EU AI Act Compliance Checklist: 10 Steps for Businesses

Most businesses looking for an EU AI Act compliance checklist are trying to answer a deceptively simple question: what do we actually have to do?

There is no single universal answer. The AI Act (Regulation (EU) 2024/1689) does not impose one uniform set of duties on every organisation. What applies depends on whether the Act covers your activity at all, whether you act as a provider or a deployer of a given system, what that system's intended purpose is, which risk category it falls into, and which provisions are actually in application on the date you read this.

That last point matters more than usual. The Act was amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), published in the Official Journal on 24 July 2026 and in force from 27 July 2026. It moved the application dates for the core high-risk requirements, softened the AI literacy obligation, added two prohibitions and extended proportionality measures to smaller companies.

What follows is a practical ten-step framework for identifying and managing the obligations that apply to your organisation. It is a management tool. Working through ten steps does not by itself make a business compliant, and it is not a substitute for legal advice.

EU AI Act Compliance Checklist: 10 Steps

Work through these in order. Each step narrows the question the next one has to answer.

One caution before you start: assess AI systems individually where it is reasonable to do so. Two tools from the same vendor, used for different purposes by different teams, can attract different obligations. Treating "our AI" as a single object tends to produce either over-compliance or blind spots.

1. Confirm Whether the EU AI Act Applies to Your Business

Start with scope, because it is the only step that can end the exercise early.

Article 2 covers providers placing AI systems on the EU market or putting them into service in the Union, irrespective of whether they are established in the EU or a third country. It covers deployers established or located in the Union. It also covers providers and deployers located outside the EU where the output produced by the system is used in the Union. Importers, distributors, product manufacturers and authorised representatives are addressed separately.

This is why organisations outside the EU frequently need to run the assessment anyway. A non-EU company whose AI tool produces outputs used inside the Union may be in scope without holding any EU entity.

Article 2 also contains carve-outs, including for AI used exclusively for military, defence or national security purposes, for scientific research and development, and for purely personal non-professional use. These are conditional and narrower than they first appear, so assess them rather than assume them.

Document the assessment either way. It is the foundation for everything that follows.

2. Create an Inventory of Every AI System You Use, Build or Provide

You cannot classify what you have not catalogued. Most organisations underestimate their AI footprint, because much of it arrives embedded inside software the business already licenses: CRM scoring features, recruitment screening add-ons, fraud detection modules, support chatbots, meeting assistants.

Capture internally developed systems, standalone third-party tools, and AI functionality embedded in wider platforms. For each, record the intended purpose, the provider or vendor, the internal owner, the deployment context, the users and affected persons, your organisational role, the current risk status, and a review date.

The AI Act does not prescribe this table. It is a practical compliance tool. That said, obligations that may apply later, including technical documentation and record keeping for high-risk systems, are far easier to meet when a reliable inventory already exists.

3. Determine Your Role for Each AI System

Roles drive obligations. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional capacity. Importers and distributors have their own defined roles in the supply chain.

One organisation can hold different roles for different systems, and sometimes for the same system over time. Article 25 sets out when a deployer or other actor becomes a provider of a high-risk system, including where it puts its own name or trademark on the system, makes a substantial modification, or modifies the intended purpose so that the system becomes high-risk. The Digital Omnibus expanded the cooperation duties the initial provider owes in that situation, and added certain Article 25 breaches to the middle penalty tier.

This is the most consequential determination in the checklist, because provider obligations are considerably heavier than deployer obligations. Our EU AI Act compliance guide covers the role definitions in more detail.

4. Screen Each AI System for Prohibited AI Practices

Article 5 prohibits a defined set of practices outright. Most have applied since 2 February 2025 and carry the highest penalty tier in the Act.

