Figma AI Under the EU AI Act: A Design Assistant, Not a Risk Category
Figma AI (First Draft, Make) is minimal-risk productivity under the EU AI Act. Article 50 only bites when output is customer-facing. Classify by use.
Figma AI is a productivity tool for designers. Under the EU AI Act it is minimal risk — and that does not change because the feature is called "AI."
First Draft turns a text prompt into a structured UI layout. Figma Make turns written instructions into an interactive prototype. Smaller tools — Replace content, Make an image, Add interactions — speed up early ideation. None of this is a use case the EU AI Act, Regulation (EU) 2024/1689, treats as high-risk. The work happens inside the design file, before anything ships. So for a product or design team, Figma AI carries no mandatory obligations — with one narrow exception that only appears when an AI-generated artefact becomes customer-facing.
This page draws that line, names the one duty that can attach, and clears up the GDPR question that comes up faster than the AI Act one.
Classify the use, not the feature name
The Act assigns risk by what the system is used for, not by whether a feature is marketed as AI. There is no "Figma tier."
Generating wireframes, drafting screens, prototyping flows and producing design-system-aware layouts is design assistance. It is not listed in Annex III — the eight high-risk areas covering biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice — and it does not engage the Article 5 prohibitions. That places Figma AI in the minimal-risk tier: no conformity assessment (Article 43), no technical documentation (Article 11 / Annex IV), no EU-database registration (Article 49), no risk-management system (Article 9).
The single duty already in force for any AI tool is Article 4 AI literacy, live since 2 February 2025. Designers using First Draft or Make should know, at a level fit for their role, that AI drafts need human review for accessibility, semantics and production-readiness — which is exactly what the tooling guidance says anyway. That is a light baseline, not a compliance project.
| Figma AI in use | EU AI Act tier | What it requires |
|---|---|---|
| First Draft / Make in the design file | Minimal | Article 4 literacy only |
| AI-built mock-ups in internal reviews | Minimal | Nothing mandatory |
| An AI chat/agent UI you ship to end users | Limited (Art 50) | Article 50(1) "you're talking to AI" notice |
| AI-generated images published in your product/marketing | Limited (Art 50) | Article 50(2)/(4) marking & disclosure |
The one place Article 50 can attach
Figma is a design surface, so its AI output is normally a means to a product — not the product. The transparency rules under Article 50 bite on the shipped result, not on the act of designing.
Two situations move you into limited risk, and both are about what reaches an end user:
- You ship a conversational AI feature. If the screens you designed in Figma become a live chatbot or AI assistant your users interact with, Article 50(1) requires that users be told they are interacting with an AI system unless it is obvious. That duty is about your deployed product, triggered by the design only because the design becomes the thing users touch.
- You publish AI-generated media. If you use Figma's "Make an image" to produce a realistic AI image and publish it in your product or marketing, the synthetic-content rules apply: provider machine-readable marking under Article 50(2) and, for realistic deepfake-style media, deployer disclosure under Article 50(4).
The general Article 50 transparency duties apply from 2 August 2026; the synthetic-content marking and watermarking element lands earlier, on 2 December 2026, under the Digital Omnibus package. Article 50 breaches sit in the €15 million or 3% of worldwide turnover band (Article 99(4)), with the Article 99(6) SME cap taking the lower figure.
Timeline note: the deferral of the stand-alone high-risk regime to 2 December 2027 is set by the Digital Omnibus, adopted by the European Parliament (16 June 2026) and the Council (29 June 2026), entering into force on Official Journal publication expected before 2 August 2026. None of this touches Figma AI, which stays minimal risk; it is simply the standing context for any dated EU AI Act page.
The provider trap is about your product, not Figma
Software teams ask the right follow-up: if we build an AI feature with Figma's help, are we a provider? Figma's role in your design process does not make you a provider of anything. But if the product you ship is itself an AI system — say a customer-facing assistant — then your product is classified on its own use, and if that use ever lands in Annex III (for example, a hiring-screening feature under Annex III point 4), the heavier provider stack under Article 16 applies to that product: technical documentation, conformity assessment (Article 43), Declaration of Conformity (Article 47), registration (Article 49). Designing it in Figma is irrelevant to the classification; the shipped system's purpose is everything.
GDPR usually arrives first. If you paste real user data, customer records or production content into a Figma AI prompt, you need a lawful basis (GDPR Article 6) and an appropriate processing arrangement; special-category data (GDPR Article 9) needs a specific legal ground. Use synthetic or placeholder data in design drafts and the question disappears.
Worked example: Tafel Software GmbH
Tafel Software GmbH is a fictional German B2B SaaS company — about 70 employees, ~€11M turnover — building a procurement product. Its design team uses Figma First Draft to draft settings screens and Figma Make to prototype an onboarding flow.
Classification of the design work: minimal risk. No Annex III use, no Article 5 issue — so no conformity assessment, no registration. Their only standing item is the Article 4 literacy note reminding designers to review AI drafts for accessibility and correctness before they become real screens.
The duty appears in the product, not the tool. Tafel ships an in-app AI assistant that answers users' procurement questions. Because end users interact with it, Article 50(1) applies from 2 August 2026: the assistant must make clear it is an AI system. That is a one-line UI disclosure, owned by the product team — the Figma design phase carried no obligation at all. Had Tafel instead built an AI feature that screened supplier-side job applicants, that product would be Annex III high-risk and classified on its own; the Figma origin would still be beside the point.
How Confir helps
Register Figma AI and Confir's rule-based engine runs the Article 5 check and the Article 6 / Annex III scoping against how you actually use it. For design-assist work it returns minimal risk with the short Article 4 literacy item. When you tell the engine you ship a customer-facing AI feature, it classifies that system separately and surfaces the Article 50(1) disclosure — or the heavier provider stack if the use lands in Annex III. The logic is deterministic and reproducible: the same intake yields the same cited finding, with the firing rule written in plain language.
Related guides
- Provider vs deployer: which are you?
- Article 50 transparency obligations
- Article 6 high-risk classification
- EU AI Act for SaaS startups
- GitHub Copilot and the EU AI Act
- How AI risk classification works
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →