The EU AI Act is changing software development and quality assurance. AI is no longer just an experimental part of a business, it is now a regulated part of digital infrastructure. QA has for a long time been more than just finding bugs or assuring the functionality and user experience, but the growing number of AI generated code and the EU AI Act expands its meaning further. Proving compliance, managing risk, and checking that a system behaves in an ethical way will become more and more important.

The Act uses a risk-based approach and sets strict, legal requirements for high-risk AI systems in particular – such as automated CV screening tools, credit scoring algorithms, or biometric identification systems. What does this mean in practice for software testing and QA?

More focus on data

Data quality, representativeness, and integrity become central, even more so than before. Under Article 10(Data and Data Governance), testing should check that training and test data do not contain bias that could lead to discriminatory or incorrect results in production. This often calls for techniques like metamorphic testing to evaluate outcomes when standard expected results are hard to define.

Reliability and security testing become continuous

Under Article 15(Accuracy, Robustness, and Cybersecurity), the regulation requires high performance, reliability, and security from AI systems throughout their lifecycle. This calls for systematic benchmarks and measurement methodologies, red teaming, and adversarial testing, where a model is tested with unusual or hostile input data. Security testing also needs to cover risks that are specific to AI, such as model tampering or data theft. Standards like ISO/IEC 29119-11 offer practical guidance for these continuous tests.

Transparency and human oversight become part of testing

Under Article 13 (Transparency) and Article 14 (Human Oversight), QA must check that decisions made by an AI are explainable and traceable. This also includes the user interface and user experience: does the system give people correct information, and a real chance to interrupt or correct a decision made by the AI?

Testing can not happen only at the end

The EU AI Act shows that testing only at the end of a development cycle is not enough. Compliance requires “shift left” thinking to go further, QA needs to be involved already at the requirements and data selection stage. As outlined in Article 72(Post-Market Monitoring System), testing also does not stop once a system is released. AI models can drift over time as performance changes or data changes (model drift and concept drift), so continuous monitoring and testing in production becomes necessary to stay compliant. Compliance will ultimately require audit-ready conformity evidence packs, versioned datasets, and traceable logs.

An opportunity, not only a requirement

For a leader responsible for QA services, the EU AI Act is not only a legal obligation—with potential fines for non-compliance reaching up to €15 million or 3% of global annual turnover. It is also a chance to build trust as a competitive advantage. Certified, secure, and compliant AI will become a requirement for operating in the market. This calls for a new kind of expertise from a QA partner, one that combines traditional software testing, data science, and an understanding of the regulatory environment.

Checking the readiness of current QA processes now, before the transition periods end, is a step worth taking today.

Contact us if you want to know more!

• Blog
|
• EUAIAct
|
• QA