AI Act compliance
EU AI Act Checklist: Obligations by Role and Risk Class with Deadlines
EU AI Act checklist by role and risk class: provider, deployer, importer and GPAI duties with article and date, from 2 December 2026 to 2 August 2028.
The EU AI Act checklist below turns every duty of Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, into one row per role and risk class, with its article and start date. The high-risk rules of Chapter III Sections 1 to 3 apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c)).
Regulation (EU) 2024/1689 (OJ L, 2024/1689, 12.7.2024) has been in force since 1 August 2024. Regulation (EU) 2026/1744 of 8 July 2026 (OJ L, 2026/1744, 24.7.2026) amended it with effect from 27 July 2026. Every row follows the EU AI Act, Regulation (EU) 2024/1689 as amended.
The rows run from role and risk route to the matrix, one block per role, the start dates and the maximum fines.
How to Use This EU AI Act Checklist: Role, Risk Route, Start Date
Three answers per AI system decide which rows apply: your role, the system's risk route and the date that route starts.
The order of work is a programme question. It runs from AI inventory to monitoring in the EU AI Act compliance programme, the step-by-step order behind these rows.
Step 1: Fix Your Role for Each AI System
The AI Act assigns duties to six operator roles (Article 3(8)): provider, product manufacturer, deployer, authorised representative, importer and distributor.
A provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name or trademark (Article 3(3)).
A deployer uses an AI system under its authority; purely personal non-professional use is excluded (Articles 3(4) and 2(10)). The provider and deployer split decides most rows; the other four AI Act roles carry verification or product duties. One company can hold different roles per system.
Under Article 25(1), a distributor, importer, deployer or other third party becomes the provider of a high-risk system when it brands it, substantially modifies it so that it remains high-risk, or changes its intended purpose so that it becomes high-risk. Establishment outside the Union changes nothing (Article 2(1)).
Step 2: Fix the Risk Route and Its Start Date
Five risk routes carry rows: Article 5, Annex III, Annex I, Article 50 and Chapter V for general-purpose AI models, with Article 4 across all of them.
Annex III lists 8 areas and 25 use cases; Article 6(3) sets four alternative conditions under which an Annex III system is not high-risk, but a system that profiles natural persons is always high-risk. Annex I covers safety components and products under listed legislation requiring third-party conformity assessment (Article 6(1)). How both routes classify high-risk AI systems decides whether the provider and deployer blocks apply.
The Article 6(5) classification guidelines are a draft of 19 May 2026; the Commission announced on 19 May 2026 that the final guidelines will be adopted by the end of 2026. The open-source exclusion (Article 2(12)) never covers high-risk, Article 5 or Article 50 systems.
The Master Matrix: Who Must Do What, from Which Date
The master matrix crosses six roles with five risk routes and Article 4, each column with its start date:
| Role | Article 5 (points (a), (b), (c) to (h) since 2 February 2025; (ba), (bb) from 2 December 2026) | Annex III high-risk (Chapter III Sections 1 to 3 from 2 December 2027) | Annex I high-risk (Chapter III Sections 1 to 3 from 2 August 2028) | Article 50 (since 2 August 2026) | GPAI model (since 2 August 2025) | Article 4 (since 2 February 2025) |
|---|---|---|---|---|---|---|
| Provider | All prohibitions | Article 16, points (a) to (l), with Articles 17 to 21 | Same as Annex III | Article 50(1), (2) | Articles 53 to 55 | Article 4 |
| Deployer | All prohibitions | Articles 26, 27 | Article 26 | Article 50(3), (4) | None | Article 4 |
| Importer | All prohibitions | Article 23 | Article 23 | None | None | None |
| Distributor | All prohibitions | Article 24 | Article 24 | None | None | None |
| Authorised representative | All prohibitions | Article 22 | Article 22 | None | Article 54 | None |
| Product manufacturer | All prohibitions | None | Provider duties under Article 25(3) | None | None | None |
For Annex I Section B products only Articles 6(1), 60a and 102 to 112 apply (Article 2(2) as replaced), so the Annex I column covers Section A products.
An empty cell means, in our reading, that the act sets no row there. The EU AI Act obligations, what each operator must do, are grouped by operator instead.
Rows for Every Operator, Whatever the Risk Class
Three rows reach operators whatever the risk class: Article 4 literacy measures, the Article 5 prohibitions and, for the systems it names, Article 50.
