Free tool · updated for the Digital Omnibus
EU AI Act compliance checklist
Every obligation in Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI, as a checklist you can filter by your role and system type. Each item names its article, the date it applies and what good evidence looks like. Your progress stays in your browser.
- Items
- 78
- Sections
- 11
- Sources
- 34
- Reviewed
- Oct 30, 2026
Next review by Nov 29, 2026 · report an error
How to use it
- 01
Pick your role
Choose provider, deployer, importer, distributor or GPAI model provider. Pick more than one if you play several roles. Leave all unticked to see everything.
- 02
Pick your system types
Tick the types that match your systems: prohibited practice screen, high-risk under Annex III or Annex I, Article 50 transparency, or general-purpose AI model. Not sure? Run the risk classifier first.
- 03
Work through each item
Set each item to not started, in progress, done or N/A, and add notes on owners and evidence. Progress saves in this browser automatically.
- 04
Export and share
Download Markdown, CSV or Excel for your compliance file or ticketing system, or print the checklist with your statuses.
Key deadlines
The AI Act applies in phases. As of Oct 30, 2026, the prohibitions, AI literacy, general-purpose AI rules and Article 50 transparency duties already apply. 50 of the 78 items below are high-risk obligations, which start on Dec 2, 2027 for Annex III systems and Aug 2, 2028 for Annex I systems.
| Date | What applies | Reference |
|---|---|---|
| Feb 2, 2025In force | Prohibited practices and AI literacy apply | Arts. 4–5 [sd-timeline][fli-113] |
| Aug 2, 2025In force | General-purpose AI model obligations apply | Chapter V [sd-timeline] |
| Jul 27, 2026In force | Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force | Reg. 2026/1744 [omnibus] |
| Aug 2, 2026In force | Article 50 transparency duties apply; enforcement begins for GPAI models, prohibitions, transparency and AI literacy | Art. 50, Art. 113 [sd-timeline] |
| Dec 2, 2026Upcoming | New bans on AI-generated non-consensual intimate imagery and CSAM; marking deadline for generative systems already on the market | Art. 5(1)(ba)–(bb), Art. 111(4) [sd-timeline][sd-111][fli-113] |
| Aug 2, 2027Upcoming | GPAI models placed on the market before Aug 2, 2025 must comply | Art. 111(3) [sd-111] |
| Dec 2, 2027Upcoming | High-risk obligations apply to Annex III systems | Art. 113, Art. 6(2) [sd-timeline][fli-113] |
| Aug 2, 2028Upcoming | High-risk obligations apply to Annex I (regulated-product) systems | Art. 113, Art. 6(1) [sd-timeline][fli-113] |
What the Digital Omnibus changed
Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on Jul 27, 2026. The checklist reflects these changes:
- High-risk obligations moved to Dec 2, 2027 (Annex III) and Aug 2, 2028 (Annex I).
- Two new bans, on AI that generates non-consensual intimate imagery and child sexual abuse material, apply from Dec 2, 2026.
- Generative systems already on the market before Aug 2, 2026 have until Dec 2, 2026 to mark their outputs under Article 50(2).
- Article 4 now asks providers and deployers to take measures to support AI literacy, without guaranteeing any level for any individual.
- Providers relying on the Article 6(3) exception must still register those systems.
- The quality management system can be proportionate to size, including for small mid-caps; a FRIA can cross-reference your DPIA; and the Commission is to publish a post-market monitoring plan template by Sep 2, 2027.
Missing these duties can be costly: see the fine tiers on our EU AI Act penalties page.
The checklist
Showing 78 of 78 items
0% done
0 of 78 applicable items done · 0 in progress · 0 N/A
Arts. 3, 4, 25 Scope, roles and AI literacy
0 of 4 doneKnow which systems you have, which role you play for each, and whether a change has made you a provider.
- Art. 3(1), (3)–(7)Applies since Feb 2, 2025 · Definitions (Chapter I)
List every AI system and general-purpose AI model you develop, buy or use in the EU, and record your role for each one: provider, deployer, importer, distributor or authorised representative.
Evidence: An AI inventory with an owner, intended purpose, EU markets, vendor and your role per system, reviewed on a set schedule and when new tools are bought.
- Art. 4Applies since Feb 2, 2025 · Providers and deployers
Take measures to support the AI literacy of staff and others who operate or use AI systems on your behalf, taking into account their knowledge, experience and the context the systems are used in.
Evidence: Role-based training plan, completion records, and guidance for staff who use AI tools, matched to the systems they actually work with.
Amended by the Digital Omnibus (in force July 27, 2026): the duty is now to support AI literacy, and it does not require any specific level of literacy for any individual.
- Art. 25(1)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Check whether you have become the provider of a high-risk system: by putting your name or trademark on it, by substantially modifying it, or by changing the intended purpose of a system so that it becomes high-risk.
Evidence: A change log for each third-party AI system recording rebranding, modifications and new uses, with a documented decision on provider status.
