EU AI Act Checklist for Mobile App Teams (2026)

The EU AI Act is now in partial force. Prohibited practices have been enforceable since February 2025, and the transparency and GPAI obligations that matter most to mobile teams land in August 2026. If your iOS or Android app uses AI features, recommendation systems, chatbots, or third-party AI SDKs and reaches EU users, this regulation applies to you regardless of where you are incorporated.

TL;DR

• Extraterritorial reach: any app serving EU users is in scope. No EU entity required.
• Four risk tiers: prohibited, high-risk, limited-risk (transparency), and minimal. Most consumer apps sit in the limited-risk tier.
• Article 50 transparency: AI interaction disclosure + AI-generated content labelling apply from 2 August 2026.
• Prohibited practices (Article 5): in force since 2 February 2025. Violations: up to €35 million or 7% of global turnover.
• GPAI obligations: apply since 2 August 2025. Using OpenAI, Gemini, Anthropic, or any foundation model API means you are a deployer, and GPAI rules touch you.
• High-risk Annex III deferral: a provisional Digital Omnibus agreement (May 2026) pushes standalone high-risk obligations from August 2026 to 2 December 2027 (formal adoption expected before August 2026; confirm publication in the EU Official Journal).
• App Store / Play Store: Apple's guideline 5.1.2(i) (November 2025) and Google Play's updated policy already require disclosure when user data is sent to third-party AI, which overlaps directly with Article 50.

---

Who is in scope, and what role are you?

Does the EU AI Act apply to non-EU mobile teams?

Yes. The Act applies to any provider or deployer whose AI system output is used within the EU, regardless of where the company is established. If your app is available in the App Store or Google Play and reaches EU users, you are in scope. Non-EU providers placing AI systems on the EU market may be required to appoint an EU representative (Article 25).

Two roles matter most for mobile teams:

Role	Definition	Typical mobile scenario
Provider	Entity that develops or has developed an AI system and places it on the market under its own name/trademark	You built the AI feature (on-device model, custom ML pipeline, your own chatbot)
Deployer	Entity that uses an AI system in its own operations or integrates a third-party AI system	You call OpenAI, Google Gemini, Anthropic, or another foundation model API inside your app

The deployer/provider boundary is not always clean. If you fine-tune a GPAI model and redistribute it, you step into provider territory. If you materially modify a third-party system for a high-risk purpose (for example, repurposing a general chatbot into an employment screening tool), regulators will treat you as a provider for those obligations.

---

What are the four risk tiers, with mobile examples?

The tier an AI system sits in determines its obligation set.

Risk tier	What qualifies	Mobile app examples	Key obligations
Prohibited (Article 5)	AI that manipulates users subliminally, exploits vulnerabilities, performs real-time public biometric ID, enables social scoring	Dark-pattern AI that exploits compulsive behaviour to maximise engagement at users' expense; AI that infers protected characteristics to price-discriminate	Banned outright since 2 Feb 2025. Penalties up to €35M / 7% turnover.
High-risk (Annex III)	Biometric identification, employment screening, credit scoring, educational assessment, essential services access	App used to screen job applicants; credit/lending decision app; student progress evaluation tool	Conformity assessment, technical docs, EU database registration, human oversight, logging. Annex III standalone deadline: 2 Dec 2027 (Digital Omnibus, provisional).
Limited-risk / Transparency (Article 50)	AI that interacts with people directly; AI that generates synthetic content	In-app AI chatbot / virtual assistant; AI-generated images, video, or text in the UI; emotion-recognition features	Disclose it's AI at first interaction; label AI-generated content in machine-readable format. Applies from 2 Aug 2026.
Minimal risk	Everything else	Spam filter, basic autocorrect, recommendation engine (most cases)	No mandatory obligations under the Act; voluntary codes of practice encouraged.

The line between "limited-risk" and "high-risk" turns on use context, not technology. A chatbot advising on medication dosing may move into the high-risk tier depending on how it is deployed.

---

What prohibited practices must your app avoid?

Article 5 has been enforceable since 2 February 2025.

The eight prohibitions most relevant to mobile products:

1. Subliminal or manipulative techniques: AI that nudges users through methods below conscious awareness, or deliberately exploits cognitive biases to harm them. Engagement-maximisation features that deliberately exploit compulsive patterns sit in a grey zone here; assess carefully.
2. Exploitation of vulnerabilities: targeting people based on age, disability, or economic hardship in ways that distort their behaviour to their detriment.
3. Social scoring: classifying people based on social behaviour in ways that cause unrelated harm or unjustified disadvantage.
4. Real-time remote biometric identification in public spaces: largely law enforcement territory, but any app performing live facial recognition of people in public falls under this.
5. Emotion recognition in workplaces and education (Article 5(1)(f)): applies where a deployer uses an emotion-detection system in these contexts.

