EU Or US Court Will Classify AI‑Generated Code As Higher‑Risk

The sacred ‘as‑is’ is running out of runway

For thirty years, the software industry has lived under one simple religion: ship fast, patch later, and let the EULA handle the sins. Everything, from your to‑do app to a hospital’s patient records system, arrived “as‑is,” “with all faults,” and mysteriously nobody was responsible for anything.

AI‑generated code is quietly blowing that up. When a junior dev pastes in 300 lines from a code assistant that later misroutes an ambulance or misprices a trillion in derivatives, the story is no longer “bugs happen.” It is “you knowingly used a stochastic parrot to write safety‑critical logic.”

Regulators and judges can live with buggy humans. They panic when the bugs are industrially scalable and deniably sourced. That is what AI‑generated code offers: cheap, fast, and plausibly unaccountable failure.

The EU calendar that turns vibes into fines

The EU has already built the scaffolding. It just has not hung the AI‑written‑code sign on it yet.

The AI Act is not a vibe. It is a calendar. Prohibited AI tricks have been illegal since February 2025. General‑purpose AI model rules hit in August 2025. The really sharp bits, the high‑risk regime, bite from December 2027 for standalone systems and August 2028 for AI buried in regulated products.

The Digital Omnibus quietly extended only those high‑risk deadlines. Brussels essentially circled that layer in red and wrote: “this is the scary stuff.”

Draft Commission guidelines already describe how to classify high‑risk AI, with one route for AI as a safety component of regulated products and another for standalone high‑risk use cases. Anywhere AI is inside a medical device, a car, a critical infrastructure controller, the framework is there to ask: what exactly is this thing doing and why should it be trusted?

By late 2027, when those high‑risk obligations finally go live, regulators will be staring at systems whose core logic was written, refactored, or silently “helped” by generative models. To decide penalties under Article 99, they must decide what counts as negligence. Pretending AI‑generated code is indistinguishable from a human’s midnight commit is the comfortable answer. It is also the least defensible one politically.

America’s “end of as‑is” mood

On the other side of the Atlantic, the US is doing what it always does: ignoring the problem until plaintiffs’ lawyers discover it has billable hours.

Policy shops are already drafting the obituary for “as‑is” software. Think‑tank reports now ask, almost politely, whether it still makes sense to shield vendors that pipe unpredictable models into safety‑critical stacks and then shrug, “you clicked agree.”

The key difference: the US does not need a grand AI statute to move. One federal appellate court opinion that says, in effect, “this limitation of liability does not fly when you let an AI write half the product,” and suddenly AI‑generated code is a documented higher‑risk category in contract and product law.

American judges have two temptations. One is to treat AI as a mere tool and say software is software, defects are defects, and the old rules cover it. The other, which is becoming more attractive every time an AI‑assisted update bricks something important, is to treat algorithmically authored code as evidence of known, foreseeable risk that demands tighter duties.

Foreseeability is doing a lot of work here. You might plausibly claim you could not foresee the specific bug your tired engineer shipped. It is harder to claim you could not foresee that a code generator trained on the public internet might hallucinate its way through your brake control system.

Why a formal higher‑risk label is more likely than not

The consensus story is soothing: regulators will stick to “technology neutral” language. AI systems, not their outputs, will be regulated. Code is code, regardless of who or what typed it.

The signal says otherwise. Several forces are prying AI‑generated code out of that neutral comfort zone:

• Embedded AI everywhere. Compliance reviews in Europe already discover AI buried in HR tools, CRM, and content platforms that nobody knowingly bought as “AI.” That is forcing regulators to look not just at systems, but at outputs they did not consent to.
• Transparency creep. Article 50 and the coming influencer and content rules are normalizing special labels for AI‑mediated output. If ads and political posts need “AI inside” disclosures, software that secretly ships AI‑written logic into a hospital will not stay in the generic bucket forever.
• Insurance and contracts. Underwriters are beginning to ask how much of a stack was generated by models and vendors are carving out AI clauses in licenses. Once the market treats AI‑generated code as a separate exposure, courts and regulators gain a ready‑made rationale: everyone knew this was a different risk.
• Social media PTSD. No regulator wants another decade of “we thought platforms were just websites” hearings. The political appetite now is to over‑label AI risks, not under‑label them.

Put those together and the path of least resistance by 2027 is not heroic technology neutrality. It is a line in an EU implementing act, or a paragraph in a US appellate decision, that says some version of: “Where software is generated by AI systems, additional obligations / higher duties apply, given the elevated and less predictable risk profile.”

The case for inertia, and why I am still betting on movement

The biggest argument against my call is boring and strong: courts and regulators hate multiplying categories. If they can avoid creating “AI‑generated code” as a new legal object, they will. The EU AI Act is explicitly framed around AI systems and use cases, not artifacts like lines of code. US courts adore contract freedom and will happily enforce a ruthless EULA between sophisticated parties.

Timing is also messy. EU high‑risk obligations for embedded AI only really bite from August 2028, which is outside our forecast window. Complex cases take years to reach top courts. It is entirely possible that by New Year’s Eve 2027, nasty AI‑bug cases are still stuck in lower courts or have settled quietly.

I am still at roughly 60 percent on an explicit higher‑risk label by then because neither system is operating in a vacuum anymore. The EU has locked in a calendar that forces detailed classification work in 2027 for at least some Annex III systems. The US has an emerging narrative that “AI‑assisted” is a synonym for “you knew better.” Both are looking for a clean way to signal that using AI to write critical code is not just ordinary sloppiness.

The cleanest way is to say what everyone already believes over coffee and under NDA: AI‑generated code is a different risk class. Once that sentence lands in an official document with a logo, this forecast resolves.

Satirical verdict: the era of the haunted pull request

So here is the bet, on the record: by 31 December 2027, at least one big EU or US authority will formally bless the phrase “AI‑generated code” with a higher‑risk warning label that human commits do not carry.

That will not kill AI tooling. It will do something funnier. It will turn every future post‑mortem into a séance: teams gathered around a broken feature, lawyers asking, “Which lines came from the model,” and someone admitting that the ghost in the repo was not covered by the old ‘as‑is’ prayer.