- Art. 25(4)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Agree in writing with suppliers of models, tools, components or services used in your high-risk system on the information, technical access and help you need to comply.
Evidence: Signed supplier terms covering documentation, technical access, known limitations and support. Free and open-source components (other than GPAI models) are exempt.
Art. 5 Prohibited practices screen
0 of 10 doneScreen every AI system against the banned practices. Two bans were added by the Digital Omnibus and apply from Dec 2, 2026.
- Art. 5(1)(a)Applies since Feb 2, 2025 · All operators
Confirm no system uses manipulative, deceptive or subliminal techniques that distort people’s decisions in a way that causes, or is likely to cause, significant harm.
Evidence: A signed screening record per system with the question asked, the answer and the reasoning, repeated when the purpose or design changes.
- Art. 5(1)(b)Applies since Feb 2, 2025 · All operators
Confirm no system exploits vulnerabilities linked to age, disability or a specific social or economic situation in a way that distorts behavior and causes, or is likely to cause, significant harm.
Evidence: Screening record covering target users, especially children and people in financial hardship, with design review notes.
- Art. 5(1)(ba)Applies from Dec 2, 2026 · New ban added by the Digital Omnibus
Confirm no system generates or manipulates realistic images, video or audio of an identifiable person’s intimate parts or sexual activity without that person’s explicit, informed consent.
Evidence: Generation safeguards and abuse testing records for image, video and audio features, plus a takedown and abuse-report process.
- Art. 5(1)(bb)Applies from Dec 2, 2026 · New ban added by the Digital Omnibus
Confirm no system generates or manipulates child sexual abuse material.
Evidence: Content safeguards, red-team results for this risk, and an escalation path to law enforcement.
- Art. 5(1)(d)Applies since Feb 2, 2025 · All operators
Confirm no system predicts the risk that a person will commit a crime based solely on profiling or personality traits.
Evidence: Screening record; where risk tools support a human assessment, documentation that they rely on objective, verifiable facts linked to criminal activity.
- Art. 5(1)(e)Applies since Feb 2, 2025 · All operators
Confirm you do not build or expand facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage.
Evidence: Data-sourcing records for any face dataset, showing where each image came from.
- Art. 5(1)(f)Applies since Feb 2, 2025 · All operators
Confirm no system infers people’s emotions in the workplace or in education, unless it is for medical or safety reasons.
Evidence: Screening of HR, productivity, proctoring and call-center tools for emotion inference, with the medical or safety justification where one applies.
- Art. 5(1)(g)Applies since Feb 2, 2025 · All operators
Confirm no system uses biometric data to categorize people by race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
Evidence: Screening record for any system that processes face, voice or other biometric data, listing the attributes it outputs.
- Art. 5(1)(h)Applies since Feb 2, 2025 · All operators
Confirm no system is used for real-time remote biometric identification in publicly accessible spaces for law enforcement, outside the narrow exceptions and conditions the Act sets.
Evidence: Screening record; for law-enforcement users, the legal basis and authorization for any use under an exception.
Arts. 6, 49(2) High-risk classification
0 of 4 doneDecide whether each system is high-risk through Annex I or Annex III, and document any Art. 6(3) exception.
- Art. 6(2), Annex IIIApplies from Dec 2, 2027 · Annex III systems
Check each system against the use cases listed in Annex III (such as biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration and justice).
Evidence: A classification record per system naming the Annex III point considered and the conclusion, signed off by legal or compliance.
- Art. 6(1), (1a)–(1c), Annex IApplies from Aug 2, 2028 · Annex I systems
Check whether the system is a product, or a safety component of a product, covered by the EU laws in Annex I that requires third-party conformity assessment. Features used only for non-safety purposes, such as user assistance or efficiency, are not safety components unless their failure would endanger health and safety.
Evidence: Product classification memo naming the Annex I law, the conformity route under it, and whether the AI function is a safety component.
Paragraphs 1a to 1c were added by the Digital Omnibus.
- Art. 6(3)–(4)Applies from Dec 2, 2027 · Annex III systems
If you rely on the Art. 6(3) exception that an Annex III system is not high-risk (narrow procedural task, improving a completed human activity, detecting patterns without replacing human review, or a preparatory task), document that assessment before placing the system on the market. A system that profiles people is always high-risk.
Evidence: A dated Art. 6(3) assessment naming the condition relied on, why the system does not materially influence decisions, and confirmation that it does not profile natural persons.
- Art. 49(2), Art. 6(4)Applies from Dec 2, 2027 · Annex III systems
Register yourself and any Annex III system you have assessed as not high-risk under Art. 6(3) in the EU database before placing it on the market.
Evidence: EU database registration confirmation, and the Art. 6(3) assessment ready to hand to authorities on request.
The Digital Omnibus kept this registration duty.
Arts. 9–15 Requirements for high-risk systems
0 of 9 doneWhat a high-risk system must meet before it is placed on the market. These are provider duties.
- Art. 9(1)–(5)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Run a documented risk management system across the system’s lifecycle: identify and estimate risks to health, safety and fundamental rights under intended use and foreseeable misuse, use post-market data, and adopt risk measures.
