EU AI Act Compliance Checker: Your Role, Risk Class, Obligations and Dates

The EU AI Act compliance checker asks 12 questions in the order of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and returns your role, risk route, articles and dates. Each result card names the provision behind it, the date it applies from and the duties it triggers.

Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024) is in force since 1 August 2024, and Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 2026/1744, 24.7.2026) amends it since 27 July 2026. The consolidated version 02024R1689-20260727 has no legal effect; the Official Journal texts are authentic. A result gives an orientation on the EU AI Act as amended, for the answers entered, not a legal assessment.

How the EU AI Act Compliance Checker Works: Twelve Questions in the Act's Order

The checker follows the act's sequence: AI system or model (Article 3), role, scope (Article 2), bans (Article 5), high-risk routes (Article 6), Article 50 and Chapter V. The familiar risk tiers are Commission vocabulary from the prohibited-practices guidelines C(2025) 5052 (paragraph 2), not terms the act defines, so a result names the provisions instead.

Three answers end the check early: no inference from input, an operator outside Article 2(1), and an exclusion under Article 2(3), (4), (6) or (8). Question 12 on company size comes last because it changes fine ceilings and documentation, not the route. Every question offers "Not sure".

A result answers the classification question: role, route, articles and dates. Meeting those duties is separate work. That work belongs to an EU AI Act compliance programme, which uses the checker as its classification step.

What the Result Screen Shows, and What It Never Says

Each result card shows the triggering provision, its date, the duties in short and the fine tier, and none says that a system is compliant:

• The provision, cited as the act numbers it, for example "Annex III, point 4(a)".
• The date, "since" for a past date and "from" for one ahead.
• The duties by addressee, such as provider or deployer.
• The fine tier, for example EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher, for Article 5 (Article 99(3)).

Every card closes with "Orientation, not a legal assessment. Verify with counsel before you rely on it." Providers and deployers also receive an Article 4 card: since 27 July 2026 they "shall take measures to support the development of AI literacy", with no certificate required and no fine amount in Article 99.

Step 1: Is It an AI System, an AI Model, or Both?

An "AI system" is "a machine-based system that is designed to operate with varying levels of autonomy" that infers from its input how to generate outputs such as predictions, content, recommendations or decisions (Article 3(1)). A "no" to this inference test ends the system module.

A general-purpose AI model (Article 3(63)) displays significant generality, performs a wide range of distinct tasks and can be integrated into downstream systems, except models used for research, development or prototyping before placing on the market. The Commission guidelines on the AI system definition, C(2025) 5053 final of 29 July 2025, explain the Article 3(1) elements.

Question 1 opens one module per answer: AI system, GPAI model, or both.

Step 2: Which Role Do You Hold, and Can It Change?

The checker records one or more of the six operator roles of Article 3(8): provider, product manufacturer, deployer, authorised representative, importer and distributor. A provider places a system or GPAI model on the market or puts it into service under its own name or trademark, paid or free (Article 3(3)); a deployer uses a system under its authority, outside personal non-professional activity (Article 3(4)).

One organisation can be provider of one system and deployer of another. The act assigns duties per role, not per company. The AI Act roles of provider, deployer, importer and distributor each carry their own articles.

Under Article 25(1), a third party becomes the provider of a high-risk system if it (a) puts its name or trademark on it, without prejudice to contractual arrangements, (b) substantially modifies it so that it remains high-risk, or (c) changes the intended purpose of a system so that it becomes high-risk. Question 4 then adds the provider role.

Step 3: Territorial Reach and the Article 2 Exclusions

Article 2(1)(a) reaches providers "irrespective of whether those providers are established or located within the Union or in a third country", and Article 2(1)(c) reaches non-EU providers and deployers "where the output produced by the AI system is used in the Union". Recital 22 says "intended to be used in the Union"; the checker applies the article.

A non-EU operator with no Union placing, putting into service or output use gets a result outside the territorial scope. EU deployers, importers and distributors are reached on their own (Article 2(1)(b), (d)). The full test of territorial scope under Article 2 also protects affected persons in the Union (point (g)).

Six exclusions stop or narrow the check: exclusively military, defence or national security purposes (Article 2(3)); third-country authorities in law-enforcement and judicial cooperation with adequate safeguards (2(4)); sole scientific research and development (2(6)); pre-market research and testing, where "Testing in real world conditions shall not be covered by that exclusion" (2(8)); purely personal use by natural persons (2(10)); and open-source licences (2(12)), which never cover high-risk, Article 5 or Article 50 systems.

