EU AI Act Gap Analysis: A Step-by-Step Readiness Assessment

Gap analysis, readiness assessment or compliance assessment?

The three terms describe the same exercise from different angles:

• Gap analysis focuses on the difference between current state and required state, obligation by obligation.
• Readiness assessment focuses on maturity: how prepared your governance, people and processes are to meet the deadlines.
• Compliance assessment usually means checking a specific system against specific requirements at a point in time.

None of these is the same as a conformity assessment. That is the formal procedure under Article 43 that providers of high-risk AI systems must complete before placing a system on the market, sometimes with a notified body. A gap analysis tells you whether you will need one, and what has to be ready before it starts.

The seven-step method

Step 1: Set the scope and build your AI inventory

Decide which legal entities, business units and geographies are in scope. The AI Act reaches beyond the EU: a UK or US company whose AI output is used in the EU can be covered, so do not scope by headquarters alone.

Then list every AI system you develop, buy, embed or let staff use. Include the obvious (a customer-service chatbot, Microsoft Copilot, a CV-screening module) and the easy-to-miss: AI features switched on by default in SaaS tools, browser extensions and models your developers call through cloud APIs. Our guide to building an AI inventory and AI system register covers discovery techniques and the fields to capture. Without this list, every later step is guesswork.

Step 2: Classify each system by risk

For each inventory entry, decide which tier it falls into: prohibited, high-risk, transparency risk or minimal risk. If you need a refresher on the tiers, see how EU AI Act risk classification works. The hard calls usually sit at the high-risk boundary. An AI tool that ranks job applicants falls under Annex III point 4; a tool that drafts job adverts usually does not. Our explainer on high-risk AI systems under Annex III walks through the categories and the Article 6(3) exemptions. Record the reasoning, not just the answer: if you conclude an Annex III system is not high-risk, the provider must document that assessment.

Step 3: Map your role for each system

Obligations depend on your role, and your role can differ per system. You are usually a deployer of Copilot and a provider of the support chatbot your team built on top of a large language model. Article 25 adds a trap: a deployer that puts its own name on a high-risk system, makes a substantial modification, or changes the intended purpose so the system becomes high-risk is treated as a provider. See provider vs deployer obligations for the full split, including importers and distributors.

Step 4: Assess the gap per obligation

Now take each system, with its tier and role, and test it against the obligations that follow. For a deployer of a high-risk system, Article 26 is the core list: use the system in line with the provider's instructions, assign human oversight to people with the necessary competence, training and authority, make sure input data you control is relevant, monitor operation and report risks, keep automatically generated logs for at least six months, inform workers and their representatives before workplace use, and tell affected people when the system makes or assists decisions about them. Public bodies, private entities providing public services, and deployers doing credit scoring or life and health insurance pricing also need a fundamental rights impact assessment under Article 27.

For each obligation, write down three things: what exists today, what is missing, and what evidence would prove it is done. "We have human oversight" is a current state. "Named reviewer with authority to override, trained, and logged" is a target state.

Step 5: Prioritise by deadline and risk

Not every gap is equally urgent. Rank them by the date the obligation applies and by the harm a failure could cause. A simple rule works well:

Within each band, push high-impact systems such as credit scoring up the list. For the full date sequence, including GPAI and public-authority transition rules, see the EU AI Act timeline after the Digital Omnibus.

Step 6: Build the remediation roadmap

Turn the prioritised gaps into a plan with owners, budgets and dates. Group the work into streams so it can be resourced: policy and governance (framework, acceptable use policy, roles), people (literacy and oversight training), technology (logging, access control, disclosure banners), and suppliers (contract clauses, vendor questionnaires). For high-risk systems, link each remediation item to a documented risk assessment so you can show why a control was chosen; our AI risk assessment template gives a structure for that.

Step 7: Collect evidence and keep it current

A closed gap without evidence is an open gap. Store the artefacts that prove each control: training attendance records, the signed acceptable use policy, oversight role descriptions, log retention settings, vendor answers, the text of chatbot disclosures. Then schedule a review, at least annually and whenever you add a significant AI system. The EU AI Act compliance checklist is a useful companion for the evidence pass.