Evidence: A risk register for the system with owners, residual-risk acceptance, and review dates tied to releases and monitoring results.
- Art. 9(6)–(9)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Test the system against predefined metrics and probabilistic thresholds during development and before it is placed on the market, and consider effects on people under 18 and other vulnerable groups.
Evidence: Test plans with metrics and pass thresholds set in advance, test results per release, and a documented assessment of impact on minors and vulnerable groups.
- Art. 10Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Apply data governance to training, validation and testing data: document design choices, data origin and preparation, assumptions and gaps, and examine and mitigate biases. Datasets must be relevant, sufficiently representative and, as far as possible, error-free and complete.
Evidence: Datasheets for each dataset (source, collection, labeling, cleaning), bias analysis with mitigations, and representativeness checks against the setting of use.
The Digital Omnibus amended Art. 10 and moved the rules on processing special categories of personal data for bias detection to a new Art. 4a.
- Art. 11, Annex IVApplies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Draw up technical documentation with at least the Annex IV contents before the system is placed on the market, and keep it up to date. SMEs and small mid-caps may use a simplified form.
Evidence: An Annex IV technical file with version history, mapped section by section, and an owner responsible for updates.
- Art. 12Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Build in automatic event logging over the system’s lifetime, enough to trace how it functions, spot risks or substantial modifications, and support post-market and deployer monitoring.
Evidence: Logging specification listing the events captured, sample logs, and retention settings. Remote biometric identification systems need the extra fields Art. 12(3) lists.
- Art. 13Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Give deployers clear instructions for use: your identity and contact details, intended purpose, accuracy and robustness levels, known risks and misuse, input data specifications, human oversight measures, required resources, expected lifetime, maintenance and how to handle logs.
Evidence: Published instructions for use reviewed against each Art. 13(3) point, with a version matched to each release.
- Art. 14Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Design the system so people can oversee it: understand its limits, monitor for anomalies, avoid over-relying on outputs, interpret, disregard or override outputs, and stop it. Remote biometric identification results need separate confirmation by two trained people before action is taken, with narrow exceptions.
Evidence: Oversight design document, UI screenshots of override and stop controls, and overseer guidance included in the instructions for use.
- Art. 15(1)–(4)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Reach and keep an appropriate level of accuracy and robustness, declare the accuracy metrics in the instructions for use, and address feedback loops in systems that keep learning after deployment.
Evidence: Accuracy benchmarks with declared metrics, robustness and fail-safe tests, and drift monitoring results.
- Art. 15(5)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Protect the system against attempts to alter its use, outputs or performance, including data poisoning, model poisoning, adversarial examples, confidentiality attacks and model flaws.
Evidence: AI threat model, adversarial and red-team test results, and security controls mapped to each listed attack type.
Arts. 16–20, 22 Provider obligations and quality management
0 of 8 doneOrganizational duties of high-risk providers: QMS, records, logs, corrective action and an EU representative.
- Art. 16(b)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Show your name, registered trade name or trademark and a contact address on the system, or on its packaging or documentation.
Evidence: Screenshot or label showing provider identity and contact details.
- Art. 17Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Put in place a documented quality management system covering compliance strategy, design and development controls, testing, data management, risk management, post-market monitoring, incident reporting, communications, record-keeping, resources and accountability. It can be proportionate to your size.
Evidence: QMS manual with procedures mapped to Art. 17(1)(a)–(m), named owners, and records showing the procedures are followed.
The Digital Omnibus amended Art. 17(2): implementation is proportionate to the provider’s size, including for SMEs and small mid-caps, without lowering the level of protection.
- Art. 18Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Keep the technical documentation, QMS documentation, notified-body documents and the EU declaration of conformity available to authorities for 10 years after the system is placed on the market or put into service.
Evidence: Retention policy with a 10-year rule for these records and a tested way to retrieve them.
- Art. 19Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Keep the automatically generated logs under your control for a period suited to the system’s purpose, of at least six months unless other law says otherwise.
Evidence: Log retention configuration and policy showing at least six months.
- Art. 20Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
If a system you placed on the market does not comply, immediately bring it into conformity, withdraw, disable or recall it, and inform distributors, deployers, importers and authorities as required.
Evidence: A corrective-action procedure with notification templates and a log of past actions.
- Art. 16(l)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Make sure the system meets the EU accessibility requirements that apply to it.
Evidence: Accessibility review against Directives (EU) 2016/2102 and 2019/882 where they apply.
Arts. 43, 47–49 Conformity assessment, CE marking and registration
0 of 5 doneThe steps that let a high-risk system be placed on the EU market.
- Art. 43(1)–(3)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Complete the right conformity assessment before placing the system on the market: internal control for Annex III points 2 to 8; for Annex III point 1 (biometrics), internal control or a notified body, and a notified body is required if harmonised standards were not fully applied; for Annex I products, the procedure in the product’s own EU law.