Two are commonly relevant to ordinary commercial use: inferring emotions in the workplace or in education institutions, subject to narrow medical and safety exceptions, and social scoring leading to detrimental or disproportionate treatment in unrelated contexts. Others cover manipulative techniques, exploitation of vulnerabilities, untargeted facial image scraping, and certain biometric categorisation and identification practices. The Digital Omnibus added prohibitions on AI systems that generate or manipulate non-consensual intimate material or child sexual abuse material, applying from 2 December 2026.

Screening should look at actual use as well as stated intended purpose. A benign product description does not neutralise a prohibited deployment. Record the outcome for each system and escalate uncertain cases. The Commission's guidelines on prohibited AI practices offer interpretation and worked examples, though they are non-binding.

Prohibited practices are not the same as high-risk systems. A prohibited practice cannot be made lawful through documentation or controls.

Under Article 99, breaching the Article 5 prohibitions attracts fines of up to EUR 35 million or 7% of total worldwide annual turnover, whichever is higher. Most other infringements sit at up to EUR 15 million or 3%. SMEs, and SMCs in the relevant tiers, face the lower of the two figures.

5. Classify Each AI System by Its Applicable Risk Category

The Act takes a risk-based approach. In practice you are sorting systems into four buckets: prohibited practices under Article 5; high-risk systems under Article 6; systems attracting the transparency obligations in Article 50; and systems with no specific obligations beyond AI literacy and general law. General-purpose AI models sit on a separate track under Chapter V, which primarily binds model providers rather than most downstream businesses.

High-risk classification runs along two routes under Article 6. Under Article 6(1), a system is high-risk where it is a product, or a safety component of a product, covered by the EU harmonisation legislation listed in Annex I, and that product must undergo third-party conformity assessment. Under Article 6(2), a system is high-risk where it falls within one of the use cases listed in Annex III, which include biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and the administration of justice.

Article 6(3) provides a narrow filter: an Annex III system may not be high-risk where it does not pose a significant risk of harm, for example because it performs a narrow procedural task. That filter never applies where the system performs profiling of natural persons, and a provider relying on it must document the assessment before placing the system on the market. The Digital Omnibus also narrowed the definition of a safety component, so that systems used solely for user assistance, performance optimisation, efficiency, automation or convenience do not qualify.

Two classification errors are common. Generative AI is not high-risk simply because it is generative. And a system used in an employment context is not automatically high-risk; the question is whether its intended purpose matches an Annex III use case. A company using an AI recruitment system should assess that intended purpose against Annex III rather than relying on how the vendor markets the product.

The Commission has published draft guidelines on high-risk classification, which remain in draft as at September 2026 following stakeholder consultation. They are the clearest available indication of how regulators are likely to read Article 6. For a fuller walkthrough, see our guide to EU AI Act compliance steps.

6. Identify Which EU AI Act Requirements Apply Now

This is where most checklists published before August 2026 go wrong. The Digital Omnibus amended Article 113 and moved the application dates for the core high-risk provisions. The table below reflects the amended text.

Two points deserve emphasis.

First, "applicable now" and "prepare now" are not the same thing. The high-risk requirements are deferred, but conformity assessment, harmonised standards and evidence trails take far longer than the remaining runway suggests. The Commission was explicit that the deferral exists because supporting infrastructure was not ready, not because the obligations were softened.

Second, the deferral in the amended Article 113 is expressed by reference to Chapter III, Sections 1, 2 and 3. Other parts of the Act are not covered by that wording. Where the sequencing matters commercially for a specific system, take advice rather than assuming a blanket pause.

7. Address AI Literacy and Article 50 Transparency Requirements

These two areas are the most likely to affect an ordinary business today.

AI literacy

Article 4 requires providers and deployers to take measures to support the development of AI literacy among their staff and other persons dealing with the operation and use of AI systems on their behalf. Measures must take into account technical knowledge, experience, education and training, the context of use, and the persons on whom the systems are used.

