Vercel v0 Under the EU AI Act: The Generator Is Not the Product

Using Vercel v0 to generate React components and full-stack scaffolding is minimal-risk under the EU AI Act. Beyond the Article 4 AI-literacy duty every deployer carries, there are no mandatory obligations attached to the act of prompting a UI into existence. The classification that should worry you is not v0's — it is the risk tier of whatever you build and ship with it, which the Act assesses entirely separately.

This is the trap teams fall into. v0 is a code-and-interface generator, so it never decides anything about a person. But the application you deploy with v0's output might screen job applicants, score creditworthiness, or run a public-facing chatbot — and those uses carry obligations that have nothing to do with the tool that wrote the markup. Regulation (EU) 2024/1689 classifies AI systems by use, not by the IDE or generator that produced the code.

This page separates the two layers: v0-the-tool (minimal) from the-thing-you-ship (assessed on its own), and flags the Article 25 moment where you stop being a user of an AI feature and become the provider of one.

---

What Vercel v0 actually does

v0 is an AI agent, built by Vercel, that turns natural-language prompts, screenshots, or Figma files into working code — UI components, full-stack applications, and live prototypes — and can deploy them to Vercel infrastructure with one click. Designers use it to convert mockups into high-fidelity interfaces; engineers use it to scaffold apps and components; founders use it to ship MVPs without a development team.

Underneath, v0 runs on general-purpose AI (GPAI) models. Under Chapter V of the Act (Articles 51–55), the obligations for those models sit with their model providers, not with you. Vercel's own GPAI duties — and those of any underlying model vendor — are a separate track from your obligations as a company using v0 to build software. The split matters: you inherit none of the model-layer duties, and your exposure depends only on what you do with the generated code.

For the act of design and code generation itself, v0 is minimal-risk. Generating a layout, a dashboard skeleton, or a marketing page does not touch any Annex III use case, triggers no transparency duty, and carries no mandatory requirement beyond Article 4 AI literacy. The same conclusion applies to comparable code-generation tools — classify the output's use, never the generator's brand.

The two-layer rule: tool vs. shipped product

The single most important distinction on this page:

v0 writing your CV-screening interface does not make v0 high-risk. It makes the CV-screening feature you deploy potentially high-risk — under Annex III, point 4 (employment, worker management, access to self-employment) — because of what that feature does to applicants. v0 is the keyboard; the application is the thing that gets classified.

So the operative question is never "is v0 high-risk?" It is: what does the software I built with v0 do, and to whom? Work through that for each shipped product:

• A landing page, an internal dashboard, a marketing microsite → minimal-risk, no obligations.
• A public-facing chatbot or an AI feature users interact with → Article 50 transparency: you must disclose that the person is interacting with an AI system. Article 50 has applied since 2 August 2026.
• A feature that screens, ranks, or scores people in an Annex III area (recruitment, credit, essential services, biometrics) → potentially high-risk, with the full requirement stack.

When you become the provider: Article 25

Here is where v0's "ship-to-production" speed creates real legal weight. The moment you take v0's output, package it as a product, and place it on the market under your own name or trademark, you are the provider of that AI system under Article 3, point 3 — regardless of which GPAI model wrote the code.

This is the Article 25 role-shift. Three triggers convert a user or integrator into a provider carrying the full Article 16 obligation stack:

1. Putting your name on it. You place the AI system on the market or into service under your own brand.
2. Substantial modification (Article 3(23)). You change an existing system's performance or intended purpose in a way that affects compliance with the high-risk requirements.
3. Repurposing. You put a system into service for a high-risk purpose it was not originally placed on the market for.

If the product you ship is high-risk, becoming its provider is consequential. Article 16 pulls in a risk management system (Article 9), technical documentation (Article 11 and Annex IV), data governance (Article 10), human oversight (Article 14), accuracy and robustness (Article 15), conformity assessment (Article 43), an EU Declaration of Conformity (Article 47), and registration in the EU database (Article 49). These obligations apply from 2 December 2027 for stand-alone Annex III systems — originally 2 August 2026, moved by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026.

Critically: v0 generating the code does not transfer any of this. The provider is whoever ships the product under their name. That is you.

Worked example: Greppweg GmbH, a 24-person HR-tech startup

Greppweg GmbH, based in Cologne, ~24 employees, ~€3M turnover, uses v0 heavily. The team prototypes their entire product surface in v0 — onboarding flows, dashboards, a settings panel — and ships an HR SaaS to mid-market employers. Two of their builds tell the whole story.

