The EU AI Act Compliance Checklist
The 10-point readiness checklist for providers and deployers of AI systems within the European Union.
Inventory All AI Systems
Document every AI system built, licensed, or used across your entire organization. Include generative AI, traditional ML models, and embedded AI tools.
Determine Your Role (Provider vs. Deployer)
Clarify if you are placing the system on the market under your name (Provider) or using it professionally (Deployer). Your obligations change drastically based on this distinction.
Classify Risk Tiers
Map every system against Article 5 (Prohibited) and Annex III (High-Risk). If high-risk, flag immediately for Annex IV documentation.
Establish an AI Governance Policy
Publish an internal policy outlining acceptable AI use, procurement requirements for new AI tools, and an AI accountability framework.
Implement a Quality Management System (QMS)
For Providers: Establish a robust QMS covering strategy, data management, post-market monitoring, and incident reporting (Article 17).
Draft Annex IV Technical Documentation
For High-Risk Providers: Ensure technical documentation is drawn up before the system is placed on the market or put into service (Article 11).
Perform Fundamental Rights Impact Assessment (FRIA)
For High-Risk Deployers in banking, insurance, or public services: Complete a FRIA prior to deploying the system (Article 27a).
Design for Human Oversight
Ensure high-risk systems are designed with appropriate human-machine interfaces so natural persons can oversee operations and override outputs (Article 14).
Ensure Transparency Obligations
Ensure users interacting with an AI system (like a chatbot) or viewing deepfakes are explicitly informed that they are interacting with AI (Article 50).
Set up Post-Market Monitoring
Establish a system to proactively collect, document, and analyze data on the performance of AI systems throughout their lifecycle (Article 72).