Literacy Measures for Staff, since 2 February 2025
Providers and deployers "shall take measures to support the development of AI literacy" for staff and other persons operating AI systems on their behalf (Article 4(1) as replaced with effect from 27 July 2026). Article 4 requires no specific level for any individual, unlike the wording before 27 July 2026.
National market surveillance authorities supervise it from 2 August 2026 (Commission AI Literacy Q&A, last update 20 October 2026). The AI literacy measures under Article 4, after the 2026 amendment, follow no mandatory format.
Banned Practices, Including the Two Added from 2 December 2026
Every operator screens each system against the ten points of Article 5(1): points (a), (b) and (c) to (h) since 2 February 2025, points (ba) and (bb) from 2 December 2026.
Points (ba) and (bb), with Article 5(1a) and (1b), were inserted by Regulation (EU) 2026/1744 and concern AI-generated intimate images and child sexual abuse material.
In our reading the screen is the same for every role. Each of the prohibited AI practices, every ban including the 2026 additions, falls in the highest fine tier, Article 99(3). No other row can make a failed screen lawful.
Disclosure Duties for Interactive Systems, Generated Content and Deep Fakes
Article 50 applies since 2 August 2026 and splits its rows between providers and deployers:
- Providers of chatbots and other interactive systems disclose the AI interaction (Article 50(1)).
- Providers of generative systems mark synthetic output machine-readably and detectably (Article 50(2)).
- Deployers of emotion recognition or biometric categorisation inform the persons exposed (Article 50(3)).
- Deployers disclose deep fakes (image, audio or video, Article 3(60)) and AI-generated text published to inform the public on matters of public interest (Article 50(4)).
Each row is subject to the exceptions in its paragraph, and the information must be clear and distinguishable at the latest at first interaction or exposure (Article 50(5)).
The Article 50 guidelines are content approved and published on 20 July 2026, and the Code of Practice on Transparency of AI-generated Content was finalised on 10 June 2026 (Article 50(7)). These disclosure duties under Article 50 fall in the Article 99(4) tier.
Generative systems placed on the market before 2 August 2026 comply with Article 50(2) by 2 December 2026 (Article 111(4)).
Checklist for Providers of High-Risk Systems (Annex III and Annex I)
Providers of high-risk systems carry the twelve points of Article 16 (Chapter III Section 3) from the Annex III and Annex I dates of the matrix:
| Row | Article 16 point | Content | Further provision |
|---|---|---|---|
| 1 | (a) | Meet the requirements of Chapter III Section 2 | Articles 8 to 15 |
| 2 | (b) | Indicate name, registered trade name or trade mark and contact address | Article 16(b) |
| 3 | (c) | Have a quality management system | Article 17 |
| 4 | (d) | Keep the documentation | Article 18 |
| 5 | (e) | Keep the automatically generated logs under its control | Article 19 |
| 6 | (f) | Ensure the conformity assessment before placing on the market or putting into service | Article 43 |
| 7 | (g) | Draw up the EU declaration of conformity | Article 47 |
| 8 | (h) | Affix the CE marking | Article 48 |
| 9 | (i) | Comply with the registration obligations | Article 49(1) |
| 10 | (j) | Take corrective actions and provide information | Article 20 |
| 11 | (k) | Demonstrate conformity on reasoned request of a national competent authority | Article 16(k) |
| 12 | (l) | Meet the accessibility requirements of Directives (EU) 2016/2102 and (EU) 2019/882 | Article 16(l) |
Before Placing on the Market: Quality System, Documentation, Conformity Route, CE Marking
Before placing on the market, a provider ticks seven rows: Articles 9 to 15, the Article 17 quality system, technical documentation, the Article 43 assessment, the declaration (Article 47), the CE marking (Article 48) and, for Annex III, registration (Article 49(1)). As of 24 October 2026, EN 18286:2026 on quality management is the only harmonised standard cited (Implementing Decision (EU) 2026/2274); the Commission states that it gives a presumption of conformity for Article 17.
Article 43 sets internal control (Annex VI) for Annex III points 2 to 8, a notified body (Annex VII) for point 1 unless harmonised standards or common specifications were applied in full without restriction, which opens a choice, and the sector procedure for Annex I Section A products (Article 43(3) as replaced). NANDO lists no notified body under the AI Act as of 24 October 2026. The conformity assessment route under Article 43, internal control or a notified body, decides who checks row 6.
