/Technology

If you build software today, there's a decent chance that a decision made in a plenary session in Brussels, in Brasília, or in some US state assembly is already, without you noticing, nudging your product roadmap somewhere different from where you planned it six months ago. That's not rhetorical exaggeration. It's fairly literal: as I write this, the law governing AI use in the European Union just went through a revision that changes dates, deadlines and obligations that companies worldwide had been scrambling to meet. And Brazil is about to vote, in an election year, on its own AI legal framework. I keep thinking about how many solo founders, kind of like me and probably like you, are building some AI feature right now without knowing it might already be out of compliance the moment it ships. Let's take this piece by piece, because there's a lot of nuance here, but I promise it's worth reading through to the end, especially if you build stuff for the internet. Start with the most repeated myth of the last few months: that the EU AI Act "takes effect in August 2026" and that's that. That's not quite true anymore. After a year in which it became obvious the European Commission itself wasn't ready with the technical guidance needed to enforce high-risk system rules, negotiators landed on what's being called the Digital Omnibus, which pushed a good chunk of those obligations back. Annex III rules, covering areas like employment, education, credit and critical infrastructure, now apply from December 2027. Annex I, tied to regulated products like medical devices and elevators, moved to August 2028. So whoever was racing against this year's August deadline just got real breathing room, more than a year in some cases. There's a catch though, and it's the kind that tends to catch people off guard. The transparency rules under Article 50 are still standing for August 2026. In practice that means if your product uses a chatbot, generates synthetic image, text or audio, or interacts with users while pretending to be human, you still need to disclose that clearly by that date, even though the heavier "high-risk" obligations got pushed back. It's almost ironic: the part users actually see stayed on the original timeline, while the expensive-to-implement part for companies got delayed. If you have any generative AI feature running right now without that disclosure, this is genuinely the moment to put it on your list. On the other side of the Atlantic the story looks pretty different, and honestly a bit messier. The US doesn't have, and doesn't seem close to having, a comprehensive federal law on AI and data privacy. What exists is a state-by-state patchwork, with California, Colorado, Texas and others each writing their own rules, each with its own definition of what counts as sensitive data, what needs explicit consent, and what kind of algorithmic audit is required. For a small company trying to sell across the whole US market, that turns into a state-by-state compliance puzzle, the kind of thing that eats up dev time that should be going into the actual product. Here in Brazil things are moving too, just slower. Bill 2338/2023, known as the AI Legal Framework, was unanimously approved by the Senate in December 2024 and now heads to the House of Representatives for a final vote expected this year. The detail nobody can really ignore is that 2026 is an election year in Brazil, and AI regulation is deeply tangled up with political deepfakes, campaign microtargeting and disinformation, so expecting the vote to be purely technical would be naive. The text closely follows the European model: risk-based classification of AI systems, rights like explanation and contestation of automated decisions, a new national oversight body, and fines that can reach roughly fifty million reais per violation, doubling on repeat offenses. There's also an interesting clause that hasn't gotten much attention outside legal circles: authors of copyrighted work would get the right to veto the use of their own material in training AI models, something that's still unresolved even in the European debate. Which brings me to the actual core tension behind all of this. There's a fairly structural contradiction between data privacy and how modern AI models get trained. Privacy laws, from GDPR to Brazil's LGPD, were built around minimization: collect only what's necessary, keep it only as long as needed, for a stated purpose. Generative AI has the opposite appetite. More data generally means a better model, and the data feeding these models often comes from mass scraping, without individual consent and without a single, declared purpose. It's no accident that so much of the legislative debate over the last couple of years has circled around exactly this: who owns the data used for training, whether anonymization actually anonymizes anything (spoiler: often it doesn't, re-identification through cross-referencing is very much a thing), and whether there's any real way to reconcile "collect little" with "train at scale." For anyone building product, this stopped being a legal department's problem and became engineering work. Privacy by design isn't just a best practice you nod along to in a blog post anymore. In several jurisdictions it's now a documented requirement, with mandatory impact assessments before launching anything classified as high-risk. That means traceability of automated decisions, formal technical documentation, and in some cases third-party audits. For a big company that's a compliance department's job. For a solo founder or a small team that's, in practice, a tax on time and money that falls disproportionately hard, and I say that with some firsthand experience, because running a platform solo already means juggling SEO, content, growth and infrastructure at once, and now this kind of regulatory obligation gets added to the pile without much mercy. There's also a side effect worth mentioning: fragmentation. If your product serves users in Europe, Brazil and the US at the same time, you might end up needing different architecture per region, data residency choices, transparency banners that vary by country, feature flags to turn AI functionality on or off depending on where the user is accessing from. That changes how you plan a roadmap. A generative AI feature that used to go straight from idea to production now needs to be born with a compliance plan already sketched out, not something you patch in after the product takes off. And the risk of ignoring all this isn't hypothetical. Fines are high enough to genuinely hurt, reaching tens of millions both in Europe and in the Brazilian text currently in progress, calculated against revenue under some regulatory models. Enforcement bodies are also being built out right now, the EU's AI Office, Brazil's upcoming oversight system, which signals that the era of "regulation on paper, no real enforcement" is running out of runway. There are two honest ways to look at this, and I think both have a point. Some argue heavy regulation stifles innovation, especially for people without a legal department or the budget for audits and certification, which ends up favoring big tech that already has the structure to absorb that cost. Others argue the opposite: that clear rules create a baseline of trust that legitimizes the product in the market, making it easier to sell to users and investors who know there's at least a minimum standard for how their data gets handled. I don't think there's a clean answer here, and maybe there shouldn't be. What I actually wanted to leave you with is this question, if you're building product right now: did your AI feature get designed with this in mind from day one, or are you going to find out you need to adapt only once someone sends you a notice? Genuinely curious how people are handling this in practice, whether you've had to redesign something because of regulation, or you're just waiting to see how it plays out. Drop it in the comments. React too if this kind of topic is on your radar, because there's a lot more layers here I still want to dig into in future posts.