EU AI Act Compliance: A Step-by-Step Programme for Providers and Deployers

EU AI Act compliance is a sequence of ten steps, from mapping every AI system to the high-risk rules of Chapter III Sections 1 to 3, which apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Four steps cover AI literacy, the prohibitions, transparency and general-purpose AI models, whose duties already apply, except Article 5(1), points (ba) and (bb), from 2 December 2026.

The act has passed and applies in stages. The EU AI Act is Regulation (EU) 2024/1689, in force since 1 August 2024 and amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026. Each step gives an orientation, not a legal assessment.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.

What EU AI Act Compliance Means for an Organisation

EU AI Act compliance means meeting the duties that Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, attaches to an organisation's role and to the risk route of each AI system or model. The current text of 119 articles, 14 annexes and 180 recitals does not define "compliance". Duties attach to operators and to each AI system (Article 3(8) and (1)), so compliance is checked system by system.

Who Must Comply and How Far the Act Reaches

Six operator roles carry duties under the AI Act: provider, product manufacturer, deployer, authorised representative, importer and distributor (Article 3(8)). One organisation can provide one system and deploy another.

The act reaches providers placing AI systems or general-purpose AI models on the Union market, wherever established (Article 2(1), point (a)), and third-country providers and deployers whose AI output is used in the Union (point (c)). The guide on who the EU AI Act applies to explains this territorial scope. Deployers who are natural persons acting in a purely personal non-professional activity are excluded (Article 2(10)).

Compliance Is Dated: What Applies Today and What Comes Next

Four application dates have passed and five follow, from 2 February 2025 to 2 August 2030. Each rests on Article 113 or on a transition rule in Article 111:

Articles 111 and 113 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Regulation (EU) 2026/1744 postponed Chapter III Sections 1 to 3 and the sandbox deadline, but not Article 50. Before 27 July 2026, Sections 1 to 3 were to apply from 2 August 2026 (Annex III) and 2 August 2027 (Annex I).

The Commission FAQ "Navigating the AI Act", updated 20 October 2026, states: "The rules for high-risk AI systems will apply starting 2 December 2027." The EU AI Act timeline lists every application date of the act.

The Compliance Section: Six Pages and What Each Answers

Six pages of this guide take the programme further: a checker, a checklist and four guides. The checker and the checklist sort duties by role and risk route, with start dates:

The Ten-Step Compliance Programme at a Glance

The ten steps follow the order in which the act's duties start: inventory and classification first, then the duties that already apply, then the high-risk build-out. The sequence is this guide's synthesis, not an official Commission programme, and it gives an orientation, not a legal assessment.

Step 1: Map Every AI Tool and Model You Build, Buy or Use

Step 1 lists every AI system and general-purpose AI model the organisation develops, places on the market, buys or uses, with its intended purpose and placing date, because Article 111 sets separate deadlines for those already on the market.

No article requires an inventory; the AI Pact pledge "Identifying and mapping AI systems likely to be categorised as high-risk under the AI Act" is voluntary and not legally binding.

Step 2: Decide Whether You Provide or Deploy, and the Risk Route of Each Tool

Step 2 gives each system a role, which decides whose duties apply, and a risk route, which decides which duties apply:

• AI system: Article 3(1), or a general-purpose AI model.
• Role: the six roles and the Article 25(1) triggers.
• Scope: Article 2.
• Prohibitions: Article 5(1).
• High-risk route: Annex I (Article 6(1)) or Annex III (Article 6(2)), with the Article 6(3) filter.
• Other duties: Article 50 or Chapter V.

A provider relying on Article 6(3) documents its assessment before placing on the market or putting into service and registers the system (Articles 6(4) and 49(2)). An Annex III system that profiles natural persons is always high-risk (Article 6(3), third subparagraph).

Annex III lists 25 use cases in eight areas. The guide to high-risk AI systems explains the high-risk route of Article 6. The Article 6(5) classification guidelines exist only as a draft of 19 May 2026.

Step 3: Stop Banned Uses, Including the Two 2026 Additions

Step 3 ends every use that Article 5 prohibits: points (a), (b) and (c) to (h) apply since 2 February 2025, points (ba) and (bb) from 2 December 2026. The new points cover realistic intimate or sexually explicit material of an identifiable person made without consent and child sexual abuse material; Article 5(1a) and (1b), applying from the same date, set out when providers and deployers fall under them.

Every operator screens its uses against all ten points. The guide to every ban in Article 5 explains each point. A breach carries the highest tier, EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher (Article 99(3)).

Step 4: Take Measures for the Skills of Staff Who Operate AI

Step 4 records the measures providers and deployers take to support the AI literacy of staff and other persons operating AI systems on their behalf (Article 4, as replaced on 27 July 2026).

