Your Progress: 0 / 0 items

August 2026 Deadline

EU AI Act Compliance Checklist 2026: Step-by-Step Implementation Guide

The EU AI Act compliance checklist on this page walks organisations through every requirement in four manageable implementation phases — from initial scoping through to EU database registration. Every item includes a one-sentence “How to comply” tip and a direct article reference.

Use the interactive checkboxes to track your progress. Your state is saved automatically in your browser — come back anytime and pick up where you left off.

TL;DR — Key Facts

1 The primary deadline is 2 August 2026. High-risk AI systems listed in Annex III must be fully compliant — conformity assessments, documentation, human oversight, and EU database registration all complete.
2 Compliance obligations differ by role. Providers (builders) carry the heaviest burden. Deployers (users) have distinct but significant duties. Many organisations are both — especially those that customise third-party AI tools.
3 Non-compliance fines reach €35M or 7% of global turnover. This checklist covers all four implementation phases — from initial classification through EU database registration — in the logical order a compliance team should work through them.

↓ Download PDF Checklist Not sure if you’re High-Risk? Take the 2-min Assessment →

Quick Tool

Not sure if your AI system is High-Risk?

Answer 5 questions about your AI system’s use case and we’ll tell you exactly which EU AI Act tier applies — and which sections of this checklist are mandatory for you.

Take the 2-Minute Assessment →

Implementation Phases

1 Scoping & Classification 2 Gap Analysis 3 Technical Implementation 4 Registration & Filing

⚡ August 2026 Priority Items Deployer-Only Items GPAI Model Items FAQ

⚡ August 2026 Priority Items — Act on These First

With the 2 August 2026 deadline approaching, these four items have the longest lead times and must be started immediately. They appear in full detail in the phases below — this is your fast-track list.

① Appoint an Authorised Representative

Mandatory for all non-EU providers (US, UK, etc.) before placing high-risk AI on the EU market. Allow 4–8 weeks to identify, contract, and register. Art. 22

② Establish Human-in-the-Loop (HITL)

Document exactly how a human can monitor, intervene, override, or halt the AI’s decisions in real-time. Must be built into system design. Art. 14

③ Create Your Annex IV Technical Documentation

Compile the “Living Document” covering system architecture, training data, testing methodology, accuracy metrics, and limitations. Takes 3–6 months for complex systems. Art. 11 + Annex IV

④ Register in the EU AI Database

Final mandatory step for all Annex III high-risk systems before EU market placement. Requires completed conformity assessment and Declaration of Conformity. Art. 49

Phase 4 of 4

Registration & Filing

Complete formal compliance filings — conformity assessment, Declaration of Conformity, CE marking, and EU AI database registration. These steps gate your legal right to place the system on the EU market.

Step 4A — Conformity Assessment (Art. 43)

Conduct a conformity assessment for each high-risk AI system, verifying compliance with all Articles 8–15 requirements Art. 43 How to comply: Most Annex III systems can use internal self-assessment based on your completed technical documentation, RMS, and QMS. Work through each Article 8–15 requirement systematically and record your compliance evidence. Appoint a senior internal reviewer to sign off the assessment — this person takes responsibility for its accuracy.

For biometric identification systems and high-risk AI in Annex I products: engage an accredited Notified Body for third-party conformity assessment Art. 43(1) How to comply: Identify a Notified Body accredited for your product category through the EU’s NANDO database. Engage them at least 6 months before your target market placement date — Notified Bodies have limited capacity and significant lead times. Budget for this cost in your compliance programme.

Step 4B — Declaration of Conformity and CE Marking (Art. 47–48)

Prepare and sign the EU Declaration of Conformity (DoC) for each high-risk AI system Art. 47 How to comply: The DoC must contain: provider identity and contact details; AI system name and description; statement that the system meets all applicable requirements; reference to standards applied; place and date of issue; and authorised signatory name and title. A template is available in Annex V of the regulation.

Affix CE marking to high-risk AI systems that are standalone products or components of regulated products Art. 48 How to comply: CE marking must be affixed visibly and legibly to the AI system (or to its packaging and accompanying documentation if the system has no physical form). If the AI is integrated into an Annex I regulated product, the CE marking for the overall product covers the AI component provided the AI’s conformity assessment is complete.

Step 4C — EU AI Database Registration (Art. 49)

Register each high-risk Annex III AI system in the EU AI Act database before placing it on the EU market Art. 49 PRIORITY How to comply: Access the EU AI Office’s registration portal and submit: provider identity, system name and description, intended purpose, geographic scope of deployment, a summary of the conformity assessment, and the Declaration of Conformity reference number. Retain the registration confirmation and unique identification number for your records.

