do, what a hallucination looks like inside your product specifically, and who hears about it when one ships.
- Someone owns the answer to "what can this model get wrong in our app?"
- That answer is written down somewhere a new hire will find it
5. Are you doing anything Article 5 prohibits?
The prohibitions have applied since 2 February 2025. Two of them catch consumer product patterns more often than founders expect: Article 5(1)(a) on manipulative or deceptive techniques that materially distort behaviour, and Article 5(1)(b) on exploiting vulnerabilities "due to their age, disability or a specific social or economic situation".
Retention mechanics tuned at teenagers, or a paywall a model adapts to press on somebody's financial situation, are worth a hard look. The Omnibus inserted two further prohibited practices, covering non-consensual intimate imagery and child sexual abuse material, which apply from 2 December 2026.
- No model in your app optimises against what the user actually asked for
- Your age gating matches what your retention mechanics really do
- If you generate images of people, you have a written policy and a filter
What the boilerplate gives you today
The straight answer: it does not ship an AI Act feature. There is no disclosure module in it today, and this page is not going to pretend otherwise.
What you get is the source code, on your machine. Every surface named above is one you edit yourself, in your own repo, instead of filing a ticket with a vendor and waiting on a toggle. That is the only claim being made here. The boilerplate makes no representation about the regulatory status of anything you build with it.
This is not legal advice
This page is a builder's reading of two published regulations. It is not legal advice, it creates no lawyer-client relationship, and nothing here means your app meets any requirement. If the EU AI Act touches your product, get advice from a qualified lawyer in the relevant jurisdiction, and read Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 in the Official Journal rather than a summary of them.
Where to go next
- Security for the production security checklist you run before a release
- Deployment for the pre-launch checklist and the store submission path
- Terms and Conditions for how responsibility is allocated between you and us