Can AI smart contracts comply with the EU AI Act?

Introduction

The integration of artificial intelligence (AI) into blockchain-based solutions is changing how smart contracts are designed and deployed. Traditional smart contracts execute predefined instructions, while AI smart contracts can analyze data, support more complex decisions, and adapt outputs to changing circumstances.

This combination creates new opportunities for automation, personalization and efficiency, particularly in finance, digital assets and data governance. It also raises an important legal question for businesses: can smart contracts comply with the EU AI Act, and when could an AI-enabled solution be treated as a high-risk AI system?

The answer requires looking beyond one regulation. Regulation (EU) 2024/1689 laying down harmonized rules on artificial intelligence (the “AI Act”) establishes a risk-based framework for AI systems. Meanwhile, Regulation (EU) 2023/2854 on harmonized rules on fair access to and use of data (the “Data Act”) introduces specific requirements for smart contracts used to execute data-sharing agreements.

Depending on the use case, the GDPR, consumer protection rules and sector-specific legislation may also apply. As a result, you cannot assess EU AI Act compliance for a blockchain project by reviewing the smart contract code alone. The legal analysis must also cover the AI model, data sources, intended purpose, affected persons, and the system’s decisions.

What is a smart contract under EU law?

Under the EU Data Act, a smart contract is a computer program used to automatically execute an agreement or part of an agreement, using a sequence of electronic data records and ensuring their integrity and accurate chronological ordering.

The EU Blockchain Observatory and Forum also describes a smart contract as an agreement represented as a computer program. These self-executing programs may be deployed on a blockchain and automatically execute when predefined conditions are met.

How a smart contract works

A typical smart contract lifecycle includes five stages:

1. Defining the conditions in code. The parties agree on the business terms and translate them into program logic, such as “if-then” conditions written in Solidity for Ethereum.
2. Deploying the contract on a blockchain. The code is published through a transaction and receives a contract address. Depending on the technical architecture, its core logic may then become difficult or impossible to modify unilaterally.
3. Receiving trigger events and input data. The contract waits for a transaction or external information supplied through an oracle or another data source.
4. Executing automatically. Once the relevant conditions are met, the blockchain network executes the programmed instructions.
5. Recording the outcome. The result is stored on the blockchain as a timestamped and cryptographically secured record.

This process explains why smart contract compliance must be considered during system design. A legal or technical issue may be difficult to correct after immutable code has been deployed.

What are AI-enabled smart contracts?

AI-enabled smart contracts combine blockchain-based execution with an AI model or AI-generated output. Instead of relying exclusively on fixed rules, the system may use artificial intelligence to assess risk, analyze behavior, classify users, interpret external data, or recommend a course of action.

In most cases, the AI model operates off-chain because running complex models directly on a blockchain requires considerable computational resources. The model processes data externally and sends its output to the smart contract through an oracle, API, or other technical interface. The smart contract then uses that output to trigger an on-chain action.

For example, an AI-powered smart contract may:

• assess information before executing a transaction;
• adjust contractual parameters based on predefined risk indicators;
• support credit, insurance or investment decisions;
• analyze user behavior for fraud prevention;
• personalize services according to a user profile;
• automate elements of data-sharing or digital-asset operations.

This architecture creates a chain of responsibility involving the AI provider, smart contract developer, deployer, oracle provider and business operating the service. Consequently, AI smart contract regulation depends on each party’s role and the intended use of the complete system.

How the EU AI Act applies to smart contracts

The AI Act does not classify every blockchain program as an AI system. A conventional deterministic smart contract that executes only fixed instructions generally does not become subject to the AI Act merely because it operates on a blockchain.

The position may change when a smart contract incorporates or depends on an AI system. In that case, the business must determine whether the relevant component meets the AI Act’s definition of an AI system, identify the provider and deployer, establish the intended purpose and assess the applicable risk category.

The AI Act follows a risk-based model that distinguishes between:

• prohibited AI practices;
• high-risk AI systems;
• AI systems subject to specific transparency obligations;
• other AI systems presenting minimal or limited risk.

The classification cannot be based solely on the technology used. It depends primarily on what the system is designed to do, how it is used, and whether its output affects people’s safety, fundamental rights,s or access to important services.

Could an AI smart contract be prohibited under the AI Act?

Article 5 of the AI Act prohibits certain AI practices that create an unacceptable level of risk. These include specific uses of manipulative or deceptive techniques and the exploitation of vulnerabilities where the applicable legal conditions are met, and significant harm is caused or reasonably likely.

An AI-enabled smart contract could therefore raise Article 5 concerns if it were designed or used to manipulate users, exploit vulnerabilities or materially distort a person’s ability to make an informed decision. The presence of a blockchain does not remove these restrictions.

For example, a system that profiles financially vulnerable consumers and automatically changes contractual conditions to exploit their circumstances may require particularly close legal review. In this situation, the relevant question is not whether the code is self-executing but whether the AI-enabled process constitutes a prohibited practice.

Are AI smart contracts high-risk under the AI Act?

Not every AI-powered smart contract is automatically a high-risk AI system. Under Article 6, high-risk classification generally depends on whether the system falls within a regulated product category under Annex I or an intended-use category listed in Annex III.

Annex III includes certain AI systems used in areas such as biometrics, employment, access to essential private or public services, law enforcement, migration and the administration of justice. An AI component connected to a smart contract may therefore be high-risk when its intended purpose falls within one of these categories, and the relevant statutory conditions are met.

For example, an AI system that materially influences a decision on a person’s eligibility for credit may fall within a high-risk use case. If its output automatically triggers a blockchain transaction, the surrounding smart contract architecture must not prevent the organization from meeting applicable duties on human oversight, record-keeping, or corrective action.