The duty "does not require providers or deployers to guarantee any specific level of AI literacy of any individual"; before 27 July 2026, Article 4 required measures to ensure, "to their best extent", a sufficient level.

The duty applies since 2 February 2025. The guide to AI literacy under Article 4 covers the measures after the 2026 amendment. According to the Commission AI Literacy Q&A (last update 20 October 2026), national market surveillance authorities supervise it from 2 August 2026.

Step 5: Meet the Disclosure Duties for Interacting and Content-Generating Tools

Step 5 meets Article 50, applicable since 2 August 2026: providers inform persons that they interact with an AI system (Article 50(1)) and mark synthetic output (Article 50(2)); deployers disclose deep fakes and AI-generated text on matters of public interest, subject to the exceptions of Article 50(4).

Generative systems placed on the market before 2 August 2026 meet Article 50(2) by 2 December 2026 (Article 111(4)). The voluntary Code of Practice on Transparency of AI-generated Content is final since 10 June 2026.

The guide to transparency obligations for synthetic content covers chatbots and deep fakes. Breaches fall under Article 99(4), point (g): EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher.

Step 6: Document and Share Information on Models You Place on the Market

Step 6 binds providers of general-purpose AI models: since 2 August 2025 they keep technical documentation, inform downstream providers, run a copyright policy and publish a training-content summary (Article 53(1)).

Above 10^25 FLOP of cumulative training compute, a model is presumed to carry systemic risk (Article 51(2)) and adds the four duties of Article 55(1).

Models placed on the market before 2 August 2025 comply by 2 August 2027 (Article 111(3)). The guide to general-purpose AI models covers systemic risk. Fines on model providers are for the Commission alone (Article 101).

Step 7: Build the Technical File, Quality Management and Conformity Route

Step 7 prepares providers of high-risk AI systems for the date Chapter III Sections 1 to 3 apply to them: 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)). Article 16 lists 12 obligations, from the Section 2 requirements to the conformity assessment, the EU declaration, the CE marking and registration under Article 49(1).

EN 18286:2026, cited by Implementing Decision (EU) 2026/2274 of 12 October 2026, is the only harmonised standard under the AI Act as of 24 October 2026 and covers the Article 17 quality management system.

The guide to AI Act conformity assessment explains the routes of Article 43. No notified body is listed on NANDO under the AI Act as of 24 October 2026.

Step 8: Prepare Use-Side Duties, Worker Information and Impact Assessments

Step 8 prepares deployers of high-risk AI systems for the twelve paragraphs of Article 26, from use according to the instructions to human oversight by competent staff. Employers inform workers' representatives and affected workers before workplace use (Article 26(7)).

Before deploying an Annex III system other than point 2, bodies governed by public law, private entities providing public services and deployers of points 5(b) and 5(c) systems assess the impact on fundamental rights and notify the results to the market surveillance authority (Article 27).

Step 9: Set Owners, Supplier Contracts and the Size Class

Step 9 names who answers for each duty, writes the information duties into supplier contracts and records whether the organisation is an SME or a small mid-cap. Article 17(1), point (m), requires providers of high-risk systems to set up "an accountability framework setting out the responsibilities of the management and other staff with regard to all the aspects listed in this paragraph". Article 25(4) requires a written agreement with suppliers of an AI system, AI model, tools, services, components or processes, with a carve-out for free and open-source suppliers other than of general-purpose AI models, fined under Article 99(4), point (da), since Regulation (EU) 2026/1744. The size classes follow Recommendation 2003/361/EC (SMEs) and Recommendation (EU) 2025/1099 (small mid-caps) (Article 3(14a) and (14b)).

Step 10: Track Pending Guidelines and Postponed Dates

Step 10 keeps the programme current, because several Commission documents are still drafts or only due. The Commission announced on 19 May 2026 that the final Article 6(5) guidelines will be adopted by the end of 2026; post-market monitoring guidance is due by 2 September 2027 (Article 72(3)). The register of EU AI Act guidelines shows which documents are final or draft.

The Programme in One Table: Who Does What, on Which Legal Basis, from When

Seven groups of duty holders appear in the programme, each with its own legal basis, start date and fine tier, on top of a baseline for everyone:

Article 113, third paragraph, and Articles 99 and 101 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.

Roles can change: under Article 25(1), a distributor, importer, deployer or other third party becomes the provider when it puts its name or trademark on a high-risk system, modifies it substantially so that it remains high-risk, or changes a system's intended purpose so that it becomes high-risk. The guide to AI Act roles explains when a deployer becomes a provider.