Step 4: The Article 5 Screen, Including the 2 December 2026 Additions

The checker lists all ten lettered points of Article 5(1): (a), (b) and (c) to (h) apply since 2 February 2025, (ba) and (bb) from 2 December 2026. The additions cover realistic intimate images of an identifiable person without explicit consent (ba) and child sexual abuse material (bb).

A "yes" to any point puts the Article 5 card first, ahead of every other route. The card states that the practice is prohibited to place on the market, put into service or use. Every point of the prohibited AI practices under Article 5 falls in the EUR 35 million or 7 % tier.

Article 5 applies whatever the date on which a system was placed on the market, so question 7 asks no placing date.

Step 5: The High-Risk Routes through Annex I and Annex III

Two routes lead to high-risk status: Annex I products needing third-party conformity assessment (Article 6(1)), with Chapter III Sections 1 to 3 applying from 2 August 2028, and Annex III use cases (Article 6(2)), with those Sections applying from 2 December 2027 (Article 113, third paragraph, point (c)). Since 27 July 2026, systems solely used for non-safety aspects such as user assistance or quality control are not safety components (Article 6(1a)), unless failure would endanger health and safety (Article 6(1b)).

Annex I Section A covers acts such as toys (point 2) and medical devices (point 11). For Section B products, such as motor vehicles (point 18) and machinery (point 21), only Article 6(1), Article 60a and Articles 102 to 112 apply (Article 2(2) as replaced). Annex III lists 8 areas and 25 use cases, unchanged by the Digital Omnibus on AI.

A high-risk route opens the 12 provider duties of Article 16, such as the quality management system (Article 17), and the deployer duties of Article 26, including informing workers before workplace use (Article 26(7)). Public bodies, private entities providing public services and deployers of Annex III point 5(b) and 5(c) systems carry out a fundamental rights impact assessment (Article 27(1)), Annex III point 2 excepted. Breaches of the duties for high-risk AI systems fall in the Article 99(4) tier, up to EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher.

The Article 6(3) Filter and the Profiling Override

An Annex III system is not high-risk where one of four alternative conditions in Article 6(3) applies and it poses no significant risk of harm, but profiling of natural persons is always high-risk. The conditions are (a) a narrow procedural task, (b) improving a previously completed human activity, (c) to "detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review", or (d) a preparatory task to an Annex III assessment.

A provider relying on the filter documents its assessment before placing on the market and registers the system under Article 49(2) (Article 6(4)). The Commission guidelines under Article 6(5) are a draft of 19 May 2026; the 2 February 2026 deadline was missed.

Step 6: Article 50 Disclosure, Marking and Labelling Duties

Article 50 applies since 2 August 2026: providers disclose interaction (50(1)) and mark synthetic content (50(2)); deployers inform (50(3)) and label deep fakes (50(4)). Article 50(4) also covers AI-generated or manipulated text published to inform the public on matters of public interest.

Question 10 adds one card per paragraph that applies. A deep fake is image, audio or video content only (Article 3(60)). Breaches of the transparency obligations under Article 50, for chatbots and deep fakes alike, fall in the Article 99(4) tier.

The only transition is Article 111(4): generative systems placed on the market before 2 August 2026 comply with Article 50(2) by 2 December 2026. The Article 50 guidelines, C(2026) 5054 final of 20 July 2026, are content approved, with formal adoption pending as of 24 October 2026.

Step 7: Model Providers under Chapter V and the 10^25 FLOP Presumption

GPAI model providers carry four Article 53(1) duties since 2 August 2025, and training compute greater than 10^25 FLOP triggers the systemic-risk presumption (Article 51(2)) and Article 55. The duties are technical documentation, information for downstream providers, a copyright policy and a public summary of the training content.

A provider whose model meets the presumption notifies the Commission within two weeks (Article 52(1)). Question 11 records compute, licence and placing date. Among general-purpose AI models, those with systemic risk add four Article 55(1) duties: model evaluation, systemic-risk mitigation, serious-incident reporting and cybersecurity.