Article 49(1) registration covers Annex III systems except point 2, registered at national level (Article 49(5)); Annex I systems are not registered under Article 49.
After Placing on the Market: Logs, Monitoring, Incidents, Corrective Action
After placing on the market, a provider keeps documentation for 10 years (Article 18(1)), keeps logs for at least six months (Article 19(1)), monitors (Article 72) and reports serious incidents (Article 73). Article 73 deadlines run from awareness:
- 15 days for a serious incident (Article 73(2)).
- 2 days for a widespread infringement or a serious disruption of critical infrastructure (Article 73(3)).
- 10 days in the event of the death of a person (Article 73(4)).
Reports go to the market surveillance authorities of the Member States where the incident occurred; an initial incomplete report is allowed (Article 73(1), (5)). The rules on serious incident reporting set deadlines and content.
A non-conforming system is corrected, withdrawn, disabled or recalled at once (Article 20(1)).
Annex III Systems Found Not High-Risk: Document and Register
A provider that concludes under Article 6(3) that its Annex III system is not high-risk documents the assessment before placing on the market or putting into service and registers under Article 49(2) (Article 6(4)). National competent authorities receive the documentation on request.
Checklist for Deployers of High-Risk Systems
Deployers of high-risk systems carry the paragraphs of Article 26 from the same Annex III and Annex I dates:
| Paragraph | Row | Who |
|---|---|---|
| 26(1) | Technical and organisational measures to use the system in line with the instructions for use | Every deployer |
| 26(2) | Human oversight by natural persons with the necessary competence, training and authority, and support | Every deployer |
| 26(4) | Input data relevant and sufficiently representative, to the extent the deployer controls it | Every deployer |
| 26(5) | Monitor operation; inform and suspend on risk; report serious incidents | Every deployer |
| 26(6) | Keep logs under its control for at least six months | Every deployer |
| 26(7) | Inform workers' representatives and affected workers before workplace use | Employers |
| 26(8) | Register the use under Article 49; never use an unregistered system | Public authorities and Union bodies |
| 26(9) | Use the Article 13 information for the data protection impact assessment | Deployers that carry one out |
| 26(10) | Authorisation ex ante or within 48 hours for post-remote biometric identification | Law enforcement |
| 26(11) | Inform natural persons subject to Annex III decisions | Deployers of Annex III systems |
| 26(12) | Cooperate with competent authorities | Every deployer |
| 27 | Fundamental-rights impact assessment | Three deployer groups |
Which Deployers Assess Fundamental-Rights Impact before First Use
Three groups of deployers assess fundamental-rights impact before first use of an Annex III system other than point 2 (Article 27(1)):
- Bodies governed by public law.
- Private entities providing public services.
- Deployers of Annex III point 5(b) (credit scoring) and point 5(c) (life and health insurance pricing) systems.
The fundamental rights impact assessment covers six elements, points (a) to (f) of Article 27(1), and its results go to the market surveillance authority.
Checklist for Importers, Distributors and Authorised Representatives
Importers, distributors and authorised representatives tick verification rows, checking the provider's work (Articles 22 to 24; the grouping is our reading):
| Role | Checks | Keep | Fine tier |
|---|---|---|---|
| Authorised representative (Article 22) | Verify the declaration, technical documentation and conformity assessment; keep documents; provide information and logs on request; cooperate; registration (Article 22(3), points (a) to (e)) | 10 years | Article 99(4), point (b) |
| Importer (Article 23) | Conformity assessment, technical documentation, CE marking with declaration and instructions, authorised representative appointed (Article 23(1), points (a) to (d)); own name and contact address (Article 23(3)) | 10 years | Article 99(4), point (c) |
| Distributor (Article 24) | CE marking, copy of the declaration, instructions for use, provider and importer identification (Article 24(1)); corrective action (Article 24(4)) | No period in Article 24 | Article 99(4), point (d) |
A third-country provider appoints the representative by written mandate before making its high-risk system available (Article 22(1)); the representative ends the mandate if the provider breaches its obligations (Article 22(4)).
