EU AI Act Compliance Checklist

Begin with scope. Article 2 reaches providers placing AI systems or GPAI models on the EU market, EU deployers, importers and distributors, and certain non-EU providers or deployers when system output is used in the Union. Record systems, model dependencies, users, jurisdictions, intended purposes, and affected people. Consider the Act’s defined exclusions and its relationship to other EU laws rather than assuming every AI-related activity is covered in the same way. Next, check the legal buckets independently. Screen for Article 5 prohibited practices; classify potential high-risk systems under both Article 6 routes; identify Article 50 transparency duties; and determine whether a model is GPAI under Chapter V. Then map operator roles and the obligations that follow: providers, deployers, importers, distributors, and general-purpose-model providers do not share one checklist. A model provider and the app provider integrating it may have separate duties. The 2026 amendment makes date tracking essential. The Act generally began applying on August 2, 2026, with exceptions. Two added Article 5 prohibitions apply from December 2, 2026. Most Chapter III requirements for Annex III high-risk systems apply from December 2, 2027, while the Article 6(1)/Annex I route applies from August 2, 2028. GPAI obligations applied earlier, from August 2, 2025, with a transition for certain models already on the market. Do not apply one date to every chapter or model. Finally, close identified gaps, assign owners, preserve evidence, and monitor deployed systems. Keep records of system versions, classification rationale, roles, required training and validation records, notices, oversight, incidents, and review dates. For Article 5 breaches, the ceiling is up to EUR 35 million or, for an undertaking, 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher. Article 99(6) gives SMEs, including start-ups, the lower of the applicable amount or percentage; the maximum is not a prediction of a specific case outcome. Consult qualified counsel on specific compliance conclusions.