This EU AI Act compliance checklist helps companies that build or use AI work out what applies to them and when. The AI Act entered into force on August 1, 2024, and its obligations apply in phases. In July 2026 the EU's Digital Omnibus on AI moved the main high-risk deadlines back, so many older checklists now show the wrong dates. This guide uses the current timeline.
Related guides: How ISO 42001 helps with EU AI Act compliance · EU AI Act timeline · How to build an AI governance framework
Key takeaways
- The AI Act classifies AI systems by risk: prohibited, high-risk, limited risk (transparency) and minimal risk.
- Prohibited practices and AI literacy duties have applied since February 2, 2025, and general-purpose AI model rules since August 2, 2025.
- After the Digital Omnibus, Annex III high-risk obligations apply from December 2, 2027, and high-risk AI in regulated products from August 2, 2028.
- Your obligations depend on your role: provider, deployer, importer or distributor.
EU AI Act deadlines (as amended in 2026)
| Date | What applies |
|---|---|
| August 1, 2024 | AI Act enters into force |
| February 2, 2025 | Prohibited AI practices banned; AI literacy obligations apply |
| August 2, 2025 | Rules for general-purpose AI (GPAI) models; governance and penalties framework |
| August 2, 2026 | Most transparency obligations under Article 50 begin to apply |
| December 2, 2026 | Labelling of AI-generated content for systems placed on the market before August 2, 2026; ban on non-consensual intimate deepfakes |
| December 2, 2027 | High-risk obligations for Annex III systems, such as AI used in employment, education, credit scoring or essential services |
| August 2, 2028 | High-risk obligations for AI embedded in products covered by EU product safety laws, such as medical devices |
The Digital Omnibus on AI was approved by the Council on June 29, 2026, published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026. Check official EU sources for any later changes.
The four risk categories
| Category | Examples | What it means |
|---|---|---|
| Unacceptable risk (prohibited) | Social scoring, manipulative techniques exploiting vulnerabilities, untargeted scraping of facial images, emotion recognition at work or school (with limited exceptions) | Banned since February 2, 2025 |
| High risk | AI used in hiring and worker management, education, credit scoring, access to essential services, biometric identification, critical infrastructure, and safety components of regulated products | Strict requirements on risk management, data, documentation, oversight and conformity assessment |
| Limited risk | Chatbots, AI-generated or manipulated content, emotion recognition systems | Transparency duties, such as telling users they are interacting with AI and labelling synthetic content |
| Minimal risk | Spam filters, most productivity features | No specific obligations beyond AI literacy, voluntary codes encouraged |
Who must comply: roles under the AI Act
- Provider: develops an AI system or has one developed and places it on the EU market under its own name. Carries the most obligations.
- Deployer: uses an AI system in a professional capacity, for example a company using an AI hiring tool.
- Importer and distributor: bring or make available AI systems from outside the EU.
The Act applies to organizations outside the EU when their AI systems are placed on the EU market or their output is used in the EU. A SaaS company can be a provider for its own AI features and a deployer of other vendors' AI tools at the same time.
EU AI Act compliance checklist
For every organization
- Build an inventory of AI systems you develop, sell and use, including AI features inside SaaS tools
- Classify each system by risk category and record your reasoning
- Confirm no prohibited practices are in use
- Run AI literacy training for staff who use or oversee AI
- Assign an owner for AI governance and a process to review new AI use
If you provide limited-risk systems
- Tell users when they are interacting with an AI system, unless it is obvious
- Mark AI-generated content in a machine-readable way where required
- Disclose deepfakes and AI-generated text published to inform the public, with the exceptions the Act allows
If you provide high-risk systems (before December 2, 2027 for Annex III)
- Set up a risk management system across the life cycle
- Apply data governance to training, validation and testing data
- Prepare technical documentation and keep logs
- Design for human oversight, accuracy, robustness and cybersecurity
- Run a quality management system and the required conformity assessment
- Register the system in the EU database and affix the CE marking
- Plan post-market monitoring and serious incident reporting
If you deploy high-risk systems
- Use systems according to the provider's instructions
- Assign human oversight to competent people
- Monitor operation and keep logs under your control
- Inform workers before using high-risk AI in the workplace
- Carry out a fundamental rights impact assessment where the Act requires it
Rules for general-purpose AI models
Since August 2, 2025, providers of general-purpose AI models must prepare technical documentation, give information to downstream providers who build on the model, put a copyright policy in place and publish a summary of training content. Models classed as having systemic risk face extra duties, including evaluations, incident reporting and cybersecurity protections. Most SaaS companies are not GPAI providers. They build on models from others and rely on those providers' documentation.
What to do this quarter
- Finish the AI inventory, including AI features inside tools you buy.
- Classify every system and confirm nothing is prohibited.
- Add transparency notices to chatbots and label AI-generated content where required.
- Record AI literacy training for staff.
- For anything that may be high-risk, start the risk management and documentation work now, as December 2027 will arrive quickly.
Penalties
Fines can reach 35 million euros or 7% of worldwide annual turnover for prohibited practices, 15 million euros or 3% for most other breaches, and 7.5 million euros or 1% for supplying incorrect information to authorities. For SMEs and startups, the lower of the two amounts applies.
How ISO 42001 helps
ISO 42001 does not equal AI Act compliance, but it gives you the management system the Act's high-risk requirements assume: inventory, risk management, impact assessment, documentation, supplier control and monitoring. Many companies use it as the backbone of their AI Act program. See how ISO 42001 helps with EU AI Act compliance.
How SecureSlate helps
SecureSlate maps EU AI Act obligations alongside ISO 42001, helps you build the AI inventory, track risk classification and impact assessments, and keep evidence ready for customers and regulators.
FAQ
When do high-risk AI obligations apply?
After the 2026 Digital Omnibus, high-risk obligations apply from December 2, 2027 for Annex III systems and from August 2, 2028 for high-risk AI embedded in regulated products.
Does the EU AI Act apply to US companies?
Yes, if their AI systems are placed on the EU market or their outputs are used in the EU.
Is using ChatGPT or other AI tools covered by the AI Act?
Using general-purpose AI tools makes you a deployer. For most uses, your duties are AI literacy and any transparency obligations. Obligations increase if you use AI for a high-risk purpose, such as screening job applicants.
What should a small company do first?
Build an inventory of AI systems, classify them by risk, confirm none are prohibited, train staff on AI literacy and add transparency notices to AI features.
Does ISO 42001 certification prove AI Act compliance?
No. It supports compliance by providing a governance system, but high-risk systems still need the specific requirements and conformity assessment the Act sets out.
What counts as AI literacy under the AI Act?
Providers and deployers must take measures so that staff who operate or use AI systems have sufficient understanding of them, taking into account their role and the context. Short role-based training with records is the usual approach.
Does the Digital Omnibus change the prohibited practices?
No. The prohibitions have applied since February 2, 2025. The Omnibus mainly moved high-risk deadlines and adjusted some other obligations.
Disclaimer (legal note)
This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.
Need compliance without the complexity?
SecureSlate automates ISO 27001, SOC 2, GDPR, HIPAA, and more. Built for growing teams. See it in action.
Find compliance gaps in 30 seconds
