When a product team brings an AI feature to legal, the conversation often starts with "is this allowed?". That is the wrong first question. The useful ones are about roles, data and promises. Answer these five and the rest of the analysis falls into place.
1. What is our role under the AI Act?
The EU AI Act allocates obligations by role: provider (you develop the system or have it developed and place it on the market under your name), deployer (you use a system under your authority) and a few others such as importer and distributor. A company that fine-tunes a third-party model and offers the result to customers can become a provider. A company that embeds a vendor's model inside its own product can be both. Fix the role first; it determines everything else.
2. Which risk category does the use case fall into?
Four tiers matter in practice: prohibited practices, high-risk systems (listed in Annex III and product-safety legislation in Annex I), systems with specific transparency duties (chatbots, synthetic content, emotion recognition) and everything else. Recruitment screening, creditworthiness, education access and essential-service eligibility are classic high-risk areas. Many internal productivity tools are not. Document the reasoning either way.
3. What personal data is involved, and on what basis?
The GDPR does not pause for AI. Training data, prompts, outputs and logs can all contain personal data. You need a lawful basis for each processing purpose, a DPIA where the processing is likely to be high risk, and an answer to data-subject rights that works technically. If a vendor processes data on your behalf, Article 28 terms apply and transfers outside the EEA need a mechanism.
4. What must users be told?
Transparency duties come from several directions at once: the AI Act (interaction with an AI system, AI-generated content), the GDPR (automated decision-making, Article 22), consumer law (unfair commercial practices, dark patterns) and, for platforms, the DSA (recommender transparency). Write one disclosure plan that satisfies all of them.
5. Who carries which risk in the contract?
AI vendor terms are rarely written for the AI Act. Check warranties on training data provenance, allocation of provider obligations, audit and documentation rights, incident notification, IP indemnities and the right to switch models. For customers, mirror these in your own terms.
What this looks like in practice
A one-page "AI feature intake" that captures these five answers, reviewed in a 30-minute call, prevents most late-stage surprises. It also creates the documentation the AI Act expects you to have. If you want a template, email me.