How I build AI you can actually put in front of EU users
Most "AI developers" wire an API key to a chat box. Building AI for the EU market means treating governance as part of the engineering, not a lawyer's afterthought. This is the checklist I run on every AI feature — with the assistant on this site as the worked example, so nothing here is invented.
Classify the risk first
EU AI Act risk class by intended use — prohibited, high-risk, limited, minimal — before I write code. Most product AI lands in limited/minimal; the point is knowing, and staying out of high-risk territory (recruitment, credit, biometrics) unless that's a deliberate, gated decision. A timeline note I keep current: the Act's high-risk deadline moved to December 2027 in the May 2026 Digital Omnibus, and GPAI transparency duties have been live since August 2025.
Human stays in command on anything consequential
AI proposes, a person approves. Nothing with legal, financial or people-impact is fully automated — which also keeps systems out of GDPR Article 22 automated-decision territory by construction. DEVDAVE, the assistant on this site, is scope-locked and refuses to act as anything beyond a professional introduction.
Minimize the data
No personal data in prompts or embeddings beyond necessity. On DEVDAVE, voice audio is processed in memory and never stored; the assistant needs no visitor PII to do its job.
A kill-switch and a fallback, always
Every AI lane can be turned off and degrade gracefully. DEVDAVE runs as a plain command terminal with the model disabled — an outage or a cost spike never breaks the site. If your product stops working when the model does, that's a dependency, not a feature.
Guardrails against misuse — tested, not assumed
Scope-lock in the system prompt, server-side input caps, refusal of jailbreak and instruction-override attempts — verified with a live adversarial battery, not taken on faith. The full write-up is in the DEVDAVE case study.
GDPR-safe by construction
Supabase Row-Level Security on every table. Verified no-training data processing agreements with model providers. EU data residency where it matters. And deletion that reaches derived artifacts — embeddings, caches, extraction sidecars — not just the database row.
Evals before I trust it
A small eval set built from real failure cases gates changes — no model swap or prompt change ships without re-running it. An unmeasured AI feature is a demo, whatever the landing page says.
The worked example: every item above is applied in DEVDAVE, the AI companion on this site — scope-locked, abuse-capped, LLM-optional, and adversarially tested.
If you're building AI for European users and "we'll sort compliance later" makes you nervous, that's the conversation I'm good at — get in touch.