Open-source models with public parameters are exempt from Article 53(1)(a) and (b) and Article 54, unless they present systemic risk. Models placed before 2 August 2025 comply by 2 August 2027 (Article 111(3)). Since 2 August 2026 the Commission can fine model providers up to 3 % or EUR 15 000 000, whichever is higher (Article 101(1)); the GPAI Code of Practice of 10 July 2025 is voluntary.

Step 8: Company Size: SME and SMC Relief from Fines and Documentation

The size answer changes three result lines: the fine ceiling (Article 99(6), (6a)), simplified documentation (Article 11(1)) and, for SMEs only, the simplified QMS (Article 63(1)). SMEs (Article 3(14a)) have fewer than 250 persons and turnover up to EUR 50 million and/or a balance sheet up to EUR 43 million; small mid-caps (Article 3(14b)) are not SMEs, have fewer than 750 persons and up to EUR 150 million turnover or EUR 129 million balance sheet.

SME fines are capped at the lower amount in all Article 99 tiers (Article 99(6)), SMC fines only under Article 99(4) and (5) (Article 99(6a)). Among the fines under Articles 99 to 101, Article 101 fines carry no SME reduction.

SMEs and SMCs may file simplified technical documentation (Article 11(1)).

Which Dates Apply to Your Result?

Seven dates decide when a result card applies, from 2 February 2025 to 2 August 2028:

The general date of application, 2 August 2026, does not cover Chapter III Sections 1 to 3. Cards are sorted by date, and each prints the application date of its own provision.

Limits of the Checker: Orientation, Not a Legal Assessment

The checker gives an orientation on what the act requires for the answers given; it does not decide an individual case and is not a legal assessment. A new intended purpose can change the route (Article 25(1), point (c)).

High-risk systems already on the market fall under Article 111(2) only after significant design changes, and those intended for public authorities comply by 2 August 2030; the checker does not compute that status. National laws and other Union law such as the GDPR are not checked.

A result that rests on Article 6(3) needs a recheck once final Article 6(5) guidelines replace the draft.

Where the Checker Ends: The Official Tool and Your Next Steps

The checker ends where an individual assessment begins: at the Commission's tool for a second view and at the compliance programme for the work. A result is the input for both. The step-by-step compliance programme for providers and deployers turns each card into tasks.

The Commission's Official Compliance Checker (Beta)

The Commission's "EU AI Act Compliance Checker" on the AI Act Service Desk is "Currently in its beta version" and "an ongoing project", and its page did not mention Regulation (EU) 2026/1744 as of 24 October 2026. It helps to show which AI Act rules may apply to providers, deployers and other operators.

The official checker takes feedback at CNECT-AIOFFICE@ec.europa.eu. The checker on this page is independent of the Commission and its AI Office (Article 3(47)).

From Checker Result to Compliance Programme

A result covers one AI system or model, so a compliance programme repeats the check for every system the organisation builds or uses. An AI inventory, a term the act does not define, supplies that list.

Each card's duties become work items by role and date, such as the quality management system (Article 17) for providers or human oversight (Article 26(2)) for deployers. The EU AI Act checklist sorts these obligations by role.

EN 18286:2026 is the only harmonised standard cited under the act (Implementing Decision (EU) 2026/2274, OJ L, 14.10.2026). No notified body is listed in NANDO under the AI Act as of 24 October 2026.

EU AI Act Compliance Checker: Related Questions

Article 113, Article 2(12) and the national implementation laws answer the remaining questions about checker results.

Frequently Asked Questions

Is the checker result a legal assessment?

No: the checker gives an orientation and never states that a system is compliant. Each card cites the provision and its date so that counsel can verify it.

Why does the checker show 2 December 2027 and not 2 August 2026?

Regulation (EU) 2026/1744 moved Chapter III Sections 1 to 3 for Annex III systems from 2 August 2026 to 2 December 2027, and for Annex I systems from 2 August 2027 to 2 August 2028. The Commission's "Navigating the AI Act" FAQ (updated 20 October 2026) states: "The rules for high-risk AI systems will apply starting 2 December 2027."

Does a free and open-source licence take a system out of the checker?

Not always: Article 2(12) does not cover high-risk systems or systems under Article 5 or 50. Open-source models with systemic risk keep all their duties.

Does the checker cover national laws that implement the AI Act?

No: it covers the regulation only. National laws implement or supplement it, and the AI Act national competent authorities in all 27 Member States are set out by country with a dated status.

Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.