Windsurf Under the EU AI Act: Minimal Risk, Classify What You Ship

Minimal risk as a coding tool. Windsurf — the agentic IDE from Codeium (now part of Cognition), built around the Cascade agent and Supercomplete code suggestions — helps developers write, refactor and ship code across a whole codebase. Using it to write software is no more an Annex III activity than using any other editor. For the company whose developers run it, Windsurf sits at minimal risk. The classification that actually matters is the software you build with it, which is judged on its own use, not the IDE's.

This guide is for the company whose engineers use Windsurf, not for the model maker. The general-purpose AI models that power Cascade are supplied upstream, and their providers carry the Chapter V obligations (Articles 51–55, in force since 2 August 2025). Your coding use is minimal; the real obligations, if any, live in the product you put in front of users.

---

Classify the use, not the IDE

"Is Windsurf high-risk?" is the wrong question. The right one is "is what I'm doing with it high-risk?" Writing and refactoring code is not a purpose listed in Annex III (read with Article 6(2)), which covers employment, essential services, creditworthiness, education, critical infrastructure, biometrics and the rest. An agent that plans a multi-file change, runs a terminal command and edits your codebase is a developer assistant, not a regulated decision system. Windsurf is minimal risk for the same reason GitHub Copilot and Cursor are: the tool accelerates building, and building is not the regulated act.

The heavy model obligations sit upstream with whoever trained the foundation models behind Cascade. Under Articles 51–55 those providers hold the technical documentation, the training-data summary and the copyright-policy duties. You benefit from that compliance without inheriting it — role determines obligation, and as a user of Windsurf you are not the provider of those models.

---

The distinction that matters: the IDE versus the app you ship

Windsurf is the build environment. The software it helps you produce is a separate system, classified by what it does. A marketing site is minimal; an app with a customer-facing chatbot is limited risk under Article 50; a tool that screens job applicants or scores creditworthiness is high-risk under Annex III. The IDE never changes tier no matter what you build — but if you place an AI feature you built on the market under your own name, you become its provider under Articles 25 and 16, and the shipped system's tier then drives your obligations.

For most engineering teams using Windsurf to maintain an existing codebase, that flip is a non-event: you are already the provider or deployer of your own product, and Windsurf is simply a faster way to work on it. The point to hold onto is that no AI Act obligation arrives because you used an AI coding tool — obligations arrive from what your product does and the role you hold over it.

---

What actually triggers a duty — and what does not

Minimal risk: using Windsurf to write code

Cascade planning changes, Supercomplete suggesting code, the agent running commands and editing files across your project — all minimal risk for you as a user. No conformity assessment, no Article 11 technical documentation, no Article 49 registration attaches to the act of building. The genuine concerns here are engineering ones — review, testing, security and licence hygiene of AI-generated and AI-modified code — which are good practice, not AI Act duties.

Article 4: literacy and code governance

Article 4 AI literacy has applied since 2 February 2025 and binds you whatever the tier. Since the Digital Omnibus took effect on 27 July 2026, it requires providers and deployers to take measures to support their staff's AI literacy, rather than guarantee a set level. For an agentic IDE this matters more than for a passive autocomplete: developers need to understand that Cascade can introduce subtle bugs, leak context, or pull in dependencies, and that AI-written code must be reviewed and tested before it merges. A short engineering policy — review every AI change, watch for secrets in context, gate the agent's autonomy in sensitive repositories — is exactly that kind of measure and is simply sound practice.

The app you ship: where any real obligation lives

If the software you build embeds a user-facing AI feature, Article 50 transparency applies to that product (50(1) for chatbots, 50(2) for generated content). If it serves an Annex III purpose, you carry the full provider obligations under Article 16 — risk management (Article 9), data governance (Article 10), technical documentation (Article 11), human oversight (Article 14), conformity assessment (Article 43), registration (Article 49). None of that is triggered by Windsurf; it is triggered by what you ship.

---

The realistic duties for a team using Windsurf

Keep two records. First, an inventory entry for Windsurf as a minimal-risk developer tool, noting that engineers use it across the codebase. Second — and more important — classify each product your team ships that contains an AI feature, on its own use, because that is where provider or deployer obligations surface. Pair this with a short AI-code policy (mandatory human review of AI changes, secret-handling rules, dependency checks) to satisfy Article 4 and keep the codebase clean. GDPR applies independently: confirm a lawful basis before personal data reaches Cascade's context window or any shipped feature.

---

Windsurf obligation map by use case

The table separates the IDE from the product — the distinction that drives the analysis.

The IDE stays minimal in every row; the shipped product is where the obligations are.

---

Worked example: a 70-person SaaS team adopts Windsurf

Lumaria s.r.o., a 70-person SaaS company in Brno with around €11M turnover, rolls Windsurf out to its engineering team to speed up feature work on its existing product. Cascade handles multi-file refactors; Supercomplete fills in routine code. As a build activity this is minimal risk; the duties are Article 4 literacy plus an AI-code-review policy.

Classification happens at the product, not the IDE. Lumaria's product is a B2B analytics dashboard with no user-facing AI feature — minimal risk; Lumaria is its provider under Article 16 with no meaningful AI Act burden. The action list is two inventory entries (Windsurf and the product), a one-page AI-code policy, and a literacy note.

The counterfactual sharpens the boundary. Lumaria uses Windsurf to build a new module that ranks and filters job candidates for its HR customers. That module is an Annex III point 4(a) high-risk recruitment system, and because Lumaria ships it under its own name it is the provider under Articles 25 and 16 — carrying risk management (Article 9), data governance (Article 10), technical documentation (Article 11), human oversight (Article 14), conformity assessment (Article 43) and registration (Article 49). Windsurf made the module quick to build; the obligations come from the module's use, not from the IDE.

---

Deadlines and penalties — proportionate, not alarmist

The settled dates: Article 4 AI literacy and the Article 5 prohibitions apply since 2 February 2025; GPAI obligations (Articles 51–55) since 2 August 2025; all of Article 50 transparency since 2 August 2026 (generative systems already on the market before that date have until 2 December 2026 for the Article 50(2) marking).

High-risk timing — relevant only if you ship an Annex III product — is now settled law. Stand-alone Annex III high-risk obligations apply from 2 December 2027 (originally 2 August 2026) under the Digital Omnibus, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The deferral is a fixed calendar date, not the standards-linked "stop the clock" of the Commission's November 2025 proposal.

On penalties: provider, deployer and Article 50 breaches carry fines up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)). Prohibited-practice breaches under Article 5 reach €35 million or 7% (Article 99(3)). Supplying incorrect or misleading information to authorities carries up to €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, each fine is capped at the lower of the percentage or the fixed amount (Article 99(6)). For minimal-risk use of Windsurf itself there is no fine exposure.

---

How Confir helps

Register Windsurf in Confir's AI register as a minimal-risk developer tool, and register each product your team ships that contains an AI feature. The deterministic, rule-based engine — no model inference, no hallucination — classifies each shipped product by its use, tells you whether shipping it makes you the provider under Article 25, and derives the matching Article 16 obligation checklist, stating in plain language the exact rule that fired. The separation between the coding tool and the product is exactly what keeps a fast engineering team from quietly shipping an unassessed high-risk feature.

Related guides

• build your AI system inventory
• provider vs deployer — which are you?
• Article 25 responsibilities along the value chain
• what minimal risk means under the Act
• GitHub Copilot under the EU AI Act
• Cursor AI under the EU AI Act