The Digital Omnibus rewrote this provision. The earlier wording required organisations to ensure a sufficient level of AI literacy. The current text asks for measures that support its development, and states expressly that the obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual. The Commission confirms that national market surveillance authorities began supervising and enforcing Article 4 from 2 August 2026, and that it will publish practical examples of compliance.

The Act does not prescribe a single course, a certificate, or an identical programme for every employee. It asks for measures proportionate to context. A finance team using a forecasting tool and an HR team screening candidates need different things. Keep evidence of what you provided, to whom, and why it fits the systems actually in use.

Article 50 transparency

Article 50 has applied since 2 August 2026. It covers a specific set of transparency duties, not every transparency concept in the Act.

Providers must design systems intended to interact directly with natural persons so that people are informed they are interacting with AI, unless that is obvious to a reasonably well-informed person. Providers of generative systems must mark synthetic audio, image, video and text in a machine-readable format so it is detectable as artificially generated or manipulated.

Deployers using emotion recognition or biometric categorisation must inform the people exposed to them. Deployers generating or manipulating deepfakes must disclose that the content is artificially generated, and those publishing AI-generated text to inform the public on matters of public interest must disclose it unless the content underwent human review with editorial responsibility. Disclosure must be clear and distinguishable at the latest at first interaction or exposure. Limited exceptions apply, including for artistic and satirical works and for assistive editing that does not substantially alter input data.

Two timing points. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking obligation. And content generated before 2 August 2026 does not need marking retroactively, although for text published on matters of public interest the relevant date is the date of publication.

The Commission published its final Article 50 guidelines on 20 July 2026, alongside a Code of Practice on Transparency of AI-generated Content that the Commission and the AI Board have assessed as adequate to demonstrate compliance. Adherence to the Code is voluntary. The underlying obligations are not.

Build practical EU AI Act knowledge

Working through roles, risk categories and application dates is easier when a team shares the same vocabulary. AI Governance Courses offers EU AI Act compliance training designed to help professionals understand how the Act's roles, risk classifications and obligations fit together, and to strengthen the foundation for internal governance work.

The course is educational. It does not constitute legal advice, and completing it does not by itself make an organisation compliant with the AI Act.

8. Assess AI Vendors and Third-Party AI Systems

Most businesses are deployers of systems built by others, which makes vendor assessment central rather than peripheral.

Identify which vendors supply AI functionality, including where it sits as a feature inside a broader product. For each, establish the intended purpose as the provider states it, who holds which role, and what the contract says about responsibilities, notification of changes, and support for your own obligations.

Ask for the information your role actually requires: instructions for use and documentation where the system is or may become high-risk, known limitations and intended conditions of use, and how the vendor handles Article 50 marking where the system generates synthetic content. Article 25(4) requires a written agreement between a provider of a high-risk system and third parties supplying components integrated into it, with a carve-out for certain free and open-source contributions.

Treat a vendor's assertion that its product is "EU AI Act compliant" as a starting point for questions, not as evidence. Compliance is system-specific, role-specific and date-specific. A vendor cannot discharge obligations that fall on you as deployer, and a claim made about one configuration may not hold for yours. Document requirements also vary by system and role, so avoid applying an identical evidence pack to every supplier. Our guidance on AI vendor compliance sets out questions worth asking at procurement.

9. Prepare the Controls and Documentation Required for Higher-Risk AI

This step applies only where step 5 identified systems that are, or may become, high-risk. It does not apply to every business running a chatbot.

The relevant obligations are not yet in application. Chapter III, Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Preparing early is a commercial judgement, not a present legal requirement, but the lead times are real.

At a high level, the requirements cover a lifecycle risk management system, data governance where training data is used, technical documentation, automatic logging, transparency and instructions for use, human oversight, and appropriate accuracy, robustness and cybersecurity. Providers also face quality management, conformity assessment, the EU declaration of conformity and CE marking, registration where applicable, post-market monitoring and serious incident reporting. Deployers have narrower duties, including using systems in accordance with instructions, ensuring human oversight, and in some cases a fundamental rights impact assessment.

