An EU AI Act compliance checklist, built from the Articles rather than from opinion

Standfirst: The EU AI Act is a scope-and-classification statute. Every compliance question it raises resolves to a specific Article, and a checklist that cannot name the Article behind each question is a marketing document, not a compliance tool. Here is the sequence, question by question, with the citation that makes each one a question.

Can an EU AI Act checklist replace reading the Articles?

A checklist is a triage tool. It tells you which parts of the Regulation demand a closer read. It does not replace that read, and it is not legal advice. Where this article summarizes an Article, the Article text governs. Where the two differ, you were misled by the summary. Read the summary, then read the source.

Step 1: Does the EU AI Act apply to you under Article 2?

Before anything else, ask whether the Regulation reaches you. Article 2(1) casts a wide net:

• Do you place AI systems or general-purpose AI models on the market in the Union, or put AI systems into service there? You are covered even if you are established in a third country (Article 2(1)(a)).
• Are you a deployer established or located in the Union (Article 2(1)(b))?
• Are you a provider or deployer in a third country whose system's output is used in the Union (Article 2(1)(c))? This is the extraterritorial hook most non-EU organizations miss.
• Are you an importer, distributor, product manufacturer, or authorized representative (Article 2(1)(d) to (f))?

Then ask whether an exclusion applies. Article 2(3) excludes systems used exclusively for military, defence or national security purposes. Article 2(6) excludes systems developed and put into service for the sole purpose of scientific research and development. Article 2(8) excludes pre-market research, testing and development activity, but testing in real-world conditions is not covered by that exclusion. Article 2(10) excludes natural persons using AI in a purely personal, non-professional activity. Article 2(12) excludes free and open-source AI systems, unless they are placed on the market or put into service as high-risk systems or fall under Article 5 or Article 50. Note the shape of that last one: open-source licensing is not an exit from the prohibited-practices and transparency rules.

Step 2: Is your AI practice banned under Article 5?

If a practice appears in Article 5(1), classification analysis is irrelevant. The practice is banned. Each prohibition carries its own limiting language, and the exam-worthy skill is knowing where each threshold sits.

Points (ba) and (bb) were inserted by Regulation (EU) 2026/1744 and apply from 2 December 2026. Article 5(1a) limits them: placing such a system on the market is prohibited only where that output is its intended purpose, or a reasonably foreseeable and reproducible outcome that the system has no adequate safeguards to prevent, and use is prohibited only where the deployer uses the system for that purpose. State the thresholds in the Article's own terms. Do not paraphrase them into something looser. The Article 5(1)(h) exceptions come with machinery of their own: prior authorization by a judicial or independent administrative authority under Article 5(3), with a 24-hour window for urgent cases begun without authorization.

Step 3: Is your system high-risk under Article 6 and Annex III?

Article 6 gives two routes into high-risk status. Ask both questions:

1. Is the system a safety component of a product, or itself a product, covered by the Union harmonisation legislation in Annex I, and does that product require third-party conformity assessment (Article 6(1))? Both conditions must hold.
2. Does the system appear in a use case listed in Annex III (Article 6(2))?

Since July 2026, Article 6(1a) to (1c) narrow the first route. AI systems used solely for non-safety aspects such as user assistance, performance optimisation, service efficiency, automation, convenience or quality control are not safety components, unless their failure or malfunction would endanger health and safety. A product that needs third-party conformity assessment only for risks other than health and safety, such as radio spectrum, does not meet the Article 6(1)(b) condition.

Then ask whether the Article 6(3) derogation applies. An Annex III system escapes high-risk status if it does not pose a significant risk to health, safety or fundamental rights, and it meets any one of 4 conditions: it performs a narrow procedural task, it improves the result of a previously completed human activity, it detects decision-making patterns without replacing human assessment, or it performs a preparatory task. But the derogation has a hard stop:

Notwithstanding the first subparagraph, an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons.

One more question the derogation raises: did you document the assessment? Article 6(4) requires a provider who concludes an Annex III system is not high-risk to document that assessment before placing the system on the market, register under Article 49(2), and produce the documentation on request. An undocumented derogation is not a derogation.

Step 4: Does your high-risk system meet Articles 9, 10, 13, 14 and 15?

For each high-risk system, ask:

Risk management (Article 9). Is there an established, implemented, documented and maintained risk management system? Article 9(2) frames it as a continuous iterative process across the entire lifecycle, covering known and reasonably foreseeable risks under intended purpose, risks under reasonably foreseeable misuse, and risks surfaced by post-market monitoring under Article 72. Article 9(5) requires residual risk, per hazard and overall, to be judged acceptable.

Data (Article 10). Article 10 covers data and data governance. A high-risk system trained on data must be developed on training, validation and testing data sets that meet the quality criteria in paragraphs 2 to 5. Read the Article itself before relying on any summary of it, including that one.

Transparency to deployers (Article 13). Does the system's operation let deployers interpret its output and use it appropriately? Are there instructions for use containing, at minimum, the Article 13(3) items: provider identity, intended purpose, the tested level of accuracy, robustness and cybersecurity referred to in Article 15, foreseeable risk circumstances, and the human oversight measures under Article 14?