⚠️ The European Commission published guidelines on prohibited practices in early 2025. If your app has personalisation algorithms that operate on psychological profiling, get legal review against Article 5(1)(a) specifically.

---

What are the Article 50 transparency obligations?

Article 50 imposes disclosure duties on all qualifying AI interactions and AI-generated content, regardless of risk tier. These apply from 2 August 2026.

Four requirements apply to mobile apps:

In-app AI chatbots and virtual assistants

Users must be informed they are interacting with an AI system at the latest at the time of the first interaction. A one-time persistent notice (a banner or onboarding screen, for example) is the minimum; the Commission's draft guidelines suggest it should be "clear and distinguishable."

AI-generated synthetic content

Providers of systems generating synthetic audio, images, video, or text must mark outputs in a machine-readable format so they are detectable as artificially generated. This applies to content generation features, AI avatar tools, AI image editors, and similar.

Deepfakes

Deployers that use AI to generate or manipulate image, audio, or video content constituting a deepfake must disclose this to the audience.

Emotion recognition and biometric categorisation

If your app uses either, users must be informed before or at first exposure.

Penalties for Article 50 non-compliance are up to €15 million or 3% of worldwide annual turnover, a separate and lower tier from the prohibited-practices maximum.

---

What are your GPAI / third-party SDK due diligence obligations?

If your app calls a third-party AI API (OpenAI, Google Gemini, Anthropic Claude, Mistral, Llama-via-cloud, etc.), you are a deployer of a General-Purpose AI (GPAI) model.

GPAI rules have applied since 2 August 2025. As a deployer your obligations include:

• Transparency chain: the GPAI model provider must give you usage documentation and transparency information. Check that the API vendor has published AI Act-compliant documentation (many major providers have published model cards and systemic-risk disclosures).
• Vendor due diligence: request and retain documentation on the model's training data, capabilities, and limitations. If the vendor cannot supply it, you carry the risk.
• Repurposing risk: if you integrate a general-purpose model into an employment screening, credit scoring, or educational assessment context, you may be reclassified as a high-risk provider. Assess intended use before integration.
• Contractual protections: review your API terms of service for AI Act compliance clauses. Absence of these in a vendor contract is a yellow flag.

---

Pre-submission checklist for mobile teams

Work through this before each release that introduces or modifies AI features.

A. Scope and role assessment

1. [ ] Map every AI component in the app: on-device models, cloud API calls, third-party SDKs (ML Kit, Core ML, OpenAI SDK, etc.).
2. [ ] Determine whether you are the provider or deployer for each component.
3. [ ] Confirm whether any component meets an Annex III high-risk use-case definition (employment, credit, education, biometric ID, essential services).
4. [ ] Confirm whether any component meets a prohibited-practice definition under Article 5; engage legal review if unclear.

B. Article 50 transparency (applies 2 Aug 2026)

1. [ ] Add a clear in-app disclosure that the user is interacting with an AI where applicable (first interaction, persistent notice).
2. [ ] Implement machine-readable labelling (C2PA watermark or equivalent) for any AI-generated images, audio, or video output.
3. [ ] Add deepfake disclosure where the app generates or edits video/audio content of real people.
4. [ ] Add emotion-recognition or biometric-categorisation notice if applicable.

C. Prohibited practices audit

1. [ ] Review engagement and personalisation algorithms against Article 5(1)(a) (subliminal manipulation). Document the review.
2. [ ] Confirm no feature targets users based on vulnerability characteristics (age, disability, economic status) in ways that cause harm.
3. [ ] Confirm the app does not perform real-time public biometric identification or social scoring.

D. GPAI / third-party AI SDK due diligence

1. [ ] Obtain and retain GPAI documentation from each API vendor (model card, transparency notice, systemic-risk disclosure if relevant).
2. [ ] Review vendor API terms for AI Act compliance provisions.
3. [ ] Assess whether the use-case triggers a deployer-to-provider reclassification.

E. High-risk obligations (if applicable, deadline 2 Dec 2027)

1. [ ] Produce technical documentation per Annex IV.
2. [ ] Implement a risk management system (Article 9).
3. [ ] Establish human oversight mechanisms (Article 14).
4. [ ] Register in the EU AI database (Article 71).
5. [ ] Set up post-market monitoring and serious incident logging (Article 72).

F. Store policy alignment

1. [ ] Add Apple App Store consent screen naming specific third-party AI services that receive personal data (guideline 5.1.2(i)).
2. [ ] Confirm Google Play data safety section reflects AI data sharing.
3. [ ] Review App Store metadata for any AI-feature claims that need substantiation.

---

Implementation timeline at a glance

2 Feb 2025  ─── Prohibited practices (Article 5) + AI literacy requirements in force
2 Aug 2025  ─── GPAI model obligations in force; EU AI Office governance active
2 Aug 2026  ─── Article 50 transparency obligations + most general obligations in force
                 (Digital Omnibus formal adoption expected before this date)
2 Dec 2027  ─── Annex III standalone high-risk obligations (provisional Digital Omnibus)
                 ⚠ Confirm in EU Official Journal (provisional agreement only as of Jun 2026)
2 Aug 2027  ─── GPAI models placed on market before Aug 2025 must be compliant
2 Aug 2028  ─── AI embedded in regulated Annex I products (medical devices, etc.)

