Discussion of the AI Act concentrates on systems placed on the market: the classification tiers, the obligations that attach to high-risk systems, the transparency duties. That is the right focus for a product containing a model.
There is a second exposure that gets much less attention. If you build regulated software with AI assistance, the assistance sits inside your development process, and your development process is already documented, audited and evidenced under whatever framework applies to you.
Where it lands in practice
Two obligations travel well beyond the Act itself and land on almost everyone.
Technical documentation. High-risk systems require documentation describing how the system was developed. If a substantial part of the implementation was machine-generated and your documentation does not mention it, the documentation is incomplete in a way that is easy to demonstrate.
Record-keeping. The direction of travel across every framework is towards records that are kept as work happens rather than assembled afterwards. Development records built retrospectively from commit messages are weak precisely because they are retrospective.
Human oversight has a specific meaning
The oversight language in the Act concerns the operation of AI systems, but the same expectation is appearing in sectoral supervision of how firms build software: a person must be in a position to understand and intervene.
Applied to coding agents, “a human approved the pull request” is a weaker claim than it sounds. Demonstrating meaningful oversight means being able to show what the agent produced and what the human changed afterwards. That distinction only exists if somebody recorded it at the time.
What to do now, regardless of classification
Record AI-assisted development as it happens, on the machines that write production code. Be able to state AI contribution per repository with a definition attached. Keep records append-only and verifiable so they survive challenge. Name which tools and models are approved, and where AI-authored code needs explicit human sign-off.
None of that is specific to the AI Act. It is what any supervisor, auditor or acquirer will ask once AI-written code is a material share of a product — and the AI Act is simply making the timeline concrete.
A caveat worth stating
This is not legal advice, and anybody telling you that a tool makes you AI Act compliant is selling something. Compliance is a property of your organisation, not of software you install. What tooling can do is turn questions that are currently unanswerable into ones you can answer with a document.