EU AI Act compliance checklist

Most AI Act checklists are a flat list of obligations. That's the wrong shape, because roughly half of what's on those lists won't apply to you — and which half depends on two answers you can work out in about twenty minutes.

So this is ordered. Each step either removes work or narrows it. Do them in sequence and you'll spend your effort on the obligations you actually have.

Step 1 — Are you in scope at all?

Two questions.

Is it an AI system? Article 3(1) defines this as a machine-based system that infers, from the input it receives, how to generate outputs such as predictions, content, recommendations or decisions. In practice: if there's a model doing inference in your product, you're in. Deterministic rule-based logic — an if/then engine, a scoring formula someone wrote by hand — generally is not, however "smart" the marketing calls it.

Does the EU have jurisdiction? Article 2 reaches providers placing systems on the EU market regardless of where they're established, and — the part people miss — providers and deployers outside the EU where the output is used in the EU. Being incorporated in Delaware does not remove you if your users are in Berlin.

Step 2 — What is your role?

This is the highest-leverage question in the entire regulation, and it's the one most often answered wrong.

Founders overwhelmingly assume "provider" because they built something. But if the AI system itself is someone else's and you're using it in your operations — a hiring tool you licensed, a support model you call through an API — you are a deployer of that system, and the difference is enormous. Teams budget for conformity assessments they were never going to owe.

It runs the other way too, and this is the expensive direction. Substantial modification can make you a provider of a system you didn't build. If you take a third-party system and materially change its intended purpose, you can inherit provider duties without ever deciding to.

The full provider vs deployer breakdown, including the mixed case where you're both at once, is worth twenty minutes if there's any doubt.

Step 3 — Did you modify a general-purpose model?

Separate question, separate obligation set, and it catches people out.

• API calls or prompting only — you're downstream. Article 53 GPAI duties sit with the model provider, not with you. Say this out loud to anyone who has told you otherwise; it removes a fear that is costing teams real money.
• Light fine-tune, same domain, modest dataset — still downstream, in the ordinary case.
• Substantial retrain, major parameter changes, or a new task domain — you may now be a GPAI provider under Article 53: technical documentation (Annex XI), downstream information (Annex XII), a copyright and text-and-data-mining policy, and a public summary of training data.

Article 53 obligations applied from August 2025 and became enforceable on 2 August 2026. The teams most exposed here are the ones who did a serious fine-tune eighteen months ago for performance reasons, when there was no regulatory reason to think about it. More on the Article 53 threshold.

Step 4 — What is your risk tier?

Work down. Stop at the first that fits.

Unacceptable — Article 5

Banned outright. Real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow exceptions), social scoring by or for public authorities, emotion recognition in the workplace or in education, untargeted facial-image scraping, and exploitative manipulation of vulnerable groups. Prohibited since February 2025; enforceable from 2 August 2026. If you land here, this is not a compliance project — it's a product decision.

High risk — Article 6 and Annex III

Annex III lists the areas: employment and worker management, education, credit and essential services, law enforcement, migration and border control, administration of justice, biometrics, and critical infrastructure. Annex I covers AI as a safety component of products already regulated under EU harmonisation law.

The exemption is not free. A provider relying on it must document that assessment and register the system. "We assumed we were exempt" written up afterwards is not an assessment. How to run the 6(3) check properly.

Limited risk — Article 50

Transparency duties. Systems that interact with people must disclose they're AI. Synthetic content must be labelled. Deepfakes must be disclosed. This is where most chatbots and generative products land — and, critically, Article 50 was not deferred by the Omnibus.

Minimal risk

No mandatory obligations beyond Article 4 AI literacy. Most business software is here.

Step 5 — What is enforceable right now?

Read that table against what you were told in June. "The EU delayed the AI Act" describes rows five and six. Rows one to four are enforceable today, and they're the rows that catch chatbots and generative products — the group most likely to have relaxed.

Deferred is not the same as distant. Conformity assessment, technical documentation and a functioning risk-management system realistically take twelve to eighteen months for a small team. December 2027 means starting work in 2026. Full deadline table.

Step 6 — Do these this week

1. If you have a chatbot: make it disclose. At or before first interaction, visible to the user — not in your privacy policy. Enforceable now, and it takes an afternoon.
2. If you generate content: label it. Article 50(2) and (4). Also an afternoon.
3. Run an AI literacy session and minute it. Article 4 is the cheapest obligation in the regulation. Half a day, attendance recorded, covering what your systems do and how they fail. The record is the compliance.
4. Write down your role and tier, with reasons, and date it. One page. This is what an enterprise procurement questionnaire is actually asking for.
5. If you're high-risk: get a fixed quote for conformity assessment. Not to buy yet — to know the number and the lead time.

A note on the fines, because most coverage gets it backwards

You'll see €35M / 7% and €15M / 3% quoted everywhere. Those are ceilings for large companies. Article 99(6) provides that for SMEs and start-ups the fine is the lower of the fixed amount and the percentage of turnover — the inverse of the rule applied to large firms.

For a small company the headline numbers were never aimed at you. Which doesn't make the risk zero — it relocates it. The realistic cost of an unanswerable AI Act position is the enterprise procurement questionnaire you can't complete and the deal that dies quietly in someone else's legal team. That happens long before a regulator has heard your name, and it happens far more often.