Most EU AI Act compliance checklists are written for companies that build AI. Most European organisations do not build it; they buy and use it. In the Act's terms they are deployers. This checklist is for them, in date order, with the article behind each check. For the full sequence for organisations that build high-risk systems, see the EU AI Act compliance roadmap.
First: are you a provider or a deployer?
1. Settle your role for every system. You are a deployer if you use an AI system under your authority in a professional activity (Article 3(4)). You become a provider if you put your name or trademark on a high-risk system, make a substantial modification to it, or change its intended purpose so that it becomes high-risk (Article 25). Write the answer down per system; every other check depends on it.
2. Keep an inventory. Every AI system in use, procurement or pilot, with owner, purpose, affected persons, supplier and risk class. The Act does not name this document, but you cannot do any of the following checks without it.
Checks that already apply
3. AI literacy (Article 4, since 2 February 2025). Take measures to support the AI literacy of staff and others using AI on your behalf. Keep a record of what you did.
4. No prohibited practices (Article 5, since 2 February 2025). Confirm none of your systems performs a prohibited practice — for example social scoring, untargeted scraping of facial images, or emotion recognition in the workplace and in education outside medical or safety reasons. Two further prohibitions on AI generating non-consensual intimate imagery and child sexual abuse material apply from 2 December 2026.
5. Transparency (Article 50, since 2 August 2026). If you deploy an emotion recognition or biometric categorisation system, inform the people exposed to it. If you publish deepfakes, disclose that the content is artificially generated. If you publish AI-generated text to inform the public on matters of public interest, disclose it unless it has gone through human editorial review and someone holds editorial responsibility.
6. Supplier documentation. Ask each supplier for its role, the system's risk class and its instructions for use. If a general-purpose model sits underneath, ask for notice of model changes. This is a contract check, not an article, but it is where deployers most often lack evidence.
Checks for high-risk systems (from 2 December 2027)
After the Digital Omnibus on AI, deployer duties for Annex III high-risk systems — for example in employment, education, access to essential services, critical infrastructure and law enforcement — apply from 2 December 2027. For AI in products under Annex I, from 2 August 2028. Under Article 26, a deployer must:
7. Use the system according to its instructions for use.
8. Assign human oversight to people with the competence, training, authority and support to do it.
9. Ensure input data is relevant and sufficiently representative, to the extent the deployer controls it.
10. Monitor operation, and inform the provider and authority without undue delay if the system presents a risk or a serious incident occurs. Serious incidents are reported under Article 73.
11. Keep the automatically generated logs under your control for at least six months, unless other law says otherwise.
12. Inform workers and their representatives before putting a high-risk system into use at the workplace, and inform people subject to decisions made or assisted by a high-risk system.
Extra checks for public bodies
13. Fundamental rights impact assessment (Article 27). Bodies governed by public law, private entities providing public services, and deployers of certain credit-scoring and life and health insurance pricing systems must assess the impact on fundamental rights before first use. Do it together with the GDPR data protection impact assessment, not separately.
14. Registration (Article 49). Public authorities and EU bodies deploying high-risk systems must register their use in the EU database before putting the system into service. National deadlines may come earlier; in Greece, existing systems must be registered by 31 December 2026, as set out in the EU AI Act explained.
What non-compliance costs
Article 99 sets the ceilings: up to €35 million or 7% of worldwide annual turnover for prohibited practices; up to €15 million or 3% for most other obligations, including deployer duties; up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs, the lower of the two amounts applies.
Frequently asked
What does an EU AI Act compliance checklist cover? For a deployer: an inventory and role per system, AI literacy measures, confirmation that no prohibited practice is used, Article 50 transparency, and, for high-risk systems, the Article 26 deployer duties, the fundamental rights impact assessment where required, registration and serious-incident reporting.
When do EU AI Act high-risk obligations apply? Since the Digital Omnibus on AI, from 2 December 2027 for Annex III high-risk systems and from 2 August 2028 for AI in products covered by Annex I.
Do deployers need to do a fundamental rights impact assessment? Under Article 27, bodies governed by public law, private entities providing public services, and deployers of certain credit-scoring and life and health insurance pricing systems must do one before first using a high-risk system.
Sources
- Regulation (EU) 2024/1689 (AI Act), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
To see where your institution stands, the six dimensions of the UberConsul Resilience Audit give a one-page position you can take to a board or a supervisor. Book a time to discuss it.
This essay is general information, not legal advice. Check the national law that applies to you.
First published October 2026 · Frankfurt am Main.