The cookie banner era of AI
The EU AI Act has stopped being a PDF and become a working reality. After years of drafts, lobbying and staged deadlines, the world's first comprehensive AI law is now something product teams have to ship against, not a thought experiment for policy people.
I've watched two reactions spread through the industry. One half says Europe just legislated itself out of the race. The other half is looking for the smallest possible compliance widget to bolt on and move on. I think the first half is closer to the truth than it's polite to say, and the second half is about to prove it on screen.
What actually changed
The Act sorts AI by what you do with it:
- Unacceptable risk is banned. Social scoring, manipulative systems that exploit vulnerabilities, certain kinds of biometric surveillance.
- High-risk is heavily regulated. AI deciding who gets hired, who gets credit, who gets treated. Human oversight, documentation, audits.
- Limited risk means transparency. If people are talking to a machine, they have to be told. Synthetic content has to say it's synthetic.
- Minimal risk is left alone. Which is most of it, by the way.
On paper it's tidy. The trouble is the date on the paper. The Commission proposed this law in April 2021, a year and a half before ChatGPT existed. The framework was drawn before the products it now governs, and general-purpose models had to be bolted on during the negotiation.
Every law ends up as an interface
Here's the part that interests me as a designer: almost every obligation in the Act lands, eventually, on an interface. "Inform the user they are interacting with an AI system." "Ensure effective human oversight." "Make the system's outputs interpretable." Each one becomes a screen somebody has to draw.
We already know what a law looks like when it reaches the screen. Europe's consent rules gave us the cookie banner, the worst UI pattern of the decade. People like to blame lazy implementation. I don't. When the brief is "prove you complied", you get a pattern built to prove compliance, and the user is an afterthought.
The cookie banner is what a law looks like by the time it reaches the screen.
Even Brussels has noticed. In November 2025 the Commission proposed a one-click reject, no repeat prompts for six months, and a delay of the Act's high-risk rules to December 2027, because the standards needed to comply weren't ready. The rule arrived before the means to follow it.
What you don't see
Frédéric Bastiat wrote an essay in 1850 about the difference between what is seen and what is not seen. A policy has a visible effect, and a second one that never shows up, because it's the thing that didn't happen.
The seen part of AI regulation will be a disclosure toast and an oversight dashboard. The unseen part is the product that launches somewhere else. In 2024, Apple held back its AI features in the EU, Meta kept its newest Llama models out, and OpenAI's voice mode arrived months late. Each pointed at European rules.
To be fair, late is not never. The voice mode did come. But a continent that receives technology late also learns it late and builds on it late.
What I'd do on Monday morning
Map your features against the risk tiers. Not your company: your features. A harmless product can contain one high-risk flow, and that flow decides your paperwork.
Write the "what is the AI doing" screen first. Write it for the user, then check it against the law. Start from the legal template and you'll ship a banner.
Treat disclosure as content design. If it reads like terms and conditions, nobody will read it, compliant or not.
Audit your dark patterns for your users' sake. Trust is the material this job is made of. You didn't need a statute to know that.
In summary
"Move fast and break things" had a good fifteen-year run, and some of what it broke was trust. I don't miss it.
But trust gets rebuilt by people who ship something, watch it fail and fix it in front of their users. A form can't do that.
Move fast, break nothing is the right brief when the people building the product write it. A law can only write the second half.