Regulation (EU) 2024/1689 (AI Act)
EU AI Act readiness checklist
Checks under Regulation (EU) 2024/1689, grouped by role: every organisation, providers and deployers of high-risk AI systems, transparency duties and general-purpose AI models.
1. All organisations
Keep an inventory of every AI system you develop, buy, integrate or use.
Art. 3(1)Test each tool against the Art. 3(1) definition of an AI system. Record owner, purpose, vendor and the people it affects.
Determine your role for each system: provider, deployer, importer or distributor.
Art. 3, Art. 25Under Art. 25 a deployer or other party becomes a provider if it puts its name on a high-risk system, substantially modifies it or changes its intended purpose so it becomes high-risk.
Confirm that no system uses a prohibited practice and stop any that does.
Art. 5Covers manipulation, exploitation of vulnerabilities, social scoring, untargeted facial image scraping, emotion recognition at work or school and more, in force since 2 February 2025. Regulation (EU) 2026/1744 adds a ban on AI systems that generate non-consensual intimate images or child sexual abuse material, applying from 2 December 2026.
Take measures to support the AI literacy of staff and others who operate or use AI systems on your behalf.
Art. 4Applies to providers and deployers since 2 February 2025. As amended by Regulation (EU) 2026/1744, it no longer requires you to guarantee a specific level for any individual. Tailor training to role, context and the persons affected, and keep a record of it.
Classify each system as prohibited, high-risk, transparency-only or minimal risk and record why.
Art. 6, Annex I, Annex IIIA system is high-risk if it is, or is a safety component of, a product under Annex I legislation that needs third-party assessment, or falls in an Annex III area such as employment, credit or education. An Annex III system that poses no significant risk can be exempt under Art. 6(3), unless it profiles people. Document that assessment.
Map your obligations to the Art. 113 dates as amended in July 2026.
Art. 113, Regulation (EU) 2026/1744Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal on 24 July 2026 and in force since 27 July 2026, moved the high-risk dates: Annex III systems from 2 December 2027, Annex I products from 2 August 2028. Most other obligations, including Art. 50 transparency, apply from 2 August 2026.
Brief management on penalty exposure, which reaches EUR 35 million or 7% of turnover for prohibited practices.
Art. 99Whichever is higher applies to undertakings. Breaches of most other obligations carry up to EUR 15 million or 3%, and supplying incorrect information to authorities up to EUR 7.5 million or 1%. For SMEs and small mid-caps the lower of the two applies.
2. Providers of high-risk AI systems
Run a documented risk management system across the whole lifecycle of the system.
Art. 9Identify foreseeable risks to health, safety and fundamental rights, including reasonably foreseeable misuse, adopt mitigation measures and test against defined metrics.
Apply data governance to training, validation and testing data, including bias examination.
Art. 10Data sets must be relevant, sufficiently representative and as error-free and complete as possible for the intended purpose. Record collection, preparation and known gaps.
Prepare technical documentation covering every Annex IV element before placing the system on the market.
Art. 11, Annex IVIncludes system description, design choices, data, testing, performance metrics and the risk management system. Keep it up to date for the life of the system.
Build automatic event logging into the system so its operation can be traced.
Art. 12Logs should help identify risk situations, support post-market monitoring and let deployers monitor operation.
Supply clear instructions for use that let deployers interpret output and use the system correctly.
Art. 13State the intended purpose, accuracy levels, known limitations, human oversight measures, required input data and how to collect logs.
Design the system so natural persons can effectively oversee it, override it and stop it.
Art. 14Overseers must be able to understand capabilities and limits, recognise automation bias and disregard or reverse output.
Achieve and declare appropriate accuracy, robustness and cybersecurity levels.
Art. 15Protect against errors, feedback loops and attacks such as data poisoning, adversarial examples and model manipulation.
Put a written quality management system in place covering design, testing, data and incident handling.
Art. 17It must be proportionate to the size of the organisation and can be integrated with existing quality systems under sector law.
Complete the applicable conformity assessment procedure before placing the system on the market.
Art. 43Most Annex III systems use internal control under Annex VI. Biometric systems and Annex I products may need a notified body. Repeat it after a substantial modification.
Issue the EU declaration of conformity, affix CE marking and register in the EU database.
