Cloud AI systems running in the EU now operate inside a fully binding legal framework, and the engineering decisions that matter most in 2026 are no longer model selection alone: they are risk classification, deployer obligations, and unit-cost control. The AI Act, formally Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence, is the first comprehensive legal framework on AI worldwide, and it assigns duties to both providers and deployers based on risk. For platform teams, that means compliance is a deployment property, not a legal afterthought — it belongs in your infrastructure pipeline, your logging design, and your billing model at the same time.
What the AI Act actually requires
The regulation uses a risk-based structure rather than a sector-based one. The European Commission describes this as four levels of risk: unacceptable, high, limited, and minimal or no risk. Systems in the unacceptable tier are banned outright — the Act prohibits nine practices, including social scoring, untargeted scraping of the internet or CCTV material to build facial recognition databases, and emotion recognition in workplaces and education institutions. High-risk systems face the heaviest obligations: risk management systems, data governance, technical documentation, logging, transparency, human oversight, accuracy and robustness requirements. Most cloud AI workloads — an internal RAG assistant, a document classifier, an inference API for customers — fall into the limited or minimal tiers, which primarily trigger transparency duties rather than full high-risk certification. The classification step is the first engineering gate: document the intended purpose, the user context, and the EU deployment surface before writing any architecture.
Deployer duties for cloud teams
For teams that consume foundation models through a hyperscaler API rather than training their own, the relevant role is usually deployer, not provider. That shifts the work to operational controls: you must use the system per its instructions for use, ensure inputs are relevant and sufficiently representative for the intended purpose, monitor operation, inform affected people when they interact with AI, keep auto-generated logs, and inform the provider or distributor if the system constitutes a risk under Article 79. In practice this converts into four infrastructure requirements. First, an immutable log store with retention aligned to the Act’s record-keeping expectations. Second, a model registry that captures version, prompt template, and supplier documentation for every deployed endpoint. Third, a human-review path for decisions with legal or similarly significant effects on a person. Fourth, a transparency surface — labels, disclosures, and contact points — mapped to each user-facing feature. Teams that already run SOC 2 or ISO 27001 controls have most of the plumbing; the gap is usually traceability from a user action back to the exact model version that produced it.
Cost model: match billing to workload
The second hard constraint in 2026 is spend. Managed AI platforms price by compute activity — training, deployment, and prediction — and idle capacity is the silent killer. Google’s documentation for its agent platform states that there is no minimum usage duration for training and prediction; instead, usage is charged in 30 second increments. That single sentence should shape your architecture: bursty, low-latency endpoints with scale-to-zero semantics behave very differently from always-on deployments, and the pricing page warns directly that you pay for each model deployed to an endpoint even if no prediction is made, so undeploying a model is the only way to stop charges. A useful comparison for planning:
| Workload pattern | Billing exposure | Best-fit control |
|---|---|---|
| Continuous inference API | Charged while endpoint exists | Right-size machine type, co-host models |
| Nightly batch training | Charged per compute hour | Scheduled jobs, spot capacity, early-stop |
| Prototype / evaluation runs | Charged in short increments | Auto-teardown after run completes |
| Deprecating a model version | Still billed if deployed | Undeploy endpoint in the same release |
For AutoML-style image workloads, Google lists classification training at $3.465 per node hour, which makes training-run discipline — dataset versioning, caching, and idempotent pipelines — a direct line item rather than an engineering nicety. Batch prediction ($2.222 per hour for the same workload class) is consistently cheaper than always-on online endpoints when latency tolerances allow it, so route by service-level objective, not by default.
Putting it together
Compliance and cost converge on the same artifact: a deployment manifest that records risk tier, transparency surface, log retention, model version, endpoint policy, and teardown rule. An ordered checklist that has held up well for EU teams:
- Classify each workload against the four risk tiers and record the decision with its rationale.
- Map deployer obligations to concrete controls: logging, monitoring, human review, disclosure.
- Register every model version and prompt template with supplier documentation links.
- Set endpoint policy per workload: batch vs. online, scale behavior, teardown trigger.
- Tag spend by workload and alert on idle deployed endpoints older than 30 days.
- Re-run classification whenever intended purpose, users, or data categories change.
For broader architecture context, see our earlier analysis of 2026 cloud AI deployment choices for EU teams and the breakdown of cloud AI costs across tokens, GPU hours, and EU rules. If your stack changed materially with the newest frontier models, the GPT-6 Astra API contract changes are also worth reviewing before you lock supplier terms.
The teams that treat the AI Act as a pipeline stage rather than a legal review are the ones that ship. Risk classification becomes a schema field, transparency becomes a route in the frontend, logging becomes a retention policy, and the endpoint teardown rule becomes a line in the IaC template. None of that is glamorous, and all of it is auditable.