The Digital Omnibus made several of these more proportionate for smaller organisations. Scope the work to the systems that warrant it: applying the full high-risk framework to a low-risk internal tool consumes budget better spent on classification accuracy.

10. Build an Evidence, Review and Audit-Readiness Process

Compliance management is continuous, because systems, vendors, use cases and law all change.

The evidence base worth maintaining typically includes the scope assessment, the AI inventory, role determinations, risk-classification rationales with the reasoning recorded, the assessment of which obligations apply and from when, AI literacy measures and who received them, Article 50 implementation decisions, vendor documentation and contractual terms, internal policies, monitoring records, incidents and near misses, and a history of reviews and changes.

Frame these as compliance-management evidence rather than as a statutory file. The AI Act does not require every organisation to hold every item on that list. Documentation duties vary according to role, system and the specific obligation. What the list does is let you demonstrate a defensible process, which is where most supervisory conversations begin.

Set a review cadence and a trigger list: new system, new vendor, changed intended purpose, substantial modification, new guidance, or an approaching application date. Our guidance on how to prepare for an EU AI Act audit covers what supervisory authorities are likely to ask for.

EU AI Act Compliance for Small Businesses and SMEs

Small businesses are not exempt. The obligations that apply depend on role, system and risk category, exactly as they do for larger organisations.

What has changed is proportionality. The Digital Omnibus inserted definitions of SME and small mid-cap enterprise (SMC) and extended several accommodations. SMEs, start-ups and SMCs may supply technical documentation for high-risk systems in a simplified manner, using a form the Commission is to establish. Quality management implementation must be proportionate to organisational size. Member States must take SME and SMC interests and economic viability into account when imposing penalties, and for SMCs the relevant fines are capped at the lower of the applicable percentage or fixed amount. SMEs and SMCs also receive priority access to the AI regulatory sandbox the AI Office may establish.

A proportionate programme still runs the same sequence. It is the depth of each step that scales, not the number of steps. Our detailed guidance on EU AI Act compliance for small businesses works through a lighter-weight version of this framework.

Quick Reference: What to Review Before Sign-Off

• ☐ Confirm whether and how the Act applies, and record the scope assessment

• ☐ Inventory every AI system built, used or supplied, including embedded features

• ☐ Determine your role for each system, and re-check after modifications

• ☐ Screen each system against the Article 5 prohibitions, including the new ones from 2 December 2026

• ☐ Classify each system by risk category using intended purpose, not vendor marketing

• ☐ Map which obligations apply now and which apply from a later date

• ☐ Put proportionate AI literacy measures in place and keep evidence

• ☐ Review Article 50 disclosure and marking across interactive and generative systems

• ☐ Assess vendors and contracts rather than accepting compliance claims

• ☐ Prepare controls and documentation for systems that are or may become high-risk

• ☐ Maintain compliance-management evidence for decisions and rationales

• ☐ Establish a periodic review cadence and change triggers

This is a practical management checklist. It is not a substitute for the legislation, official guidance, or legal advice on your specific circumstances.

Making AI Governance an Ongoing Process

EU AI Act compliance is not a project with a completion date. It is a process of knowing what AI your organisation uses, identifying your role for each system, classifying the risks that genuinely apply, understanding which obligations are live now and which arrive later, maintaining evidence of the decisions you made, and reviewing systems as they change.

The Digital Omnibus bought additional time for the high-risk requirements. It did not remove them, and the obligations already in application, including AI literacy, the Article 5 prohibitions and Article 50 transparency, are being supervised now. The organisations in the strongest position in December 2027 will be those that used the interval deliberately.

If you want to strengthen your team's understanding of how roles, risks and obligations fit together, AI Governance Courses offers EU AI Act compliance training built for professionals doing this work in practice.

For official information and interactive compliance tools, see the European Commission's AI Act Service Desk and Single Information Platform.