Evidence: Conformity assessment report or notified-body certificate, with the route chosen and why.
Arts. 40–49 are not tied to the high-risk dates in Art. 113, but the provider duty that triggers this step (Art. 16) applies from the high-risk dates shown.
- Art. 43(4)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Run a new conformity assessment whenever the system is substantially modified. Changes to a learning system that were predetermined and documented at the first assessment do not count.
Evidence: A change-control procedure that flags substantial modifications, and the documented list of predetermined changes in the technical file.
Arts. 40–49 are not tied to the high-risk dates in Art. 113, but the provider duty that triggers this step (Art. 16) applies from the high-risk dates shown.
- Art. 47, Art. 16(g), Art. 18Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Draw up and sign an EU declaration of conformity for each high-risk system, with the contents listed in Annex V, and keep it for 10 years.
Evidence: Signed declaration per system and version, stored with the technical file.
Arts. 40–49 are not tied to the high-risk dates in Art. 113, but the provider duty that triggers this step (Art. 16) applies from the high-risk dates shown.
- Art. 48, Art. 16(h)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Affix the CE marking to the system, or to its packaging or documentation where that is not possible. Digital-only systems use a digital CE marking.
Evidence: Screenshots or photos of the CE marking, including the notified body’s number where one was involved.
Arts. 40–49 are not tied to the high-risk dates in Art. 113, but the provider duty that triggers this step (Art. 16) applies from the high-risk dates shown.
- Art. 49(1), (4)–(5)Applies from Dec 2, 2027 · Annex III systems
Register yourself and each Annex III high-risk system in the EU database before placing it on the market. Critical-infrastructure systems (Annex III point 2) are registered nationally, and law-enforcement, migration and border systems go in a secure non-public section.
Evidence: EU database registration confirmation with the Annex VIII information, kept up to date.
Arts. 40–49 are not tied to the high-risk dates in Art. 113, but the provider duty that triggers this step (Art. 16) applies from the high-risk dates shown.
Arts. 23–24 Importers and distributors
0 of 6 doneChecks for businesses that bring high-risk systems into the EU or pass them along the supply chain.
- Art. 23(1)–(2)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Before placing a high-risk system on the market, verify that the provider completed the conformity assessment, drew up the technical documentation, affixed the CE marking, supplied the declaration and instructions, and appointed an authorised representative.
Evidence: An import checklist per system and version with copies of the documents checked.
- Art. 23(3)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Show your name, registered trade name or trademark and contact address on the system, its packaging or its documentation.
Evidence: Label or documentation showing importer details.
- Art. 23(5)–(7)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Keep copies of any notified-body certificate, the instructions for use and the EU declaration of conformity for 10 years, and give authorities the documentation they ask for.
Evidence: Document archive with a 10-year retention rule per imported system.
- Art. 24(1)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Before making a high-risk system available, verify it has the CE marking, the EU declaration of conformity and instructions for use, and that the provider and importer have met their labelling duties.
Evidence: A distribution checklist per system and version with copies of the documents checked.
The AI Act Service Desk says the Digital Omnibus amended Art. 24 and its displayed text had not been updated when we checked (Oct 30, 2026). Check the consolidated text on EUR-Lex.
- Art. 23(2), Art. 24(2), (4)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Do not place or make available a system you have reason to think does not comply; once it is on the market, take or trigger corrective action and inform the provider or importer and the authorities if it presents a risk.
Evidence: An escalation procedure for suspected non-compliance with a log of cases and notifications.
- Art. 23(4), Art. 24(3)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
While a system is under your responsibility, make sure storage or transport conditions do not put its compliance at risk.
Evidence: Handling procedures, for example access controls on model artifacts and integrity checks on delivered software.
Arts. 26–27 Deployer duties and FRIA
0 of 11 doneWhat organizations using high-risk systems must do, including the fundamental rights impact assessment.
- Art. 26(1)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Use each high-risk system in line with the provider’s instructions for use, with technical and organizational measures to make that happen.
Evidence: Instructions for use on file, an internal operating procedure based on them, and periodic checks that use stays within the intended purpose.
- Art. 26(2)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Assign human oversight to people with the competence, training, authority and support they need.
Evidence: Named overseers per system, their training records and written authority to override or stop the system.
- Art. 26(4)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Where you control the input data, make sure it is relevant and sufficiently representative for the system’s intended purpose.
Evidence: Input data checks and a record of what data you feed the system and why it fits the purpose.
- Art. 26(5)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Monitor the system’s operation, tell the provider about issues, suspend use and inform the provider or distributor and the market surveillance authority if it may present a risk, and report serious incidents immediately.
Evidence: A monitoring routine, an incident and escalation procedure with provider contacts, and a log of reports made.
- Art. 26(6)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Keep the logs the system generates, to the extent they are under your control, for at least six months unless other law says otherwise.
Evidence: Log retention settings and policy showing at least six months.
- Art. 26(7)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Before using a high-risk system at work, inform workers’ representatives and the affected workers.
