New Rules, Old Habits: The EU AI Act Hits the Project Floor

Sunday Reflection — 2026-11-01

On Thursday, I watched a software team in Saxony-Anhalt spend four hours wrangling over one AI model risk checklist. Nobody wanted to sign off. Two German developers went line by line through the questions while the British product owner rolled his eyes and kept asking when we’d get back to the backlog. That tension—between legal obedience and delivery rhythm—has become routine since the EU AI Act started biting mid-sized firms this month.

All the official training says you can “embed compliance into agile.” That’s not what I’m seeing. Teams are dusting off their old waterfall instincts: write it down, print it, file it, tick the boxes before moving forward. Ten years ago, before anyone cared about ‘responsible AI’, we built a voice recognition feature for a medical app in Magdeburg. The German client wanted every edge case documented and signed by the project manager. We created a four-inch stack of paper and nobody, not the doctors or the devs, actually read it. The real bugs showed up in UAT and kept us up nights anyway. This month feels like that again—except now, every technical misstep might trigger a compliance audit.

mermaid flowchart LR A[AI Feature Proposed] --> B{Compliance Required?} B -- Yes --> C[Add Documentation & Checklist] B -- No --> D[Standard Agile Delivery] C --> E{Who Signs Off?} E -- Legal --> F[Delay, More Reviews] E -- Product Owner --> G[Pushback, Confusion] F --> H[Backlog Stalls] G --> H

The habits aren’t the same either side of the channel. Most German teams I’ve managed treat new documentation like gospel, even if nobody will admit to trusting the docs more than people. British colleagues are happy to dash something off, call it “living,” and move on—until legal gets nervous. The friction comes from the tools as much as the law: when Jira rituals crash into legal review, status meetings balloon and the clean line from idea to production gets knotted up in draft PDFs and worried emails. I’ve lost track of how many times someone’s had to say “Let’s park this until we know what compliance wants.”

What keeps me from despair is the rare project manager who can speak both languages—who wrangles process into just enough box-ticking to keep everyone out of trouble, then carves a shortcut back to building things that matter. That’s a harder job than it was a month ago, but much more valuable. If there’s a lesson, it’s this: process can protect, but it rarely delivers.