EU AI Act Compliance Checklist & Guide for Businesses

To comply with the EU AI Act, first establish your role (provider or deployer), then classify each AI system's risk tier, and apply the obligations that match. High-risk systems require conformity assessment, CE marking, documentation, and human oversight. The checklist below turns those duties into concrete, sequenced steps.

This checklist reflects the rules as of October 2026, after the Digital Omnibus on AI (Regulation (EU) 2026/1744) entered into force on 27 July 2026 and moved the high-risk deadlines. If you would rather answer structured questions than work through a table, Opsio's free EU AI Act readiness assessment covers the same ground and writes four editable governance documents from your answers.

Are you a provider or a deployer?

Your obligations depend heavily on your role, and many organisations are both for different systems.

• Provider: You develop an AI system (or have one developed) and place it on the EU market or put it into service under your own name or trademark. Providers of high-risk systems carry the heaviest obligations.
• Deployer: You use an AI system under your own authority in a professional context. Deployers have lighter but real duties, such as ensuring human oversight, using the system per instructions, and monitoring operation.

Can you become a provider without building anything?

Yes. You can be re-classified as a provider if you put your name or trademark on an existing high-risk system, make a substantial modification to it, or change its intended purpose so it becomes high-risk. Fine-tuning or significantly adapting a third-party model can pull you into provider obligations, so document where you sit for every system in your estate.

How to classify your system's risk

Risk classification is the pivot of the whole Act. Work through the tiers in order.

1. Is it prohibited? Check Article 5 practices, such as social scoring, manipulative subliminal techniques, and certain biometric uses. These bans have applied since 2 February 2025, and the Digital Omnibus adds bans on AI that generates non-consensual intimate imagery or child sexual abuse material from 2 December 2026. If a system falls under Article 5, you cannot deploy it in the EU.
2. Is it high-risk? Check Annex III use cases (recruitment, credit scoring, education, critical infrastructure, certain law-enforcement and biometric uses) and Annex I, where AI is a safety component of a regulated product such as a medical device.
3. Does it have transparency duties? Chatbots, emotion recognition, and AI-generated or manipulated content (deepfakes) require disclosure even if not high-risk. These Article 50 duties apply from 2 August 2026.
4. Otherwise minimal: No mandatory obligations, though voluntary codes of conduct are encouraged.

Document the classification decision and its reasoning for each system. Regulators and customers will expect to see a defensible rationale, not an assumption. A consistent AI risk assessment template makes those decisions comparable across teams.

The step-by-step compliance checklist

Use this checklist to structure your programme. Not every row applies to every system; scope it to your role and risk tier.

Step 7 matters more than most teams expect, because much of your AI arrives inside SaaS products. An AI vendor due diligence checklist helps you get the instructions for use, logging and transparency information you need as a deployer.

Conformity assessment and CE marking for high-risk systems

High-risk AI systems must pass a conformity assessment before going to market, the procedure that demonstrates the system meets the Act's requirements. For many Annex III systems this is an internal assessment based on the provider's own controls and documentation; for some categories, and for AI embedded in regulated products, a third-party notified body is involved.

Once conformity is established, the provider draws up an EU declaration of conformity and affixes the CE marking, signalling that the system may circulate freely in the EU single market. Conformity must be maintained over time: a substantial modification can require a fresh assessment. Aligning with harmonised standards (being prepared by bodies such as CEN-CENELEC) gives a presumption of conformity and is the most practical route for most providers. Under the Digital Omnibus, SMEs and small mid-caps (fewer than 750 staff) can use simplified technical documentation and a proportionate quality management system.

What documentation and governance do you need?

Plan for a documentation backbone that includes: the technical documentation file, records of the risk-management and data-governance processes, instructions for use, the declaration of conformity, automatically generated logs, and your post-market monitoring plan. On governance, assign clear accountability (often an AI governance lead or committee), integrate AI risk into existing enterprise risk and ISO 27001 controls, and keep an audit trail. Deployers should retain automatically generated logs for at least six months, ensure competent human oversight, inform workers before using high-risk AI in the workplace, and inform affected people where required.

Your timeline to compliance

The Act applies in phases. The Digital Omnibus (Regulation (EU) 2026/1744) is adopted law and has moved the high-risk dates, but it did not move everything. As of October 2026, the applicable dates are:

The extra time for high-risk systems is not a reason to pause. Transparency duties already apply, and the documentation, risk management, and governance you build now are needed regardless of which date covers your systems. Our EU AI Act timeline after the Digital Omnibus explains each deadline and the transitional rules for systems already on the market.

How to start

You do not need to solve everything at once. A pragmatic first 90 days:

• Discover: Inventory every AI system in use or in development, including embedded vendor AI and internal tools.
• Triage: Classify role and risk tier, and flag anything potentially prohibited or high-risk for urgent review.
• Gap-assess: Compare current controls against the obligations for each tier and identify the biggest gaps. Our step-by-step EU AI Act gap analysis guide shows how to structure this.
• Remediate and govern: Stand up documentation, human oversight, and an accountable governance owner, reusing GDPR and ISO 27001 structures where you can.

Opsio, a Swedish cloud and AI company whose India operations are ISO/IEC 27001 and 27701 certified, helps enterprises run exactly this process, from AI inventory and risk classification through governance and conformity readiness. Explore our AI governance consulting services, and for the underlying law see our explainer on what the EU AI Act is and how it works.

Frequently asked questions

When does the EU AI Act apply to my business?

It applies in phases. Prohibitions and AI-literacy duties applied from 2 February 2025, GPAI and governance rules from 2 August 2025, and Article 50 transparency duties from 2 August 2026. After the Digital Omnibus, high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for AI in Annex I products.

Does the EU AI Act apply to my company if we are based outside the EU?

Generally yes if your AI reaches the EU. The Act covers providers placing AI on the EU market wherever they are located, and providers and deployers outside the EU whose system output is used in the EU. Serving EU customers typically brings you into scope.

How is the EU AI Act different from GDPR?

GDPR governs the processing of personal data; the EU AI Act governs AI systems by risk tier and by your role as provider or deployer. They are complementary, and a single AI system that handles personal data must comply with both. Reusing your GDPR governance is an efficient starting point.

What are the penalties for non-compliance?

Fines reach up to €35 million or 7% of total worldwide annual turnover (whichever is higher) for prohibited practices, up to €15 million or 3% for most other breaches, and up to €7.5 million or 1% for supplying incorrect information. For SMEs and start-ups, the lower of the two amounts applies.

Turn this checklist into documents

A checklist tells you what to do; your auditors and customers will ask to see the policies behind it. Assess your AI governance against the EU AI Act in about 40 minutes of questions, and receive four editable Word documents written from your answers (an AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template) plus a maturity score across ten governance areas. It is free, with no card and no obligation.

This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Related reading: What Is the EU AI Act.