Evidence: Dated notice to workers and their representatives, following local consultation rules.
- Art. 26(8), Art. 49(3)Applies from Dec 2, 2027 · Annex III systems
If you are a public authority or EU body, register your use of the system in the EU database, and do not use a system that is not registered.
Evidence: EU database registration of your use, or a note that you are not a public-sector deployer.
- Art. 26(9)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Use the provider’s Art. 13 information to carry out a data protection impact assessment where GDPR requires one.
Evidence: A DPIA that references the system’s instructions for use.
- Art. 26(11)Applies from Dec 2, 2027 · Annex III systems
Tell people when an Annex III high-risk system makes, or helps make, decisions about them.
Evidence: Notice text in application forms, letters or interfaces, and a record of where it is shown.
- Art. 27(1)–(2), (4)Applies from Dec 2, 2027 · Annex III systems
If you are a public body, a private entity providing public services, or you use an Annex III point 5(b) or (c) system (creditworthiness, or life and health insurance pricing), carry out a fundamental rights impact assessment before first use. Critical-infrastructure systems (Annex III point 2) are excluded.
Evidence: A FRIA covering the Art. 27(1)(a)–(f) points: processes, period and frequency of use, affected groups, specific risks, oversight measures and what you will do if risks materialize. You may cross-reference an existing DPIA.
The Digital Omnibus amended Art. 27(4)–(5): the FRIA can cross-reference or include DPIA content, and the AI Office is to provide a simplified questionnaire template.
- Art. 27(2)–(3)Applies from Dec 2, 2027 · Annex III systems
Notify the market surveillance authority of the FRIA results using the template, and update the assessment when any element changes.
Evidence: Submitted notification and a dated update log for the FRIA.
Arts. 72–73 Post-market monitoring and serious incidents
0 of 5 doneMonitoring high-risk systems once they are in use, and reporting serious incidents on time.
- Art. 72(1)–(2)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Set up and document a post-market monitoring system that collects and analyzes performance data over the system’s lifetime to confirm it keeps complying.
Evidence: Monitoring dashboards or reports, data feeds from deployers, and review minutes with actions taken.
- Art. 72(3)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Write a post-market monitoring plan and include it in the Annex IV technical documentation.
Evidence: The plan, with metrics, data sources, review frequency and triggers for corrective action.
Amended by the Digital Omnibus: the Commission is to adopt guidance, including a template for the plan, by Sep 2, 2027.
- Art. 73(1)–(2)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Report serious incidents to the market surveillance authority of the Member State where they happened, immediately after establishing a causal link (or its reasonable likelihood) and no later than 15 days after becoming aware.
Evidence: An incident procedure with severity triage, a reporting template, authority contacts per Member State, and a log of reports with timestamps.
- Art. 73(3)–(5)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
Meet the shorter limits: no later than 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure, and no later than 10 days after becoming aware of a death. An incomplete first report is allowed if a complete one follows.
Evidence: Escalation playbook with the 2-day and 10-day routes and an on-call owner.
- Art. 73(6)Applies from Dec 2, 2027 · Annex III systemsApplies from Aug 2, 2028 · Annex I systems
After reporting, investigate the incident, assess the risk and take corrective action, cooperating with authorities and without altering the system in a way that could affect the cause analysis before you inform them.
Evidence: Investigation reports with root cause, corrective actions and evidence preserved before any changes.
Art. 50 Transparency duties
0 of 6 doneDisclosure and marking duties for chatbots, generated content, deepfakes and emotion recognition.
- Art. 50(1)Applies since Aug 2, 2026 · All in-scope systems
Design systems that interact directly with people so those people are told they are dealing with an AI, unless that is obvious from the context.
Evidence: Disclosure text in the chat or voice interface, with screenshots and the point in the flow where it appears.
- Art. 50(2), Art. 111(4)Applies since Aug 2, 2026 · Systems placed on the market from Aug 2, 2026Applies from Dec 2, 2026 · Systems already on the market before Aug 2, 2026
Mark synthetic audio, image, video and text outputs in a machine-readable format so they can be detected as AI-generated or manipulated, using solutions that are effective, interoperable, robust and reliable as far as technically feasible.
Evidence: Technical description of the marking method (for example watermarking or metadata), detection test results, and the exemptions you rely on, such as assistive editing.
- Art. 50(3)Applies since Aug 2, 2026 · All in-scope systems
Tell people exposed to an emotion recognition or biometric categorization system that it is operating, and process their personal data in line with GDPR.
Evidence: Notice text, where and when it is shown, and the GDPR legal basis recorded.
- Art. 50(4)Applies since Aug 2, 2026 · All in-scope systems
Disclose that image, audio or video deepfakes you publish are AI-generated or manipulated. For evidently artistic, satirical or fictional work, a light-touch disclosure that does not spoil the work is enough.
Evidence: Content labelling policy, label examples, and a review step before publication.
- Art. 50(4)Applies since Aug 2, 2026 · All in-scope systems
Disclose that AI-generated text published to inform the public on matters of public interest is AI-generated, unless it has gone through human review or editorial control and someone holds editorial responsibility.
