EU AI Act Compliance Checklist: Step-by-Step Assessment

A practical step-by-step EU AI Act compliance checklist with sector-specific guidance. Assess your AI systems against scope, risk classification, prohibited practices, GPAI obligations, and high-risk AI requirements. Updated for 2026 omnibus deadlines.

How to assess your EU AI Act compliance: 10 steps

This checklist is designed for legal, compliance, and technology teams conducting an initial AI Act assessment. Work through the steps in sequence — each builds on the previous.

The checklist applies to all organisations that develop, deploy, import, or distribute AI systems in the EU. It covers all risk tiers, from prohibited practice checks through full high-risk conformity.

Step 1 — Build your AI inventory

Start here: without a complete AI inventory, nothing else is possible. Create a register of every AI system your organisation touches:

• AI systems you develop and sell or license (you are the provider)
• AI systems you purchase or license and use internally (you are the deployer)
• AI systems embedded in products you manufacture or import
• AI systems accessed via API from third parties (cloud AI, foundation model APIs)

For each: document the system name, function, data inputs and outputs, use context, decision impact, and affected population. Flag systems where you are uncertain of classification — these need legal review.

Step 2 — Check prohibited practices first

Priority check: are any systems already illegal? Assess each system against Art. 5 before any risk tier classification. If any system:

• Uses subliminal or subconscious manipulation techniques
• Exploits specific group vulnerabilities (children, elderly, disadvantaged)
• Performs social scoring (public bodies only)
• Conducts real-time biometric identification in public spaces (law enforcement)
• Performs emotion recognition in workplace or education contexts
• Categorises individuals by biometric data to infer sensitive characteristics
• Generates NCII or CSAM

→ Decommission or fundamentally redesign immediately. These prohibitions apply since 2 February 2025.

Step 3 — GPAI model check

If your organisation develops and releases a foundation model or large-scale AI model, GPAI obligations under Chapter 5 apply. Check:

• Is the model trained with self-supervision at significant scale?
• Is it capable of performing a wide range of tasks?
• Is it made available to other developers or users (not purely internal)?

If yes → GPAI provider obligations since 2 August 2025. If training compute exceeds 10²⁵ FLOPs → systemic risk obligations.

Steps 4–10 — High-risk AI compliance programme

For each system not excluded by Step 2 and not covered by Step 3, classify against Annex III and Annex I. Then follow Steps 4–10 as a programme track, targeting the 2 December 2027 deadline for Annex III systems and 2 August 2028 for Annex I embedded systems.

Do not wait until 2027. A realistic compliance programme for one high-risk AI system takes 12–24 months. Begin the gap assessment and QMS design in 2026 to avoid a last-minute crunch — and to avoid the capacity bottleneck at notified bodies as December 2027 approaches.

Cross-regulation mapping

If your organisation is also subject to DORA or NIS2, your AI Act compliance programme can be integrated with existing ICT risk management, incident response, and third-party governance frameworks. See our AI Act vs DORA vs NIS2 convergence guide → for dual-mapping templates.

Sector-specific compliance considerations

Financial services (DORA overlap)

Financial entities subject to DORA already operate ICT risk management and third-party oversight frameworks. For AI Act compliance:

• Credit scoring and loan decision AI falls under Annex III (essential services — Art. 6(2)(e)). Your DORA ICT risk management (Art. 6 DORA) partially satisfies AI Act risk management requirements but must be extended to cover AI-specific data governance and human oversight.
• Fraud detection systems may fall under Annex III if used in law enforcement contexts. DORA incident reporting (Art. 19) and AI Act serious incident reporting (Art. 73) obligations must both be met — design a single integrated reporting workflow.
• Customer chatbots built on GPAI foundation models require: AI disclosure to users (Art. 50), GPAI downstream deployer compliance, and DORA ICT service management.
• Practical priority: Map AI systems against both DORA and AI Act simultaneously. Use the AI Act vs DORA vs NIS2 convergence guide → for a dual-obligation mapping template.

Healthcare and medical devices (MDR/IVDR overlap)

AI embedded in medical devices or in vitro diagnostic devices is classified as Annex I high-risk (deadline: 2 August 2028). Key considerations:

• Your CE marking under MDR/IVDR must be extended to cover AI Act Chapter III requirements. The existing technical file is the foundation — it must be supplemented with AI-specific risk management (Art. 9), data governance (Art. 10), and human oversight measures (Art. 14).
• ISO 13485 QMS systems must be extended to cover the AI lifecycle from data governance through post-market monitoring.
• If your AI is diagnostic-support only (no autonomous decision), the Art. 6(3) significant risk test may allow exclusion from high-risk classification — document your justification carefully.
• Notified bodies for MDR must be separately designated under the AI Act. Confirm your body's AI Act designation before planning your conformity assessment.

HR and recruitment AI

AI systems used for recruitment, CV screening, candidate ranking, performance management, or termination decisions fall under Annex III — employment and worker management (Art. 6(2)(d), deadline: 2 December 2027).

Key compliance priorities:

1. Bias and discrimination risk is the primary regulatory concern. Data governance (Art. 10) must address historical bias in training data. Document bias mitigation measures and testing results.
2. Transparency to candidates — deployers must inform candidates when AI significantly affects hiring decisions. Consider proactive disclosure policies beyond the minimum requirement.
3. Fundamental Rights Impact Assessment (FRIA) — Art. 27 requires this for public sector deployers; strongly recommended for all HR AI regardless of sector.
4. Human oversight: No AI system may make final binding employment decisions without human review. Document the decision workflow and the human reviewer's authority to override.