EU AI Act Compliance Checklist Template

The first task asks whether you provide a general-purpose AI model, which decides whether Phase 6 appears.

• Set the scope and name the AI governance lead — entities, review period, and the executive sponsor who signs off the year
• Build the AI system inventory — systems in use, in development or being bought, including AI features inside existing SaaS tools
• Test each entry against the AI system definition (Art. 3(1)) — using the Commission’s February 2025 guidelines
• Record our role for each system — provider, deployer, importer, distributor or product manufacturer; non-EU organisations are in scope where output is used in the EU (Art. 2)
• Check whether anything makes us a provider (Art. 25(1)) — our name on a high-risk system, a substantial modification, or a new high-risk purpose

The sign-off asks whether you provide or deploy any high-risk system. The answers show or hide Phases 4 and 5.

• Screen every system against the Article 5 prohibitions — eight since 2 February 2025, two more from 2 December 2026; stop use and escalate any match
• Check each system against Annex I (Art. 6(1)) — a safety component of, or itself, a product needing third-party conformity assessment
• Check each system against the eight Annex III areas (Art. 6(2)) — from biometrics and employment to essential services, migration and justice
• Document any Article 6(3) exemption claimed as provider — narrow or preparatory tasks only, never where the system profiles people; register it (Art. 49(2))
• Flag systems with Article 50 transparency duties — chatbots and agents, generative output, emotion recognition and deepfakes
• Sign off the classification register — approval by the AI governance lead, with tier, role and reasoning for each system

Generative systems on the market before 2 August 2026 have until 2 December 2026 to mark their output (Art. 111(4)).

• Map who operates or uses AI on our behalf (Art. 4) — staff, contractors and service providers
• Deliver AI literacy measures matched to each role — reflecting technical knowledge, context and the people affected; keep an internal record
• Tell people when they are interacting with AI (Art. 50(1)) — a provider duty for chatbots and voice agents, unless it is obvious
• Mark synthetic audio, image, video and text output (Art. 50(2)) — providers, in a machine-readable form detectable as AI-generated
• Give the deployer notices under Art. 50(3) and 50(4) — emotion recognition, biometric categorisation, deepfakes, and public-interest text without editorial review
• Record our position on the transparency Code of Practice — final June 2026, voluntary, assessed as adequate by the Commission

Shown only for providers of a high-risk system. Applies from 2 December 2027 (Annex III) or 2 August 2028 (Annex I).

• Run a risk management system across the lifecycle (Art. 9) — foreseeable risks and misuse, residual risk, testing
• Govern training, validation and test data (Art. 10) — representativeness and bias checks; special category data only under Art. 4a
• Draw up the technical documentation and instructions for use (Arts. 11, 13) — Annex IV content, kept 10 years (Art. 18); SMEs and SMCs may use a simplified form
• Build in logging, human oversight and accuracy controls (Arts. 12, 14, 15) — event logs, oversight a deployer can exercise, robustness and cybersecurity
• Operate a quality management system (Art. 17) — proportionate to size; EN 18286:2026 is the European standard written for it
• Complete conformity assessment, declaration, CE marking and registration — internal control for Annex III points 2–8 (Art. 43(2)), then Arts. 47–49
• Monitor after market and report serious incidents (Arts. 72, 73) — within 15 days, 10 for a death, 2 for widespread or critical infrastructure incidents

Shown only for deployers of a high-risk system. The first task decides whether the FRIA task appears.

• Check whether Article 27 requires a FRIA — public bodies, private providers of public services, and credit scoring or life and health insurance pricing
• Use each system as instructed and assign human oversight (Art. 26(1)–(2)) — named people with the competence and authority to intervene
• Monitor operation and keep logs for at least six months (Art. 26(5)–(6)) — suspend use and tell the provider and authority if a system presents a risk
• Inform workers’ representatives and affected people (Art. 26(7), (11)) — before workplace use, and when a system helps decide about someone
• Complete the FRIA before first use and notify the authority (Art. 27) — cross-refer to the DPIA where it covers a point; approval by the AI governance lead

Shown only for GPAI model providers. Applies since 2 August 2025; earlier models have until 2 August 2027.

• Confirm the model is a GPAI model and that we are its provider — the July 2025 guidelines use training compute above 10²³ FLOP as an indicator
• Draw up model documentation for the AI Office and downstream providers — Annexes XI and XII (Art. 53(1)(a)–(b)); limited open-source exemption
• Adopt a copyright policy and publish the training content summary — respecting text and data mining opt-outs; summary on the AI Office template (Art. 53(1)(c)–(d))
• Assess systemic risk and notify within two weeks (Arts. 51, 52) — presumed above 10²⁵ FLOP, bringing the Art. 55 duties
• Record our position on the General-Purpose AI Code of Practice — published 10 July 2025: transparency, copyright, safety and security

Runs every year, and early after a new AI purchase, a model change or a new use for an existing system.

• Log every gap with an owner and a due date — working back from 2 December 2027 or 2 August 2028, not from the next review
• Check guidance and standards issued since the last review — the final Article 6 guidelines, standards cited in the Official Journal, AI Office templates
• Report the programme to the executive sponsor — inventory changes, tiers, gaps and incidents; approval by the executive sponsor
• Archive the evidence and schedule the next review — and route new AI purchases through Phase 2 before signature