Evidence: Editorial policy naming who holds responsibility, and records of human review, or disclosure labels where there is none.
- Art. 50(5)Applies since Aug 2, 2026 · All in-scope systems
Give the Art. 50 information clearly and distinguishably, at the latest at the first interaction or exposure, and in an accessible format.
Evidence: UX review showing when each disclosure appears, and an accessibility check of the disclosure.
Arts. 51–55 General-purpose AI models
0 of 10 doneDuties of GPAI model providers, with extra duties for models with systemic risk.
- Arts. 51–52Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
Check your model against the systemic-risk classification in Art. 51, and notify the Commission without delay if it meets the threshold or you know it will.
Evidence: A training-compute estimate and capability assessment, and a dated notification to the Commission where one was due.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 53(1)(a)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
Draw up and keep up to date technical documentation of the model, including training, testing and evaluation results with at least the Annex XI information, and provide it to the AI Office or national authorities on request.
Evidence: Model documentation mapped to Annex XI, with version history.
Open-source models whose weights, architecture and usage information are public are exempt from (a) and (b), unless they have systemic risk.
- Art. 53(1)(b)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
Give providers who build on your model the information and documentation they need to understand its capabilities and limits and to meet their own obligations, with at least the Annex XII elements.
Evidence: A downstream provider pack (model card, limitations, integration guidance) mapped to Annex XII.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 53(1)(c)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
Put in place a policy to comply with EU copyright law, including identifying and respecting text-and-data-mining opt-outs.
Evidence: Written copyright policy, crawler opt-out handling, and records of how reservations are detected and honored.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 53(1)(d)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
Publish a sufficiently detailed summary of the content used to train the model, using the AI Office template.
Evidence: The published summary, its URL and the template version used.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 55(1)(a)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
For models with systemic risk: evaluate the model with up-to-date standardized methods, including documented adversarial testing, to identify and reduce systemic risks.
Evidence: Evaluation reports and red-team results with dates, methods and findings.
The AI Act Service Desk says the Digital Omnibus amended Art. 55 and its displayed text had not been updated when we checked (Oct 30, 2026). Check the consolidated text on EUR-Lex.
- Art. 55(1)(b)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
For models with systemic risk: assess and mitigate possible systemic risks at EU level, including their sources, from the development, release or use of the model.
Evidence: A systemic risk assessment with mitigations and owners, reviewed at each major release.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 55(1)(c)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
For models with systemic risk: track and document serious incidents and possible corrective measures, and report them without undue delay to the AI Office and, where relevant, national authorities.
Evidence: Incident log, reporting procedure and copies of reports sent.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
- Art. 55(1)(d)Applies since Aug 2, 2025 · Models placed on the market from Aug 2, 2025Applies from Aug 2, 2027 · Models placed on the market before Aug 2, 2025
For models with systemic risk: keep adequate cybersecurity protection for the model and its physical infrastructure.
Evidence: Security controls for weights and infrastructure (access control, monitoring, incident response) and recent test results.
The AI Office can enforce GPAI obligations, including fines, from Aug 2, 2026.
When a spreadsheet is not enough
Many teams start with this checklist and move to a governance platform once they have several high-risk systems or need audit trails for evidence. Compare platforms in our independent ranking of EU AI Act compliance tools, or use the vendor matchmaker. Rankings are editorial and never for sale.
Frequently asked questions
+What is on an EU AI Act compliance checklist?
Start with an inventory of your AI systems and your role for each, then AI literacy (Art. 4) and a screen for prohibited practices (Art. 5). High-risk systems add the Art. 9–15 requirements, provider duties such as a quality management system (Art. 17), conformity assessment, CE marking and registration (Arts. 43, 47–49), deployer duties (Arts. 26–27) and post-market monitoring and incident reporting (Arts. 72–73). Chatbots and generative AI add Article 50 transparency, and general-purpose AI models have their own duties (Arts. 53–55).
+When do the EU AI Act high-risk rules apply after the Digital Omnibus?
The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, moved them. Obligations for stand-alone high-risk systems in Annex III apply from December 2, 2027, and for AI in products covered by Annex I from August 2, 2028. Article 50 transparency duties have applied since August 2, 2026. See all dates on our AI compliance timeline.
+Does the EU AI Act still require AI literacy training?
Yes, in softer form. Article 4 has applied since February 2, 2025. Since the Digital Omnibus, providers and deployers must take measures to support the AI literacy of their staff and others using AI on their behalf; the duty no longer requires any specific level of literacy for any individual. The Commission and Member States must support those efforts. Keep a training plan and records so you can show what you did.
+Which checklist items apply to a deployer?
Tick "Deployer" above. For every AI system: the inventory, AI literacy and the Art. 5 screen. For high-risk systems: use per the instructions, human oversight, input data, monitoring, six-month log retention, informing workers and affected people, and for some deployers a fundamental rights impact assessment (Art. 27). For chatbots and generated content: the Article 50(3) and (4) disclosures. Our FRIA generator drafts the assessment.