Build one: the marketing site and customer dashboard. Generated in v0, deployed to Vercel. It displays charts and lets customers manage their account. No decisions about people, no Annex III use. Minimal-risk. No EU AI Act obligations attach. v0's involvement is irrelevant to classification.

Build two: an automated applicant-ranking feature. Greppweg builds, with v0's help, a feature that scores and ranks job candidates for their employer-customers. This lands in Annex III, point 4(a) — recruitment and candidate selection. Greppweg places it on the market under its own brand, so Article 25 makes Greppweg the provider. The feature is high-risk. Greppweg now owes the Article 16 stack: conformity assessment via the Annex VI internal-control route, Annex IV technical documentation, an Article 47 Declaration of Conformity, and registration under Article 49 — by 2 December 2027, the date set by the Digital Omnibus. Their employer-customers using the feature are deployers under Article 26.

The lesson Greppweg learns: v0 made both builds equally fast, but only one of them created a compliance programme — and v0 had nothing to do with which.

A note on penalty scale, because SME founders over-estimate it: failing the high-risk provider obligations carries a maximum of €15,000,000 or 3% of worldwide annual turnover under Article 99(4) — and for an SME or start-up, Article 99(6) caps the fine at the lower of those two figures, not the higher. The percentage protects small companies; it does not punish them.

How Confir helps

Confir registers every AI system your company builds or deploys — including the products you scaffold and ship with v0 — and classifies each one by its actual use under Articles 5 and 6 with Annex III logic, then derives whether you are a provider (Article 16) or deployer (Article 26), including the Article 25 role-shift. The classification engine is deterministic and rule-based: the same intake produces the same finding, the rule that fired is human-readable, and there is no model inference in the loop. For a product you ship under your own name, it generates the Article 11 / Annex IV documentation pack and the Article 47 Declaration of Conformity.

Frequently Asked Questions

Is Vercel v0 high-risk under the EU AI Act?

No. v0 is a code and UI generator, and the act of generating designs or scaffolding is minimal-risk with no mandatory obligations beyond Article 4 AI literacy. What can be high-risk is the application you build and ship with v0's output — that is classified on its own use. If your shipped product screens job applicants or scores creditworthiness, it may fall under Annex III, but v0 itself does not.

Does using v0 make me a provider under the EU AI Act?

Not by itself. You become a provider under Article 25 when you place an AI system on the market or into service under your own name or trademark, substantially modify one, or repurpose one for a high-risk use. If the product you build with v0 is an AI system you ship under your brand, you are its provider — and if it is high-risk, the full Article 16 stack applies, regardless of which model generated the code.

Who handles the GPAI model obligations for v0?

The model provider, under Chapter V of the Act. The general-purpose AI models that power v0 carry obligations under Article 53 — technical documentation, downstream information, a copyright policy, and a training-data summary — that sit with their providers, not with you as a v0 user. Those duties have been in force since 2 August 2025 and are a separate track from your obligations.

If I ship a chatbot built in v0, what do I owe?

If users interact with an AI system, Article 50(1) requires you to disclose that they are dealing with an AI, unless it is obvious from the context. This transparency duty has applied since 2 August 2026. It is a limited-risk obligation, not the high-risk stack — a clear notice that the user is talking to an automated system usually satisfies it. Breaches sit in the Article 99(4) tier of €15M or 3%.

What is the deadline I should plan against for a high-risk product built with v0?

For a stand-alone high-risk system under Annex III, the obligations apply from 2 December 2027 under the Digital Omnibus — Regulation (EU) 2026/1744, in force since 27 July 2026. Plan against 2 December 2027. Annex I product-embedded systems apply from 2 August 2028.

Does v0's one-click deployment change my obligations?

No. Where your application is hosted does not change its classification — the Act looks at what the system does, not the infrastructure it runs on. One-click deployment to Vercel makes shipping faster, which can mean you reach the "placing on the market" moment — and the Article 25 provider line — sooner than you expect. The speed is operational; the classification is about use.

Related guides

• ChatGPT under the EU AI Act: classify by use, not by name
• GitHub Copilot and the EU AI Act
• Google Vertex AI and the EU AI Act
• Provider — definition, obligations, and the Article 25 role-shift
• Article 25 — responsibilities along the AI value chain
• Substantial modification — Article 3(23) and the provider flip
• Article 50 — transparency obligations for limited-risk AI