The EU AI Act compliance checklist

Name a single AI accountable owner at leadership level.

Article 22 supervisory-authority interactions need one point of contact.

Publish an internal AI usage policy covering permitted tools, data classes and disclosure.

Baseline for Article 4 competency support and Article 50 transparency.

Add AI risks to the enterprise risk register with quarterly review.

Feeds the risk-management-system evidence high-risk providers must show (Art. 9).

Approve an AI incident-response playbook (who decides to pull an AI tool).

Post-market monitoring under Art. 72 assumes this exists.

Board or ExCo receives an AI compliance report at least twice a year.

Documents leadership oversight - the first thing an auditor asks for.

Central register of every AI system built, bought or embedded - including shadow-IT usage.

Prerequisite for classification and vendor evidence.

For each system record: purpose, vendor, data classes, decision impact, user population.

Fields required for Annex IV documentation.

Classify each system as prohibited, high-risk (Annex III / Annex I), limited-risk (Art. 50) or minimal.

Determines every downstream duty.

Document the classification rationale, and re-review whenever features change.

Regulators reject 'trust us' - they want the reasoning.

Flag any use touching HR, credit, education, biometrics, essential services or law enforcement.

Automatic Annex III triggers.

Baseline AI training rolled out to every employee using AI in their role.

Article 4 as amended by the Omnibus.

Advanced training for teams operating high-risk or customer-facing AI.

Proportionality principle in Art. 4.

Record who was trained, when, and on what content.

Only evidence a regulator accepts.

Refresh training after any material tool or policy change, not just annually.

Competency has to keep pace with the tools in use.

Chatbots and voice agents disclose that the user is interacting with AI.

Art. 50(1).

AI-generated images, audio, video and text are labelled as such at delivery.

Art. 50(4) and deepfake regime.

Emotion recognition and biometric categorisation notify affected persons.

Art. 50(3).

New AI-generating systems produce machine-readable watermarks.

Art. 50(2); 4-month grace for pre-existing systems ends 2 Dec 2026.

Web assistants and support flows carry an accessible 'this is AI' notice.

Combines Art. 50(1) with usability expectations.

Risk-management system covering the full lifecycle documented (Art. 9).

Central artefact of the high-risk regime.

Data governance controls: representative, relevant, error-free training and validation data (Art. 10).

Bias and quality failures start here.

Annex IV technical documentation opened and maintained (Art. 11).

Without it there is no conformity assessment.

Automatic event logs enabled and retained (Art. 12).

Regulators want traceability, not screenshots.

Human oversight designed into the workflow, not bolted on (Art. 14).

'Human in the loop' has to be evidenced end-to-end.

Accuracy, robustness and cybersecurity tests with pass/fail thresholds (Art. 15).

Required in the technical file.

Quality-management system covering design, testing, monitoring (Art. 17).

Notified bodies check this first.

Conformity assessment route selected and CE marking planned (Art. 43).

Determines which Annex applies to your build.

Post-market monitoring plan with defined signals and escalation (Art. 72).

'Ship and forget' is no longer legal.

Serious-incident reporting procedure with 15-day deadline mapped out (Art. 73).

Missed reports carry their own fine.

AI Act clauses added to procurement and vendor contract templates.

Deployer duties under Art. 26 depend on provider evidence.

Provider evidence collected for every high-risk supplier: documentation, oversight design, incident history.

Deployers inherit gaps.

Data protection impact assessment (DPIA) refreshed to include AI-specific risks.

GDPR Art. 35 dovetails with AI Act obligations.

Records of processing updated for AI-based decisions.

Regulators cross-check GDPR and AI Act registers.