+Who needs a fundamental rights impact assessment (FRIA)?
Before first use of an Annex III high-risk system: bodies governed by public law, private entities providing public services, and deployers of systems that assess creditworthiness or price life and health insurance (Annex III points 5(b) and (c)). Critical-infrastructure systems are excluded. The Digital Omnibus lets the FRIA cross-reference an existing DPIA, and the AI Office is to publish a simplified questionnaire template.
+Do we have to register an AI system we decided is not high-risk?
Yes. The Digital Omnibus kept the duty: a provider that relies on Article 6(3) to treat an Annex III system as not high-risk must document the assessment before placing it on the market and register the system in the EU database under Article 49(2).
+How fast must serious incidents be reported?
Providers of high-risk systems report to the market surveillance authority no later than 15 days after becoming aware; no later than 2 days for a widespread infringement or serious disruption of critical infrastructure; and no later than 10 days after becoming aware of a death (Art. 73). Our incident report builder structures the report.
+Is this also an AI compliance checklist for other laws?
No. It covers the EU AI Act only. For a management-system view that maps to many laws, use our ISO 42001 checklist. For US state laws, use the state-by-state compliance wizard.
+Does ISO 42001 certification cover the EU AI Act?
No. ISO/IEC 42001 is not a harmonised standard under the AI Act, so certification gives no presumption of conformity, and it does not replace a system’s conformity assessment. An AI management system is still useful groundwork for the Act’s risk management, data governance and monitoring duties. See our ISO 42001 guide.
+Is my progress stored on your servers?
No. Statuses, notes and filters are saved only in your browser’s local storage on this device. Nothing is sent to us. If your browser blocks storage, the checklist still works, but export your progress before closing the tab.
Sources
Each item lists the sources it draws on. The date after each source is when we last opened and checked it.
- [aia]EUR-Lex, Regulation (EU) 2024/1689 (Artificial Intelligence Act) (2024-07-12). Checked Oct 15, 2026.Official text. Items citing only this source (Arts. 47, 48, 51, 52, 54) are paraphrased from it.
- [omnibus]EUR-Lex, Regulation (EU) 2026/1744 (Digital Omnibus on AI) (2026-07-08). Checked Oct 30, 2026.Amending regulation dated July 8, 2026; entry into force July 27, 2026.
- [sd-timeline]European Commission, AI Act Service Desk, Timeline for the implementation of the EU AI Act. Checked Oct 30, 2026.Feb 2, 2025 (definitions, AI literacy, prohibitions); Aug 2, 2025 (GPAI rules); Aug 2, 2026 (Art. 50; enforcement begins for GPAI models, prohibitions, transparency and AI literacy); Dec 2, 2026 (new bans; Art. 50(2) for systems already on the market); Dec 2, 2027 (Annex III); Aug 2, 2028 (Annex I). Reflects the Digital Omnibus.
- [fli-113]Future of Life Institute, artificialintelligenceact.eu, Article 113: Entry into force and application (as amended). Checked Oct 30, 2026.Art. 5(1)(ba), (bb), (1a) and (1b) apply from Dec 2, 2026; Chapter III Sections 1–3 apply from Dec 2, 2027 (Art. 6(2), Annex III) and Aug 2, 2028 (Art. 6(1), Annex I); other provisions from Aug 2, 2026 unless listed; Art. 101 excluded from the Aug 2, 2025 group.
- [sd-3]AI Act Service Desk, Article 3: Definitions. Checked Oct 30, 2026.Definitions of provider, deployer, authorised representative, importer, distributor and operator; SMC definition added by the Omnibus.
- [sd-4]AI Act Service Desk, Article 4: AI literacy (amended). Checked Oct 30, 2026.Amended duty: providers and deployers take measures to support AI literacy; no specific level guaranteed for any individual.
- [sd-5]AI Act Service Desk, Article 5: Prohibited AI practices. Checked Oct 30, 2026.Points (a) to (h), and new points (ba) and (bb) added by the Omnibus.
- [sd-6]AI Act Service Desk, Article 6: Classification rules for high-risk AI systems. Checked Oct 30, 2026.Art. 6(1) Annex I route and new paras 1a–1c; Art. 6(2) Annex III; Art. 6(3) conditions and profiling rule; Art. 6(4) documentation and Art. 49(2) registration.
- [sd-9]AI Act Service Desk, Article 9: Risk management system. Checked Oct 30, 2026.Lifecycle risk management steps, testing against predefined metrics, effects on under-18s and vulnerable groups.
- [sd-10]AI Act Service Desk, Article 10: Data and data governance (amended). Checked Oct 30, 2026.Dataset quality and governance; paras 1 and 6 amended, para 5 deleted, cross-reference to new Art. 4a.
- [sd-11]AI Act Service Desk, Article 11: Technical documentation (amended). Checked Oct 30, 2026.Annex IV documentation before market; simplified form for SMEs and SMCs.
