Software Engineering Meets the EU AI Act: Artifacts, Patterns, and Future Directions

Abstract

As AI systems become increasingly integrated into consumer, enterprise, and public-sector software, ensuring compliance with emerging AI regulations has become an important challenge. Under the 2026 Digital Omnibus, the EU AI Act’s high-risk obligations are being phased in through 2027–2028. So far, compliance has been treated mainly as a documentation problem: tools check what organizations write about their AI systems. We argue that software engineering offers a complementary path, because an AI system is also a set of artifacts that carry evidence about what the system does. We re-frame AI Act compliance as a software engineering problem and set out an SE-AI Act compliance taxonomy for Articles 8 to 15 organized into three detectability tiers. We derive sub-clause-level detection patterns for Article 12 on record-keeping and implement them in AIActQ, a prototype static analyzer that recovered evidence from three open-source AI repositories: BentoML, DeepFace, and CompreFace. Across 24 repository-sub-clause pairs, AIActQ achieved 75.0% accuracy, with 73.3% macro precision and 66.3% macro recall, showing stronger performance for automatically detectable logging and monitoring obligations and limitations for context-dependent traceability requirements. Ground-truth labels were validated through inter-rater agreement (Cohen’s kappa = 0.799, substantial agreement). We outline directions for SE researchers, industry, standards bodies, and regulators to consider AI regulation as a software engineering concern.