EU AI Act Compliance Checklist
Staggered application through 2027. Covers role and scope, prohibitions, classification, provider and deployer obligations for high-risk systems, GPAI, and organisational baseline including AI literacy.
Counsel-grade external checklist for the EU AI Act (Regulation (EU) 2024/1689). Staggered application: prohibitions and AI literacy (February 2025), GPAI obligations (August 2025), high-risk regime (August 2026), Annex I product-embedded high-risk (August 2027). Verify current guidance — Commission GPAI Code of Practice, harmonised-standards status, AI Office FAQs — before relying on any specific point. This checklist is a working reference, not legal advice.
A. Role and scope gate — everything depends on this
- AI-system inventory completed — every system meeting the Art. 3(1) definition (machine-based, inference-generating, autonomy) across build and buy; shadow-AI (staff tool usage) included.
- Role determined per system: provider, deployer, importer, distributor, product manufacturer — obligations differ radically; note the Art. 25 role-switching triggers (rebranding, substantial modification, repurposing a system into a high-risk use makes a deployer a provider).
- Territorial scope checked (Art. 2): non-EU providers in scope where output is used in the EU.
- Exclusions documented where relied on: pure R&D, pre-market testing, personal non-professional use, open-source carve-outs (limited), military and national security.
B. Prohibited practices screen (Art. 5 — already in force)
- Portfolio screened against all prohibitions: subliminal and manipulative techniques, exploitation of vulnerabilities, social scoring, predictive policing on profiling alone, untargeted facial-image scraping, emotion recognition in the workplace and in education (with narrow exceptions), biometric categorisation on sensitive attributes, real-time remote biometric ID in publicly accessible spaces (law-enforcement exceptions).
- Negative screening documented per system — the evidence an authority asks for first.
- Sanctions ceiling understood: up to €35m or 7% of global turnover for prohibited-practice violations.
C. Classification (Art. 6 and Annexes I and III)
- High-risk check A: safety component / product under Annex I harmonised legislation (machinery, medical devices — note that MDR Class IIa+ software is typically also high-risk AI, dual regime).
- High-risk check B: Annex III use cases — biometrics, critical infrastructure, education, employment / HR, essential services and credit scoring, law enforcement, migration, justice.
- Art. 6(3) derogation assessed where claiming an Annex III system is not high-risk (narrow procedural or preparatory tasks) — documented assessment and registration of the derogation claim required.
- Limited-risk transparency duties mapped (Art. 50): chatbots disclose machine interaction, synthetic content machine-readable marking, deepfake labelling, emotion-recognition / biometric disclosure to exposed persons.
- Classification reviewed on every substantial modification.
D. Provider obligations — high-risk systems (Arts. 8–21)
- Risk-management system (Art. 9): continuous, lifecycle-long, documented — foreseeable misuse included.
- Data governance (Art. 10): training / validation / test data relevance, representativeness, error-freeness "to the best extent possible", bias examination and mitigation.
- Technical documentation (Art. 11 and Annex IV) before placing on the market — the file the whole conformity claim rests on.
- Logging (Art. 12): automatic event recording enabling traceability appropriate to the risk.
- Transparency to deployers (Art. 13): instructions for use — capabilities, limitations, accuracy metrics, human-oversight measures.
- Human-oversight design (Art. 14): systems designed for effective oversight — intervention, override, kill capability.
- Accuracy, robustness, cybersecurity (Art. 15): declared metrics; resilience including adversarial-attack (data and model poisoning) considerations.
- QMS (Art. 17): documented quality-management system covering the above.
- Conformity assessment (Art. 43): internal-control route for most Annex III; notified body where required (certain biometrics; Annex I-linked follows sectoral routes); harmonised-standards reliance noted where available.
- EU declaration of conformity and CE marking; registration in the EU database (Art. 49) before placing on the market.
- Post-market monitoring plan (Art. 72) and serious-incident reporting (Art. 73: 15 days baseline; widespread infringement or death: shorter clocks — verify current values).
- Authorised representative appointed where the provider is non-EU (Art. 22).
E. Deployer obligations — high-risk systems (Arts. 26–27) — the neglected half
- Use per the provider's instructions; assigned, trained, competent human-oversight persons.
- Input-data relevance and representativeness ensured where the deployer controls inputs.
- Logs retained (≥6 months where in deployer control); operation monitored, provider and authority informed of risks and serious incidents.
- Workplace deployment: workers and representatives informed before putting high-risk AI into service.
- FRIA — fundamental-rights impact assessment (Art. 27) where required: public bodies, private entities providing public services, credit-scoring and insurance-pricing use cases.
- GDPR interplay executed, not just mapped: FRIA and DPIA coordinated; automated-decision Art. 22 GDPR rights alongside AI Act oversight.
F. GPAI and organisational baseline
- GPAI provider status assessed (model providers only): technical documentation, downstream-provider information, copyright policy, training-content summary; systemic-risk tier (Art. 55) if above the compute threshold.
- Downstream integration of third-party GPAI documented — contractual information flows from the model provider.
- AI literacy (Art. 4 — in force): staff operating or using AI systems trained to a level appropriate to context; records kept.
- AI-governance owner named; inventory-to-obligation mapping refreshed at each application-date milestone (next: August 2026).
Related
- Cross-regime: GDPR checklist (Art. 22 automated decisions, DPIA alongside FRIA), MDR checklist (Class IIa+ MDSW under dual regime), NIS2 and DORA for cybersecurity and ICT-risk overlaps.
Last reviewed: July 2026. High-risk obligations begin to bite in August 2026; verify current Commission and AI Office guidance and harmonised-standards status before publishing.