- [sd-12]AI Act Service Desk, Article 12: Record-keeping. Checked Oct 30, 2026.Automatic event logging over the system lifetime.
- [sd-13]AI Act Service Desk, Article 13: Transparency and provision of information to deployers. Checked Oct 30, 2026.Contents of instructions for use.
- [sd-14]AI Act Service Desk, Article 14: Human oversight. Checked Oct 30, 2026.Oversight design, overseer capabilities, stop function, two-person verification for remote biometric identification.
- [sd-15]AI Act Service Desk, Article 15: Accuracy, robustness and cybersecurity. Checked Oct 30, 2026.Declared accuracy metrics, resilience, feedback loops, AI-specific attacks.
- [sd-16]AI Act Service Desk, Article 16: Obligations of providers of high-risk AI systems. Checked Oct 30, 2026.Points (a) to (l), including conformity assessment, declaration, CE marking, registration and accessibility.
- [sd-17]AI Act Service Desk, Article 17: Quality management system (amended). Checked Oct 30, 2026.QMS aspects (a) to (m); para 2 amended for proportionality, including SMEs and SMCs.
- [sd-18]AI Act Service Desk, Article 18: Documentation keeping. Checked Oct 30, 2026.10-year retention of technical, QMS and notified-body documentation and the EU declaration of conformity.
- [sd-19]AI Act Service Desk, Article 19: Automatically generated logs. Checked Oct 30, 2026.Providers keep logs under their control for at least six months.
- [sd-20]AI Act Service Desk, Article 20: Corrective actions and duty of information. Checked Oct 30, 2026.Corrective action, withdrawal, recall and notification duties.
- [sd-22]AI Act Service Desk, Article 22: Authorised representatives of providers of high-risk AI systems. Checked Oct 30, 2026.Written mandate before making the system available; 10-year retention; mandate tasks.
- [sd-23]AI Act Service Desk, Article 23: Obligations of importers. Checked Oct 30, 2026.Pre-market verification, labelling, storage, 10-year retention, cooperation.
- [sd-24]AI Act Service Desk, Article 24: Obligations of distributors. Checked Oct 30, 2026.Pre-market checks, storage, corrective action; page notes an Omnibus amendment not yet reflected in its text.
- [sd-25]AI Act Service Desk, Article 25: Responsibilities along the AI value chain (amended). Checked Oct 30, 2026.When distributors, importers and deployers become providers; written agreements with suppliers.
- [sd-26]AI Act Service Desk, Article 26: Obligations of deployers of high-risk AI systems. Checked Oct 30, 2026.Paragraphs 1 to 12, including six-month log retention, worker information and notice to affected persons.
- [sd-27]AI Act Service Desk, Article 27: Fundamental rights impact assessment (amended). Checked Oct 30, 2026.Which deployers must assess, contents (a)–(f), notification, DPIA cross-referencing and AI Office template.
- [sd-43]AI Act Service Desk, Article 43: Conformity assessment (amended). Checked Oct 30, 2026.Annex III point 1 route choice; internal control for points 2–8; sectoral procedure for Annex I Section A; new assessment after substantial modification.
- [sd-49]AI Act Service Desk, Article 49: Registration. Checked Oct 30, 2026.Registration by providers (incl. Art. 6(3) systems) and public-sector deployers; secure section; national registration for Annex III point 2.
- [sd-50]AI Act Service Desk, Article 50: Transparency obligations. Checked Oct 30, 2026.Provider and deployer transparency duties, timing and accessibility; para 7 amended.
- [sd-53]AI Act Service Desk, Article 53: Obligations for providers of general-purpose AI models. Checked Oct 30, 2026.Documentation, downstream information, copyright policy, training-content summary; open-source exception; codes of practice.
- [sd-55]AI Act Service Desk, Article 55: Obligations for providers of GPAI models with systemic risk. Checked Oct 30, 2026.Evaluation and adversarial testing, systemic risk mitigation, serious incident reporting, cybersecurity. Page notes an Omnibus amendment not yet reflected in its text.
- [sd-72]AI Act Service Desk, Article 72: Post-market monitoring (amended). Checked Oct 30, 2026.Monitoring system and plan; Commission guidance and template due by Sep 2, 2027.
- [sd-73]AI Act Service Desk, Article 73: Reporting of serious incidents. Checked Oct 30, 2026.15-day, 2-day and 10-day reporting limits; investigation and cooperation duties.
- [sd-111]AI Act Service Desk, Article 111: Systems and models already on the market (amended). Checked Oct 30, 2026.GPAI models placed on the market before Aug 2, 2025 comply by Aug 2, 2027; generative systems placed on the market before Aug 2, 2026 comply with Art. 50(2) by Dec 2, 2026; legacy high-risk systems.
How we keep this page current
We re-check every item against its sources at least every 30 days, and sooner when the law or standard changes. This checklist is a planning aid, not legal advice: requirements are paraphrased, so check the official text and take advice before relying on it. Vendors cannot pay to appear on this page.