Checklist for Model Providers under Chapter V
Providers of general-purpose AI models tick four Article 53(1) rows since 2 August 2025; models placed before that date comply by 2 August 2027 (Article 111(3)). Systemic-risk models add Article 55(1):
| Row | Provision | Content |
|---|---|---|
| Technical documentation | Article 53(1)(a) | At minimum Annex XI, for the AI Office and national competent authorities on request |
| Downstream information | Article 53(1)(b) | At minimum Annex XII, for providers that integrate the model |
| Copyright policy | Article 53(1)(c) | Policy to comply with Union copyright law, including reservations of rights |
| Training-content summary | Article 53(1)(d) | Public summary on the AI Office template |
| Authorised representative | Article 54(1) | Written mandate before placing, for providers established in third countries |
| Notification | Article 52(1) | Within two weeks once the 10^25 FLOP threshold is met or known to be met |
| Systemic-risk rows | Article 55(1), points (a) to (d) | Model evaluation, systemic-risk mitigation, serious-incident reporting, cybersecurity |
For general-purpose AI models, the General-Purpose AI Code of Practice of 10 July 2025, found adequate by Commission Opinion C(2025) 5361 of 1 August 2025, is voluntary and gives no presumption of conformity.
Article 53(2) lifts points (a) and (b) for qualifying free and open-source models without systemic risk, presumed above 10^25 FLOP of cumulative training compute (Article 51(2)).
When Each Checklist Row Starts to Apply, 2025 to 2030
Checklist rows start on nine dates between 2 February 2025 and 31 December 2030:
| Date | Rows that start | Instrument | Before 27 July 2026 |
|---|---|---|---|
| 2 February 2025 | Article 4; Article 5(1), points (a), (b) and (c) to (h) | Article 113, third paragraph, point (a) | |
| 2 August 2025 | Chapter V (Articles 51 to 56); Chapter III Section 4; penalties (Chapter XII, except Article 101) | Article 113, third paragraph, point (b) | |
| 2 August 2026 | General date of application, including Article 50; Article 101 | Article 113, second paragraph | |
| 2 December 2026 | Article 5(1), points (ba) and (bb), 5(1a), 5(1b); legacy generative systems comply with Article 50(2) | Article 113, third paragraph, point (a), as amended; Article 111(4) | |
| 2 August 2027 | GPAI models placed before 2 August 2025 comply | Article 111(3) | |
| 2 December 2027 | Annex III high-risk: Chapter III Sections 1 to 3 (except Article 6(5)) | Article 113, third paragraph, point (c)(i) | 2 August 2026 |
| 2 August 2028 | Annex I high-risk: Chapter III Sections 1 to 3 (except Article 6(5)) | Article 113, third paragraph, point (c)(ii) | 2 August 2027 |
| 2 August 2030 | High-risk systems intended to be used by public authorities under Article 111(2) comply | Article 111(2) | |
| 31 December 2030 | Annex X components placed before 2 August 2027 comply | Article 111(1) |
The Commission "Navigating the AI Act" FAQ (last update 20 October 2026) confirms: "The rules for high-risk AI systems will apply starting 2 December 2027." The full timeline of every application date from 2024 to 2030 adds milestones that start no row.
The last column shows the dates before the Digital Omnibus on AI, Regulation (EU) 2026/1744.
What Missing a Row Costs: Article 99 and Article 101 Maximums
Most rows map to a maximum fine: up to EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher, for Article 5 (Article 99(3)) and up to EUR 15 000 000 or 3 % for the Article 99(4) rows. Article 99 sets the maxima that national penalty rules must provide for (Article 99(1)):
| Infringement | Maximum | Provision |
|---|---|---|
| Prohibited practices (Article 5) | EUR 35 000 000 or 7 % of total worldwide annual turnover, whichever is higher | Article 99(3) |
| Articles 16, 22, 23, 24, 25(2) and (4), 26 and 50; notified-body duties under Articles 31, 33(1), (3), (4) and 34 | EUR 15 000 000 or 3 % of total worldwide annual turnover, whichever is higher | Article 99(4) |
| Incorrect, incomplete or misleading information | EUR 7 500 000 or 1 % of total worldwide annual turnover, whichever is higher | Article 99(5) |
| GPAI model providers | 3 % of annual total worldwide turnover or EUR 15 000 000, whichever is higher | Article 101(1) |
| SMEs, including start-ups | The lower of the amount or the percentage, in every Article 99 tier | Article 99(6) |
| Small mid-cap enterprises | The lower of the amount or the percentage, for Article 99(4) and (5) only | Article 99(6a) |
| Article 4 literacy, Article 27 FRIA | No EU amount; penalties are left to national rules | Article 99(1) |
Chapter XII applies since 2 August 2025; the Commission (IP/26/1714, 31 July 2026) announced enforcement by the AI Office and national authorities from 2 August 2026. Article 101 fines carry no SME reduction. Within the caps, the maximums under Articles 99 to 101 are set from factors such as gravity, duration and size (Article 99(7)).
