Articles

We read 130 company claims that their AI meets the EU AI Act. Nearly nine in ten don't say how.

16 October 2026

AI-assisted text, reviewed by a person at Heedward.

Most stop at the phrase. Here is what the sentences leave out, what your customer will ask next, and what a better claim looks like.

One software company promises, in German, 100 per cent conformity with Article 14 of the EU AI Act. Another, a recruitment tool, calls its AI Act claim "self-declared".

In a customer's supplier spreadsheet, both lines land in the same column. Only one of them tells the reader what the claim is worth.

What we did: we collected 130 of these claims from companies' own websites and read each one, a sentence at a time. What we did not do: judge them. We read sentences, not systems. We call no claim true or false, and a short line on a homepage may sit on top of serious work.

Why should you care? If your homepage has a line like these, the next customer who sends you an AI questionnaire is likely to ask exactly the questions these sentences skip. It is worth five minutes.

Five ways to say it, and the question each one invites

1. The bare badge. Four in ten claims say the phrase and stop: "EU AI Act compliant", sometimes with the product's name. Nothing about which part of the Act, or how. The question: which part of the Act, for which system?
2. The badge wall. Nearly a third list the AI Act next to other laws and standards: ISO 27001, the MDR, DORA, HIPAA. Nine in ten of these include GDPR. The pairing is natural, but the two laws ask different things. GDPR asks about the personal data. The AI Act asks about the system: what it is used for, how risky that use is, and who built it. The question: you checked the data; what did you check about the system?
3. Built in. About one in seven say "by design", "from day one" or "out of the box". It is a good instinct, and the easiest one to show. The question: where is the design decision written down, and what in the system carries it out?
4. The absolutes. Ten claims say "fully", "100%" or "across all use cases". The question: all of which requirements, and who checked?
5. The specific ones. Only one in eight name something a customer can follow up: human oversight, a transparency disclosure, a risk class, an audit trail, explainable answers. Five cite an article by number, Article 14 or Article 50. These are the claims a reader can start to check.

The groups overlap, so they add up to more than 130. Two small details: two claims tie themselves to a date ("August 2026"), and one, the recruitment tool above, calls itself "self-declared".

The thing none of them says

Under the AI Act, what a company has to do depends on its role. The provider builds a system and puts it on the market, and carries most of the obligations. The deployer uses it, and carries others. Take human oversight: the provider designs the system so that a person can oversee it, and the deployer assigns people who can.

Not one of the 130 claim sentences says which of the two the company is. Only three mention a risk class at all.

The gap is sharpest where we least expected it. A fifth of the claims come from recruitment and HR software, an area the Act names directly: it lists AI used to filter job applications or evaluate candidates as high-risk. Two of those claim sentences mention it.

Three questions a claim has to answer

After 130 of these, the same three gaps keep coming back. A customer who reads "AI Act compliant" still does not know:

1. Which system the claim covers.
2. Which obligation it means, and in what role.
3. What shows it.

Nearly nine in ten of the sentences answer neither the second nor the third. A few come close. One describes the human interventions its product records, and ties them to Article 14: a system, an obligation and a record, in one line. That is the bar.

The same claim, rewritten

Here is how that can look, for an imaginary product:

Before: "EU AI Act compliant."

After: "Our tool ranks job applicants for employers, a use the AI Act lists as high-risk. We are its provider. Every ranking goes to a recruiter who can override it; the tool logs each review and each override, and customers can export that log."

This is an illustration, not wording for a real product. Whether a system is high-risk, and who its provider is, are questions for your legal counsel. The point: every part of the second version can be checked.

What shows it

The third question is the one most claims skip. It is also the one we work on.

We spent more than a decade shipping enterprise software. A status line saying "tested" never got a release out of the door; the test results did. Evidence works the same way. A policy says that a person reviews the system's output. The log the system already keeps shows that they did: who, when, and what they changed. Where a requirement matches something a running system does, the system's own records make better evidence than a document written about it. Not every requirement works that way, and it does not have to. But a customer's questionnaire is easier to answer with a record than with a badge.

So, what does your sentence say?

Read the AI Act line on your own site and ask it the three questions. If it answers them, put the answers on the page; they are your strongest sales line. If it does not, a customer's questionnaire will ask them soon enough.

Send us your claim sentence at hello@heedward.com, and we will tell you which of the three questions it leaves open.

How we counted

Up to 7 October, AI research agents searched public company pages for claims that a product or service meets the EU AI Act. We kept only claims about the company's own product or the systems it builds, not offers to help others with the Act, and recorded each claim's exact wording. The sample is not representative: we found the companies by searching for the claim. They come from thirteen industries and are mostly based in Europe.

We read the claim sentence as recorded, not the rest of the page, which may say more. We counted each company and product once. A claim counts as a bare badge when it names nothing beyond the Act itself: no other law, no "by design", no absolute, nothing specific, no date. Words that only describe the product, such as "private AI" or "for resellers", do not count. On 15 October we re-opened 25 claims at random: 24 still carried the same wording, and one site blocked us.