EU AI Act gap analysis template

Use one row per obligation per system, and add an evidence link once an item is closed. The sample rows show a mid-sized company that deploys an AI CV-screening tool, runs a customer chatbot it built itself and has rolled out Copilot.

If filling this table from scratch feels heavy, a structured questionnaire gets you most of the way. The AI Act gap assessment from Opsio is exactly that: about 40 minutes of questions across 14 steps, a maturity score on a five-level scale for each of ten governance areas, and, the moment you submit, four editable Word documents written from your answers: an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template. It is free, with no card and no obligation, and the documents are yours to edit.

Gaps that come up again and again

Most organisations fail on foundations, not obscure articles. Look for these first.

• No AI inventory. Nobody can say how many AI systems are in use, which makes classification and every later step impossible. Fix: a register with an owner per system, refreshed quarterly.
• No acceptable use policy. Staff use ChatGPT, Gemini or Copilot with no rules on what data they may paste in or how outputs must be checked. Fix: a short, enforced AUP tied to data classification.
• Shadow AI. Personal accounts and unapproved browser extensions process company and customer data outside any contract. Fix: an approved-tools list, a request route for new tools, and technical controls such as an EU-hosted gateway like Opsio Vault AI that pseudonymises personal data before it reaches the model.
• No vendor checks. AI features arrive inside existing SaaS contracts without anyone asking about training data, logging, model changes or EU data residency. Fix: an AI vendor due diligence questionnaire in procurement.
• No human-oversight assignment. "A human is in the loop" with no name, no authority and no training. Fix: written oversight roles per high-risk or high-impact system.
• No log retention. The vendor deletes logs after 30 days, or logs exist but nobody can retrieve them. Fix: confirm retention of at least six months for high-risk systems and test an export.
• No literacy evidence. Training happened, but there is no record of who attended or what it covered. Fix: role-based modules with attendance and content kept on file.

Who should run it

A gap analysis works best with one accountable owner, often the CISO, the head of compliance or a named AI governance lead, and a small working group: legal or DPO, IT, HR, procurement and one or two business owners of the highest-risk systems. Keep it time-boxed. Four to six weeks is realistic for a first pass in a mid-sized organisation if the inventory is honest. If you want an outside view on the results, Opsio's AI governance consulting team can review the roadmap with you.

Frequently asked questions

What is an EU AI Act gap analysis?

It is a structured comparison between your current AI practices and the obligations of the EU AI Act that apply to you. You inventory your AI systems, classify each by risk, identify your role as provider or deployer, then record what is missing for each obligation. The output is a prioritised list of gaps with owners, deadlines and the evidence needed to close each one.

Is a gap analysis legally required under the EU AI Act?

The Act does not require a document called a gap analysis. It requires you to meet specific obligations, such as AI literacy measures, transparency notices and, for high-risk systems, human oversight and log retention. A gap analysis is the practical way to show you know which obligations apply and how you are meeting them, which is what regulators and enterprise customers will ask about.

How long does an EU AI Act readiness assessment take?

A first structured baseline can take under an hour with a questionnaire; Opsio's free assessment takes about 40 minutes. A full gap analysis with interviews, vendor checks and evidence collection usually takes four to six weeks for a mid-sized organisation. The biggest variable is how long it takes to find all the AI already in use.

What is the difference between a gap analysis and a conformity assessment?

A gap analysis is an internal exercise any organisation can run at any time. A conformity assessment is a formal procedure under Article 43 that providers of high-risk AI systems must complete before placing them on the EU market, in some cases with a notified body. The gap analysis tells you whether you need one and what must be ready first.

Which EU AI Act obligations apply right now?

As of October 2026, prohibited practices (Article 5) and AI literacy (Article 4) have applied since 2 February 2025, general-purpose AI model obligations since 2 August 2025, and Article 50 transparency duties since 2 August 2026. New prohibitions on non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026. Annex III high-risk obligations follow on 2 December 2027.

Find your gaps in 40 minutes

You can build the inventory, classifications and gap table yourself with the method above. Or you can let a structured questionnaire do the first pass. Assess your AI governance against the EU AI Act with Opsio's free assessment: 14 steps, a maturity score across ten governance areas, and four editable Word documents (AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template) written from your answers the moment you submit. No card, no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Dates and obligations are stated as of October 2026.