The small mid-cap relief of Article 99(6a) was inserted by Regulation (EU) 2026/1744.
What This EU AI Act Checklist Does Not Decide
The checklist lists what the act requires per role and route; it neither classifies an individual system nor replaces a pending Commission document.
Classification depends on the intended purpose and Article 6, where the checklist stops. What to do first is set out in the step-by-step compliance programme.
Pending Commission Guidance, Templates and Forms
Five Commission documents that shape how rows are ticked are pending or drafts as of 24 October 2026:
- Guidelines on high-risk classification under Article 6(5): draft of 19 May 2026.
- Post-market monitoring guidance with a voluntary template (Article 72(3)): due by 2 September 2027.
- Serious-incident guidance (Article 73(7)): draft of 26 September 2025; the statutory date of 2 August 2025 was missed.
- FRIA template questionnaire (Article 27(5)): pending.
- Simplified technical documentation form (Article 11(1)): pending.
Each document shapes how a row is filled, not whether it applies.
The dated register of EU AI Act guidelines, implementing and delegated acts shows which documents exist and in which version.
Orientation, Not a Legal Assessment
The checklist gives an orientation, not a legal assessment of a particular AI system.
EU AI Act Checklist: Related Questions
Articles 11(1), 63, 99(6a), 26(9) and 27(4) answer the remaining questions.
How Does the Checklist Relate to the Compliance Checker?
The checker asks the role and risk-route questions; the checklist shows the rows those answers switch on. The EU AI Act compliance checker answers role and risk class first, with no "compliant" verdict. The Commission Service Desk checker states: "Currently in its beta version, the Compliance Checker represents an ongoing project" (checked 24 October 2026).
Do SMEs and Small Mid-Caps Tick Fewer Rows?
No: SMEs and small mid-caps tick the same rows, but some rows are lighter and fines are capped lower.
Both may provide simplified technical documentation (Article 11(1)), and SMEs without partner or linked enterprises may keep a simplified quality system (Article 63(1)), while Articles 9 to 15, 72 and 73 still apply (Article 63(2)).
Does the Checklist Cover the GDPR Checks Too?
No: the checklist covers AI Act rows only, but Articles 26(9) and 27(4) point to the GDPR data protection impact assessment. The comparison AI Act vs GDPR shows where the two overlap. Since 27 July 2026, a fundamental-rights impact assessment may cross-refer to that assessment (Article 27(4)).
Frequently Asked Questions
Do the high-risk rows apply already?
No: Chapter III Sections 1 to 3 apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744.
Does a deployer affix the CE marking?
No: the CE marking is a provider row (Articles 16(h) and 48).
How long must logs and documentation be kept?
Logs at least six months (Articles 19(1) and 26(6)); documentation and the declaration 10 years (Articles 18(1) and 47(1)), as for copies held by authorised representatives and importers (Articles 22(3)(b) and 23(5)).
Is a certificate required for the AI literacy row?
No: Article 4 requires measures, not a guaranteed level of literacy, and the Commission AI Literacy Q&A states: "There is no need for a certificate."
Compiled by the AIActGuide.net Editorial Team from the Official Journal text; how we check every statement: methodology.
Sources
- EUR-Lex: Regulation (EU) 2024/1689
- EUR-Lex: Regulation (EU) 2026/1744
- EUR-Lex: CELEX 02024R1689
- European Commission: ai-act-service-desk.ec.europa.eu/en/ai-act/article-16
- European Commission: ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
- European Commission: ai-act-service-desk.ec.europa.eu/en/ai-act/article-27
- European Commission: ai-act-service-desk.ec.europa.eu/en/ai-act/article-73
- European Commission: ai-act-service-desk.ec.europa.eu/en/ai-act/article-99
- European Commission, digital strategy: digital-strategy.ec.europa.eu/en/faqs/navigating-ai-act
- European Commission, digital strategy: digital-strategy.ec.europa.eu/en/news/consultation-guidelines-high-risk
- EUR-Lex: eur-lex.europa.eu/eli/dec_impl/2026/2274/oj
- European Commission: webgate.ec.europa.eu/single-market-compliance-space/notified-bodies
- European Commission: ai-act-service-desk.ec.europa.eu/en/eu-ai-act-compliance-checker