Profiling and material influence on decisions

Article 6(3) provides a limited exception for certain Annex III systems that do not pose a significant risk of harm to health, safety, or fundamental rights, including by not materially influencing decision-making outcomes. However, an Annex III system that profiles natural persons is treated as high-risk.

Businesses should therefore determine:

• whether the AI system performs profiling;
• whether its output materially influences a decision;
• whether the decision affects a natural person’s rights or access to services;
• whether a relevant Annex III use case applies;
• whether human intervention is technically and operationally possible.

These questions are central to assessing whether an AI smart contract is high-risk under the AI Act.

EU AI Act compliance requirements for high-risk systems

Where an AI component is classified as high-risk, the responsible parties may need to comply with the obligations in Articles 8–15 of the AI Act. Depending on their roles and the specific system, the required measures can include:

• a documented risk-management system;
• appropriate data governance and data-quality controls;
• technical documentation;
• automatic record-keeping and logs;
• clear information for deployers;
• effective human oversight;
• appropriate accuracy, robustness and cybersecurity;
• post-market monitoring and incident-management procedures;
• a conformity assessment before the system is placed on the market or put into service.

These duties may be difficult to reconcile with a completely immutable and autonomous smart contract. A compliant architecture may require pause functions, controlled intervention mechanisms, upgradable components, off-chain governance processes or other safeguards that allow the responsible organization to monitor and correct the system.

For this reason, blockchain AI compliance should be incorporated into the technical design before deployment rather than added after the smart contract is already operating.

Smart contracts under the EU data act

The AI Act is not the only relevant regulation. Article 36 of the Data Act establishes essential requirements for smart contracts used to execute data-sharing agreements. Depending on the project, these requirements may apply even if the smart contract does not contain an AI component.

The principal EU Data Act smart contract requirements include:

• robustness and access control;
• safe termination and interruption;
• data archiving and continuity;
• consistency with the terms of the data-sharing agreement;
• interoperability with relevant standards and technical specifications.

The vendor of the smart contract, or in certain cases the person deploying it for others, must perform a conformity assessment and issue an EU declaration of conformity where Article 36 applies.

AI-powered projects must therefore assess the AI Act and Data Act separately. Compliance with one regulation does not automatically establish compliance with the other.

GDPR and automated decision-making

Where an AI smart contract processes personal data, the GDPR may apply alongside the AI Act and Data Act. Relevant issues can include transparency, purpose limitation, data minimization, lawful processing, data-subject rights and restrictions relating to solely automated decisions.

Blockchain immutability can create additional challenges where personal data must be corrected, erased or rendered inaccessible. Businesses should avoid placing unnecessary personal data directly on-chain and should assess whether off-chain storage, cryptographic references or other privacy-preserving designs are more appropriate.

Where a system makes or supports decisions with legal or similarly significant effects, the organization should also assess whether meaningful human intervention and a process for contesting decisions are required.

Practical compliance checklist for AI smart contracts

Before deploying an AI-powered smart contract in the EU, businesses should complete the following steps:

1. Map the complete system. Identify the AI model, blockchain, smart contract, oracle, external data sources, and all participating providers.
2. Define the intended purpose. Document what the AI component is designed to do and which decisions or transactions it influences.
3. Allocate legal roles. Determine who acts as the AI provider, deployer, importer, distributor, smart contract vendor, data controller and processor.
4. Complete an AI Act classification. Check prohibited practices, Annex I, Annex III, and any applicable transparency obligations.
5. Assess Data Act applicability. Determine whether the smart contract executes a data-sharing agreement covered by Article 36.
6. Review personal-data processing. Map data flows and assess the GDPR lawful basis, transparency duties and data-subject rights.
7. Design human oversight. Ensure that authorized persons can review significant decisions and intervene where required.
8. Build technical safeguards. Consider access controls, logging, pause mechanisms, secure termination, rollback procedures and upgrade paths.
9. Prepare documentation. Maintain risk assessments, technical documentation, policies, testing records and incident-response procedures.
10. Monitor the system after deployment. Review model performance, discriminatory outcomes, cybersecurity risks and regulatory changes.

When should businesses seek legal advice?

Legal review is particularly important where an AI-enabled smart contract:

• affects access to credit, insurance, employment or essential services;
• profiles individuals or analyses their behavior;
• changes contractual conditions based on AI-generated outputs;
• processes biometric or other sensitive personal data;
• automatically executes decisions with legal or financial consequences;
• supports tokenization, DeFi, digital-asset or data-sharing projects operating in the EU.

Early legal review helps teams align the contractual model, technical architecture and compliance documentation before deployment. It can also reveal whether the project requires a conformity assessment, a data protection impact assessment, or additional sector-specific authorization.

Conclusion

AI smart contracts can comply with the EU AI Act, but compliance depends on how the AI component is designed and used. A deterministic smart contract is not automatically an AI system, and an AI-enabled smart contract is not automatically high-risk. The intended purpose, affected persons, regulatory category and impact of the system’s outputs must all be assessed.

Projects operating in the European Union may also need to comply with the Data Act, GDPR, consumer protection law and sector-specific requirements. The most effective approach is to implement compliance by design: classify the system, allocate responsibilities, document risks and build appropriate oversight and intervention mechanisms before deployment.

Legal support for AI and smart contract compliance

Manimama Law Firm provides legal support for Web3, blockchain, artificial intelligence, and digital-asset projects. We help companies assess EU AI Act compliance, determine whether an AI system may be prohibited or high-risk, and establish the legal roles of providers, deployers and other participants.

Our team also advises on smart contracts under the EU Data Act, GDPR compliance, contractual structuring, risk-management documentation and compliance-by-design measures. The scope of support is tailored to the project’s technology, business model, users and target jurisdictions.