Human oversight (Article 14). Can natural persons effectively oversee the system while in use? Article 14(4) requires that the persons assigned oversight can understand the system's capacities and limits, remain aware of automation bias, correctly interpret output, decide not to use the system or override its output, and intervene or halt the system safely. For systems under point 1(a) of Annex III, Article 14(5) adds a stricter rule: no action or decision on the basis of the identification unless separately verified and confirmed by at least 2 natural persons with the necessary competence, training and authority.

Accuracy, robustness and cybersecurity (Article 15). Article 13 confirms these are the performance dimensions against which the system must be tested and validated. The detail sits in Article 15 itself.

Step 5: What must providers and deployers do under Articles 16 and 26?

The Act allocates duties by role, and misidentifying your role is the fastest route to the wrong checklist.

If you are a provider of a high-risk system, Article 16 asks: is the system compliant with Section 2? Do you have a quality management system under Article 17? Have you kept the Article 18 documentation and the Article 19 logs? Has the system passed the Article 43 conformity assessment before placing on the market? Have you drawn up the EU declaration of conformity (Article 47), affixed the CE marking (Article 48), registered under Article 49(1), and can you demonstrate conformity to a national competent authority on reasoned request?

If you are a deployer of a high-risk system, Article 26 asks: are you using the system in accordance with its instructions for use? Have you assigned human oversight to persons with the necessary competence, training, authority and support? Where you control input data, is it relevant and sufficiently representative? Are you monitoring operation, informing the provider and market surveillance authority of risks, and suspending use where Article 79(1) risk arises? Are you keeping automatically generated logs under your control for at least 6 months (Article 26(6))? If you are an employer, have you informed workers' representatives and affected workers before putting the system into use at the workplace (Article 26(7))? Public authority deployers must also verify the system is registered in the EU database before using it (Article 26(8)).

Step 6: When do the Article 50 transparency duties apply?

These apply regardless of risk class. Ask four questions:

• Does the system interact directly with natural persons? Then they must be informed they are dealing with AI, unless that is obvious to a reasonably well-informed, observant and circumspect person (Article 50(1)).
• Does the system generate synthetic audio, image, video or text? Then outputs must be marked in a machine-readable format and detectable as artificially generated (Article 50(2)).
• Are you deploying an emotion recognition or biometric categorisation system? Then you must inform the persons exposed to it (Article 50(3)).
• Are you deploying a system generating deep fakes, or AI text published to inform the public on matters of public interest? Then disclosure is required, with carve-outs for artistic works and for text under human editorial responsibility (Article 50(4)).

Article 50(5) fixes the timing: the information must reach the person no later than the first interaction or exposure. Our Article 50 guide covers each duty and its exceptions.

Step 7: Which rules apply to general-purpose AI model providers?

Chapter V of the Regulation governs general-purpose AI models, and its first section sets classification rules. Article 51 sets when a general-purpose AI model counts as a model with systemic risk. Article 53 sets what every provider of a general-purpose AI model must do: keep technical documentation, give information to the providers who build on the model, put a copyright policy in place and publish a summary of the content used for training. If GPAI is your business, Chapter V is the chapter you read in full, and note from Step 8 that it applies earlier than the general date. Our guide to general-purpose AI model duties sets them out.

Step 8: When do your EU AI Act obligations start under Article 113?

The Regulation, done at Brussels on 13 June 2024 and published in the Official Journal on 12 July 2024, entered into force on the 20th day after publication. It applies in stages, as amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026:

Our guide to every EU AI Act date and fine tier has the detail behind each date.

In what order should you run an EU AI Act compliance check?

Work through the steps in order, because the Act does: scope kills the analysis fastest, prohibition kills it hardest, and classification determines everything downstream. On the exam, this material shows up as the ability to place a described system into the right box and name the obligations that follow from that placement, by role and by Article. If you can walk a fact pattern through these eight steps without looking anything up, and you know which Article you would check when you are unsure, you have done the preparation this checklist exists to structure. Then go read the Articles, because they are what governs, and they are what you will be tested on.

Want it in one place? The EU AI Act compliance guide works through EU AI Act compliance from the Official Journal text of Regulation (EU) 2024/1689, with every obligation traced to its Article, and the EU AI Act case study book takes 24 situations a governance lead faces under the AI Act and works each one to a decision, settled against the Articles by number.

Frequently asked questions

Is there an official EU AI Act compliance checklist?

No. The Regulation sets obligations; it does not publish a checklist. Any checklist, including this one, is a triage tool built from the Articles, and the Article text governs.

Where do I start?

Article 2, scope. If the Regulation does not reach your organization, nothing downstream applies. If it does, Article 5 next, because a prohibited practice is not a compliance problem to manage but a system you cannot place on the market.

Which books go deeper on this?

AI Governance Framework

Building one that survives the EU AI Act. 22 chapters, 416 pages.

What is insideBuy on Amazon

AI Governance Worked Scenarios

24 worked situations under the EU AI Act, decided against the Articles. 81 pages.

What is insideBuy on Amazon