EU AI Act compliance checklist
The step-by-step checklist a compliance owner follows to take an AI system from 'we have AI' to 'we can evidence compliance' — regardless of whether you build or buy.
1. Classify every system
Write down the intended purpose of each AI system and run the Article 6 test: is it a safety component of a regulated product (Annex I)? Does it serve an Annex III area? Does it pose a significant risk? Record the conclusion and the reasoning.
2. Watch for prohibited practices
Check Article 5 first. Prohibited practices — social scoring, manipulative AI, emotion inference at work or in education, untargeted facial scraping, real-time biometric ID in public spaces — have no compliance path. Removal is the only option.
3. Stand up the risk management system
For each high-risk system, build a risk register: hazards, likelihood and severity, mitigation hierarchy, testing, and residual-risk acceptance. Update it after every release and at least annually.
4. Get the evidence pack together
Prepare technical documentation (Annex IV), data governance and bias records, automatic logging with six-month retention, instructions for use, human oversight plans, and performance/robustness evidence. The documentation checklist tool lists all ten items.
5. Run the deployer checks
Deployers must use systems per the provider's instructions, staff human oversight, inform workers about workplace AI, keep logs running, and run a FRIA where applicable. If you materially modify a system, you become a provider.
6. Do the transparency pass
Even outside high-risk: tell users when they talk to AI (chatbots), label synthetic content (deepfakes, generated media), and keep AI literacy training for everyone who touches AI.
7. Monitor post-market
Watch for incidents and drift, log and investigate serious incidents, update documentation when the system changes materially, and revisit classifications as the Commission's guidance evolves.
Go deeper
Related guides & tools
See where your AI actually lands
Describe your system in the free Risk Scanner for a preliminary classification and the obligations that likely apply.
Open the Risk ScannerPreliminary EU AI Act clarity summary. Not legal advice.