⚠️ The Annex III deferral to December 2027 is based on a provisional political agreement reached in May 2026. It requires formal adoption and publication in the EU Official Journal before it becomes binding law. Until that happens, the original August 2026 deadline technically remains on the books. Track publication at the EU Official Journal (eur-lex.europa.eu).

---

How does this interact with App Store and Google Play policies?

Apple and Google have independently introduced AI disclosure requirements that overlap significantly with Article 50.

Apple's App Store guideline 5.1.2(i) (effective November 2025) requires apps to: - Display a named consent screen before sending personal data to any third-party AI service (naming the provider, e.g., "OpenAI", "Anthropic"). - On-device AI using Core ML with no data leaving the device is exempt. - Missing this disclosure triggers App Review rejection under 5.1.1.

Google Play's November 2025 policy update added requirements to disclose when personal data is shared with third-party AI services and to obtain explicit permission.

Practical implication: the Article 50 in-app AI disclosure and the App Store consent screen can largely be satisfied with a single, well-designed onboarding flow, provided you name the specific AI service, explain what data flows to it, and give users a genuine choice. Build one compliant disclosure layer; it serves both regulators and store reviewers.

---

What can tooling actually detect, and what can't it?

Pre-submission static analysis tools (including AppCompliance, which applies 100+ rules across five compliance frameworks) can surface technically detectable signals:

• Presence of AI/ML SDKs (TensorFlow Lite, Core ML, ONNX Runtime, OpenAI SDK, Vertex AI, etc.) in the binary or manifest.
• On-device model files (.tflite, .mlmodel, .onnx) that indicate AI inference.
• Missing in-app disclosure strings for AI interactions (pattern-based detection).
• Third-party AI endpoints called without apparent consent flow.
• Metadata flags relevant to AI-content labelling.

What static analysis cannot do: - Determine whether a use-case is legally high-risk under Annex III. That requires legal and contextual assessment. - Certify legal compliance or guarantee App Store approval. - Assess the intent of an algorithm against Article 5 manipulation prohibitions. - Replace a conformity assessment for high-risk systems.

Think of pre-submission scanning as risk surfacing, not legal certification. AppCompliance flags the detectable signals; your legal and compliance team makes the regulatory determination.

---

Frequently asked questions

Does the EU AI Act apply to my indie app if I have no EU entity?

Yes. The Act's extraterritorial reach applies to any provider whose AI system is placed on the EU market or whose output is used by EU users, regardless of the company's location. If your app is available on the App Store or Google Play without geo-restriction and serves EU users, you are in scope. You may need to designate an EU representative if you are a non-EU provider placing a high-risk system on the market.

My app uses a third-party AI API. Am I a provider or deployer?

In most cases, you are a deployer of the third-party model and a provider of the overall app. The distinction matters because providers carry heavier obligations. You step into provider status if you fine-tune the model, redistribute it, or repurpose it for a high-risk use-case. Using the API as-is to power a chatbot or content generation feature keeps you in deployer territory, but you still owe GPAI documentation diligence and Article 50 transparency.

When exactly does Article 50 kick in?

2 August 2026. This date is unaffected by the Digital Omnibus, which only deferred the Annex III high-risk obligations. Article 50 transparency (AI interaction disclosure and AI-content labelling) applies on schedule.

What counts as a "high-risk" AI system for a mobile app?

High-risk systems are defined in Annex III of the Act. Mobile apps are most likely to hit this tier in: employment or HR screening (CV filtering, interview scoring), credit or insurance decisioning, education and vocational assessment, access to essential public services, and biometric identification. If your app does any of these, get legal advice before the December 2027 deadline. The conformity assessment and documentation requirements are substantial.

What are the penalties for a typical Article 50 violation?

Up to €15 million or 3% of worldwide annual turnover, whichever is higher. The €35 million / 7% turnover ceiling applies specifically to prohibited practices (Article 5). Providing incorrect information to regulators carries up to €7.5 million or 1% of turnover.

Will passing an AppCompliance scan mean I'm EU AI Act compliant?

No. AppCompliance detects technically observable signals (embedded AI SDKs, missing disclosure patterns, on-device model files) which helps you identify risk before submission. Legal compliance with the EU AI Act requires a legal and technical conformity assessment, appropriate documentation, and (for high-risk systems) registration in the EU database. Pre-submission scanning is an early-warning layer, not a certification.

---

Regulation reference: EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Digital Omnibus provisional agreement: May 2026. Always verify current implementation deadlines against the EU Official Journal and official Commission guidance at digital-strategy.ec.europa.eu.