Who Checks Compliance and What a Breach Can Lead To

National market surveillance authorities and, for general-purpose AI models and some systems built on them, the AI Office have enforced the AI Act since 2 August 2026. The AI Office is exclusively competent for systems built on a general-purpose AI model of the same provider or undertaking (except Annex I products, Annex III points 2 and 8, and law enforcement, border management and financial-institution systems under Article 74(6)) and for systems in designated very large online platforms or search engines (Article 75(1)). Article 99 sets the maximum fines that national penalty rules must provide for:

Article 99 sets no EU fine amount for Article 4 or Article 27; penalties for a missing Article 27 assessment follow national rules (Article 99(1)). The guide to EU AI Act penalties sets out the full penalties regime.

Free Official Help and Voluntary Commitments

Four official sources of help exist: the AI Act Service Desk, the AI Pact, national competent authorities and regulatory sandboxes. The Service Desk opened on 8 October 2025; on 24 October 2026 its checker still reads "Currently in its beta version, the Compliance Checker represents an ongoing project" and does not mention Regulation (EU) 2026/1744.

The AI Pact pledges are voluntary and not legally binding. Member States shall ensure that at least one national AI regulatory sandbox is operational by 2 August 2027 (Article 57(1)).

Under Article 70(8), national competent authorities guide and advise SMEs, including start-ups, and small mid-caps. The guide to national competent authorities gives the designation status in all 27 Member States.

Where the Programme Ends: Overlapping EU Regimes

The programme covers the AI Act only; data protection, product liability, NIS2 and the Cyber Resilience Act run their own compliance tracks. Under Article 42(3), high-risk AI systems that fall under the Cyber Resilience Act and meet its Article 12(1) conditions are deemed to comply with the Article 15 cybersecurity requirements.

AI liability in the EU follows the Product Liability Directive (EU) 2024/2853 for products placed on the market or put into service after 9 December 2026; the AI Liability Directive proposal was withdrawn in 2025.

The GDPR applies in parallel: Article 4a replaced Article 10(5) on bias detection, and Article 27(4) allows DPIA cross-references. The page on where the AI Act and the GDPR overlap covers Article 4a and the DPIA.

EU AI Act Compliance: Related Questions

Commission guidance, ISO/IEC 42001, official cost estimates, Article 2(1) and Regulation (EU) 2026/1744 answer the bordering questions.

Is There an Official Commission Compliance Programme?

No compliance programme is published on the Commission's AI Act pages as of 24 October 2026; its FAQ "Navigating the AI Act" explains the duties. The AI Pact offers voluntary pledges, not a programme.

Does an ISO Certificate Prove Compliance?

No: ISO/IEC 42001 is a voluntary management-system standard without presumption of conformity with the AI Act. The overview of the AI Act compared with ISO/IEC 42001 sets out the difference.

Are There Official Estimates of the Programme's Price?

Yes, as estimates, not prices: the impact assessment SWD(2021) 84 of 21 April 2021 put the maximum at around EUR 10 000 per AI application, adjusted to EUR 6 000 to 7 000 by 2025. SWD(2025) 836 of 19 November 2025 states that "there are no reliable calculations for compliance costs arising from the existing framework for businesses".

Does the Programme Reach Companies outside the EU?

Yes: Article 2(1), points (a) and (c), reach non-EU providers placing on the Union market and third-country providers and deployers whose output is used in the Union. The guide to the EU AI Act for non-EU companies covers US, UK and other providers. Non-EU providers of high-risk AI systems and of general-purpose AI models appoint an authorised representative by written mandate (Articles 22(1) and 54(1)).

Can the Omnibus Dates Move Again?

Only a new amending act can move them; the high-risk dates moved once, by Regulation (EU) 2026/1744. The page on the Digital Omnibus on AI explains what that regulation changed. The separate proposal COM(2025) 837, pending at the European Parliament ("Awaiting committee decision" as of 24 October 2026), does not amend the AI Act.

Frequently Asked Questions about EU AI Act Compliance

What does EU AI Act compliance require?

It requires the duties the act attaches to each role and risk route, from AI literacy to the Chapter III requirements, ordered here in ten steps.

When does an organisation have to comply?

Now for Article 4, Article 50 and general-purpose AI models; Chapter III Sections 1 to 3 from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).

Does an organisation that only uses a bought tool have duties?

Yes. Deployers take AI literacy measures (Article 4) and meet Article 50(4); deployers of high-risk systems follow Article 26 and, in the cases of Article 27(1), Article 27.

Can a small company comply with less?

Partly: SMEs, including start-ups, without partner or linked enterprises may use a simplified quality management system (Article 63(1)), but they are not exempted from other requirements, including Articles 9 to 15, 72 and 73 (Article 63(2)).

Does the online checker give a legal assessment?

No. The compliance checker gives an orientation with the legal reference and date of each result, never a "compliant" verdict.

Is there an official AI Act compliance certificate?

No. The act certifies no organisation; notified-body certificates cover a high-risk AI system for at most five years (Annex I) or four years (Annex III) (Article 44(2)).