Art. 47, Art. 48, Art. 49Keep the declaration for 10 years after the system is placed on the market. For digital-only systems, a digital CE marking is used. Critical infrastructure systems are registered at national level. Some law enforcement and migration entries go to a non-public section.
Run post-market monitoring and a procedure to report serious incidents to the authority on time.
Art. 72, Art. 73The plan is part of the technical documentation. Use the data to check continued compliance and feed it back into risk management. Report no later than 15 days after becoming aware, with shorter limits for widespread infringements or critical infrastructure (2 days) and deaths (10 days).
3. Deployers of high-risk AI systems
Use each system per the instructions for use and assign oversight to competent, trained people.
Art. 26(1), Art. 26(2)Put technical and organisational measures in place. Using it outside its intended purpose can make you the provider under Art. 25. Name the overseers per system and make sure they can actually intervene in day-to-day operation.
Ensure input data you control is relevant and sufficiently representative for the intended purpose.
Art. 26(4)This applies to the extent you exercise control over the input data, for example data from your own HR or customer systems.
Monitor operation, act on risks and keep logs under your control for at least six months.
Art. 26(5), Art. 26(6)Serious incidents must be reported to the provider immediately, and then to the authorities. Longer periods may follow from Union or national law, including data protection law. Check the retention settings in vendor contracts.
Inform workers' representatives before workplace use and tell affected persons about Annex III decisions.
Art. 26(7), Art. 26(11)Follow the information procedures of Union and national labour law, which may also require consultation or co-determination. Add the notice to the relevant forms, letters or portals at the point where the decision process starts.
Carry out a fundamental rights impact assessment before first use, where required.
Art. 27Covers Annex III systems except critical infrastructure (point 2). Required for bodies governed by public law, private entities providing public services, and deployers of credit scoring or life and health insurance pricing systems. Notify the result to the market surveillance authority. You can cross-reference an existing GDPR DPIA.
Be ready to explain the role of the AI system in a decision when an affected person asks.
Art. 86Applies to decisions based on Annex III output that produce legal or similarly significant effects. Set up a request channel and a response template.
4. Transparency obligations
Make sure people know they are interacting with an AI system, unless it is obvious.
Art. 50(1)This is a provider duty for chatbots and voice assistants. Show the notice at the latest at the first interaction.
Mark synthetic audio, image, video and text output in a machine-readable, detectable format.
Art. 50(2), Art. 111(4)Recital 133 names watermarks, metadata, cryptographic provenance methods, logging and fingerprints. The Act does not name C2PA, an industry provenance standard you may use. Exceptions cover standard editing assistance and output that does not substantially alter the input. Systems on the market before 2 August 2026 have until 2 December 2026.
Disclose deepfakes and AI-generated text published to inform the public on matters of public interest.
Art. 50(4)A deployer duty. Lighter disclosure applies to evidently artistic or satirical work, and the text rule does not apply where there is human editorial review and responsibility.
Inform people exposed to an emotion recognition or biometric categorisation system that it is operating.
Art. 50(3)Process personal data in line with the GDPR. Emotion recognition at work and in education is prohibited under Art. 5 except for medical or safety reasons.
5. Providers of general-purpose AI models
Maintain model technical documentation and give downstream providers the information they need.
Art. 53(1)(a), Art. 53(1)(b)Applies since 2 August 2025 under Art. 113. Annexes XI and XII list the contents. Open-source models are partly exempt unless they have systemic risk.
Adopt a copyright policy and publish a sufficiently detailed summary of training content.
Art. 53(1)(c), Art. 53(1)(d)The policy must identify and respect text and data mining opt-outs. Use the Commission's template for the training content summary.
For models with systemic risk, run evaluations, mitigate risks, report serious incidents and secure the model.
Art. 51, Art. 52, Art. 55Systemic risk is presumed above 10^25 FLOPs of training compute. Notify the Commission within two weeks of meeting the threshold.
These checklists summarise the official texts to help you plan. They are not legal advice, and national laws or guidance may add requirements. Check the official text before relying on an item.
All checklistsRelated service: Policies and Procedures Assessment
Want a second pair of eyes on your gaps?
We run gap assessments against these frameworks and help close what they find.