If you run an SRE or platform team, rolling out Claude Code or Cursor raises a fair question: does this put us on the hook under the EU AI Act? For writing code, not as a high-risk use. The Act classifies by use, not by tool, and software development is not a high-risk use. The exposure shows up when you point an AI tool at something else.
First, check reach: the Act covers deployers established or located in the EU, and deployers elsewhere whose AI output is used in the EU (Article 2). A US team scoring engineers based in the EU is in scope. A US-only team may not be. If you are in scope, two questions settle it: is the use on the Annex III list, and did you change what the tool is for? The deadlines come from our earlier piece on the Digital Omnibus. This one covers the classification step that comes before any date matters.
Question 1: is the use on the Annex III list?
High-risk status for standalone systems comes from Annex III, which lists eight areas: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and the administration of justice and democratic processes (Annex III). Writing code is not on it.
What counts as the tool's use is set by Article 3(12): "the use for which an AI system is intended by the provider, including the specific context and conditions of use" (Article 3). A coding agent's intended use is software development. Annex III obligations for standalone high-risk systems apply from 2 December 2027 (Regulation (EU) 2026/1744), but a coding agent used to write code never reaches that date, because it never enters the category.
The Commission has said the Act covers AI agents even though "agent" is not a defined term (AI Act Service Desk FAQ). Covered does not mean high-risk. It means the risk tiers apply, and this use sits outside the high-risk one.
Question 2: provider or deployer?
Article 3(4) defines a deployer as "a natural or legal person, public authority, agency or other body using an AI system under its authority." A team with Cursor seats fits that, so you are a deployer. Article 3(3) defines a provider as a person or body that "develops an AI system or a general-purpose AI model," and places it on the market or puts it into service under its own name or trademark (Article 3). The company that builds and ships the tool is its provider.
Being a deployer of a non-high-risk system is a light position. The duties that worry compliance teams, such as Article 26's human-oversight and log-retention obligations, attach to deployers of high-risk systems, as the earlier piece lays out.
Under Article 25, the role can shift, but only for high-risk systems. Under Article 25(1), a deployer "shall be considered to be a provider" of a high-risk AI system if it puts its name or trademark on one, substantially modifies one so that it stays high-risk, or changes a system's intended purpose so that it becomes high-risk. Under 25(2), the original provider then "shall no longer be considered to be a provider of that specific AI system," and must cooperate with the new provider, unless it had specified that the system must not be turned into a high-risk one (Article 25).
Branding or customizing a coding agent for internal use does not trigger this. Repointing it does, if the new use is high-risk: take a coding agent, repoint it from writing code to screening job applicants, and you have changed what it is for. That is how a tool choice turns into a provider problem, with the Annex III and Article 25 rules applying from 2 December 2027. A team that develops its own agent and puts it into service for its own use is also a provider under Articles 3(3) and 3(11), whether or not the system is high-risk.
The use that does put you on the hook
For an engineering org, the likelier version is not hiring. It is engineering management. Annex III point 4(b) covers AI systems used "to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons" in work relationships (Annex III). Using an AI tool to evaluate individual engineers' performance, rank them, or allocate tickets based on each engineer's behavior or traits lands there, with obligations applying from 2 December 2027. Point 4(b) is about individuals, not team-level metrics or routing tickets by component.
A concrete case: a team pipes pull-request and commit data from its coding agents into a model, scores each engineer every quarter, and uses the score to assign tickets. Nobody bought a "high-risk AI system." The scoring layer is likely one. A team that built that layer and runs it internally can be its provider as well as its deployer (see Article 3(11) in Article 3, and Article 25 in the earlier piece).
Article 6(3) lets some Annex III systems out of high-risk where they do not pose "a significant risk of harm to the health, safety or fundamental rights of natural persons" (Article 6). It does not help the scoring example: an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons," and scoring individual engineers on their work is profiling (as defined in Article 3(52), which adopts the GDPR definition covering performance at work).
What still applies to a team using coding agents
The obligation that reaches coding-agent users is Article 4, AI literacy. As amended by the Omnibus, it requires providers and deployers to "take measures to support the development of AI literacy" among staff who use AI on their behalf, and it does not require them to guarantee any specific level (Article 4). Article 4 has applied since 2 February 2025 (Article 113); the Omnibus softened it in 2026.
Article 50 splits by role. Providers owe the AI-interaction disclosure (50(1)) and machine-readable marking of synthetic content (50(2)). Deployers owe the emotion-recognition or biometric-categorization disclosure (50(3)) and deepfake labeling, plus disclosure of AI-generated text published to inform the public on matters of public interest (50(4)) (Article 50). Writing code with an agent triggers none of these. Ship your own AI feature to users and you become its provider; 50(1) applies if the feature interacts directly with people, and 50(2) if it generates content. Article 50 has applied since 2 August 2026, except that 50(2) marking gives systems already on the market until 2 December 2026 (Article 111).
Two gaps remain. The Commission published draft Article 6 high-risk classification guidelines on 19 May 2026 for public consultation (IAPP). As of 9 October 2026 we found no final version. And as of 9 October 2026 we found no Commission guidance written specifically for coding agents or developer tools.
A one-page check before the next rollout
- For each AI tool, write down its intended use in one line, in the provider's terms.
- Compare each use against the Annex III areas. Flag anything that scores or ranks individuals, or allocates work based on an individual's behavior or traits, or that acts as a safety component in running critical digital infrastructure (Annex III point 2).
- Treat any repointing that lands a tool in an Annex III use, such as coding agent to candidate screening, as a role change under Article 25(1)(c) when it makes the system high-risk.
- Re-read the Commission's classification guidelines when they are final.
Classification decides which duties attach to the use. It doesn't decide what the agent runs once it is on a production host—that is execution control.
