Originally published at https://charz.ai/blog/ai-act-30-step-compliance-checklist by Char-Z AI.
Why a Step-by-Step EU AI Act Checklist
The EU AI Act is requirements-heavy and deadline-staggered: prohibitions and transparency arrive first, high-risk obligations follow in December 2027, Annex I products in August 2028, and public-sector systems in August 2030 (European Commission, 2026). Because obligations land in waves, a single checklist that you re-run — rather than a one-time project — is the most reliable way to stay compliant as deadlines pass.
A structured checklist also solves the most common failure mode: organizations struggle most with knowing which systems they have and which obligations apply to each. The steps below start there and build outward.
The 30-Step EU AI Act Checklist
Phase 1 — Foundation (Steps 1-7)
Step 1: Inventory every AI system.
Catalog all AI systems you develop, deploy, or consume. Capture purpose, data inputs, vendor, and lifecycle stage. This is the prerequisite for every later step (European Commission, 2024).
Step 2: Classify risk per system.
For each system, determine its EU AI Act risk category: prohibited, high-risk (Annex III/I), GPAI, limited (transparency), or minimal. See our high-risk classification guide for the full test (European Commission, 2024).
Step 3: Record intended purpose.
Document each system's intended purpose in writing. The Act's obligations attach to intended purpose, not general capability.
Step 4: Map the responsible party.
Determine whether you are provider, deployer, importer, or distributor for each system. Obligations differ by role.
Step 5: Identify the applicable authority.
Confirm your national competent authority (see our national authorities guide) and, for GPAI, whether the AI Office is involved.
Step 6: Establish governance ownership.
Name a person accountable for AI governance. Assign roles spanning legal, risk, and technical teams.
Step 7: Set a review cadence.
Schedule quarterly reviews of the inventory and classification. Re-run this checklist at each review.
Phase 2 — Prohibitions & Transparency (Steps 8-12)
Step 8: Screen for prohibited practices.
Check every system against Article 5 prohibited practices — social scoring, manipulative techniques exploiting vulnerabilities, untargeted facial scraping, and biometric categorization of sensitive attributes (European Commission, 2024).
Step 9: Apply transparency obligations.
For AI that interacts with people, generates deepfakes, or produces AI-generated content, mark transparency labels and disclosures per Article 50. These are in force since August 2, 2026 (European Commission, 2026).
Step 10: Label AI-generated content.
Ensure machine-readable labelling is technically feasible for synthetic content you produce. The watermarking grace period ends December 2, 2026.
Step 11: Audit GPAI obligations.
If you operate a general-purpose AI model, confirm you meet the AI Office's transparency, copyright, and training-data-summary obligations (in force since August 2025).
Step 12: Log compliance evidence.
Store a dated record of prohibitions screening and transparency implementation for each system.
Phase 3 — High-Risk Documentation (Steps 13-20)
Step 13: Implement a risk management system.
Design a documented, iterative risk process covering the full lifecycle — identification, estimation, evaluation, and mitigation of risks to health, safety, and fundamental rights (European Commission, 2024).
Step 14: Set up data governance.
Document training/validation/test data provenance, relevance, and completeness. Put bias-mitigation and data-quality measures in place.
Step 15: Create technical documentation.
Maintain the Article 11 technical file: architecture, development process, intended purpose, and the information needed for conformity assessment.
Step 16: Prepare automatic logging.
High-risk systems must record machine events automatically for traceability. Document your logging design.
Step 17: Ensure human oversight.
Document the human-in-the-loop measures and the interface that lets operators override or revert system output.
Step 18: Meet robustness and accuracy standards.
Document performance targets, accuracy levels, and robustness/cybersecurity measures appropriate to the system's purpose.
Step 19: Draft the EU declaration of conformity.
High-risk systems require a written EU declaration of conformity and the CE marking process when applicable.
Step 20: Complete the registration.
Register high-risk systems in the EU database before they are placed on the market — an obligation that scales with the high-risk deadlines from December 2027.
Phase 4 — Post-Deployment (Steps 21-25)
Step 21: Establish post-market monitoring.
Maintain a documented process to collect, review, and act on performance data across the system's lifetime.
Step 22: Log and escalate incidents.
Record serious incidents and understanding of near-misses. Escalate to the authority where the Act requires notification.
Step 23: Handle complaints.
Route and document complaints from data subjects and the public, including feedback channels for operators.
Step 24: Run periodic reviews.
Re-run classification when you materially change a system's intended purpose or capability — a reclassification can shift obligations.
Step 25: Maintain the audit trail.
Keep dated evidence of every obligation met. Your technical file should be reconstructable from your records alone.
Phase 5 — Ongoing Program (Steps 26-30)
Step 26: Train staff.
Train the teams that interact with AI on the transparency, human-oversight, and documentation duties that apply to their work.
Step 27: Manage vendors.
Verify that third-party AI providers you rely on meet their own obligations and provide the documentation you need (see our vendor risk assessment guide).
Step 28: Track deadlines.
Monitor the phased dates — December 2, 2026 (watermarking end), December 2, 2027 (Annex III), August 2, 2028 (Annex I), August 2, 2030 (public sector) (European Commission, 2026).
Step 29: Re-assess applicability.
Re-run the applicability factors — sensitive data, automated decision-making, international transfers — as your systems evolve.
Step 30: Conduct annual readiness review.
Re-run this full checklist annually and record the result as evidence of an active program.
A Practical Note on Scope
This checklist is a planning tool, not legal advice and not a certification of compliance. The EU AI Act's specific obligations depend on your system classification, role, and jurisdiction. Use the checklist to structure your program, and consult the official text and a qualified adviser for determinations that affect your obligations (European Commission, 2024).
Sources
European Commission. (2024). Regulation (EU) 2024/1689 of the European Parliament and of the Council. *Official Journal of the European Union*. https://eur-lex.europa.eu/eli/reg/2024/1689
European Commission. (2026). Regulation (EU) 2026/1744 — Digital Omnibus on AI. *Official Journal of the European Union*.
Top comments (0)