If you are a deployer of high-risk AI in public-service or regulated contexts: register your deployment in the EU AI database Art. 49(2) How to comply: Deployers using high-risk AI systems in areas such as law enforcement, migration, judicial administration, and education must register their specific deployment. This is separate from the provider’s registration. Check with your national competent authority for the applicable registration procedure in your member state.

Step 4D — Post-Market Obligations (Art. 72–73)

Activate your post-market monitoring system and begin systematic performance data collection from day of deployment Art. 72 How to comply: Implement your PMM plan (prepared in Phase 3). Set up automated dashboards tracking your defined KPIs. Schedule quarterly PMM review meetings with your AI governance team. Report any material deviation from documented performance benchmarks to your senior leadership immediately.

Establish a serious incident reporting procedure meeting the 15-day notification requirement Art. 73 How to comply: Define “serious incident” criteria aligned with Article 3(49) (death, serious injury, critical infrastructure disruption, fundamental rights breach). Train your operations team to escalate potential serious incidents immediately. The 15-day clock starts from when your organisation first becomes aware — internal escalation delays count against this window.

Maintain all technical documentation, conformity assessment records, and Declaration of Conformity for 10 years after market placement Art. 18 How to comply: Set up a document retention schedule in your document management system locking all compliance records for a minimum 10-year period. Include this retention requirement in your QMS. National market surveillance authorities can request these documents at any time during the retention period.

Role-Specific

Deployer-Specific Obligations

These items apply specifically to organisations using (but not building) high-risk AI systems. They apply in addition to the Phase 1–4 items above.

Verify that each high-risk AI system you deploy has a completed conformity assessment and valid Declaration of Conformity from the provider Art. 26(1) How to comply: Request the DoC and conformity assessment summary from every vendor supplying high-risk AI before August 2026. Non-provision is a red flag — a vendor unable to supply these documents should be treated as non-compliant and your deployment of their system creates regulatory exposure.

Use each high-risk AI system only within the scope, purpose, and conditions specified by the provider in the Instructions for Use Art. 26(1) How to comply: Maintain a copy of each vendor’s Instructions for Use and circulate the relevant sections to operational teams. Implement controls preventing use of the AI for undocumented purposes — this can be as simple as internal usage policies with manager sign-off required for any novel deployment context.

Implement the human oversight measures specified by the provider and ensure designated oversight personnel are adequately trained Art. 26(2) How to comply: Take the oversight requirements from the provider’s Instructions for Use and translate them into internal procedures. Assign a named Oversight Officer per system. Run tabletop exercises simulating AI decision anomalies to verify your override and escalation procedures actually work in practice.

Maintain use logs for each high-risk AI system for a minimum of 6 months from the date of each logged interaction Art. 26(5) How to comply: Configure your systems (or request vendor configuration) to generate and retain logs per Article 12. Store logs in a location accessible to your compliance and legal team. Build a log review into your quarterly AI governance review cycle.

Where AI makes or significantly influences decisions affecting individuals, implement and document the right to explanation and the complaint procedure Art. 26(10) How to comply: Establish a documented procedure for individuals to request an explanation of an AI-assisted decision affecting them (e.g. credit denial, job rejection). Define who reviews these requests, within what timeframe, and how outcomes are communicated. Align with your GDPR Article 22 procedure if one exists.

Role-Specific

GPAI Model Provider Obligations

These items apply to organisations that develop or release General Purpose AI models (foundation models, large language models). Obligations applied from 2 August 2025.

Prepare and maintain technical documentation of your GPAI model’s training methodology, capabilities, and limitations Art. 53(1)(a) How to comply: Document training data sources and volumes, training compute (FLOPs), architecture type, evaluation benchmarks, known limitations and failure modes, and safety testing results. This documentation must be available to the EU AI Office on request.

Publish a summary of training data content sufficient for downstream providers to understand and assess the model Art. 53(1)(d) How to comply: Publish a training data summary (model card or similar) covering: data categories used, geographic representation, data cutoff dates, and any significant exclusions. This does not require disclosing proprietary datasets in detail — a structured summary at category level is sufficient.

Implement and document a copyright compliance policy covering training data, ensuring compliance with EU copyright law (Article 4 DSM Directive) Art. 53(1)(c) How to comply: Establish a data sourcing policy requiring copyright review before any web-scraped or licensed dataset is used in training. Document rights clearances, opt-out mechanism compliance (for TDM opt-outs under DSM Directive Art. 4), and any licence agreements covering training data use.

If your model meets the systemic risk threshold (training compute exceeding 10²⁵ FLOPs): notify the EU AI Office and complete adversarial testing (red-teaming) Art. 51–55 How to comply: Submit a notification to the EU AI Office’s designated contact point. Commission adversarial testing against capability thresholds defined by the AI Office. Engage independent red-teamers covering at minimum: harmful content generation, CBRN risk uplift, and cybersecurity capability testing. Report serious incidents within 15 days of discovery.

Download the Complete Checklist as PDF

All four phases, every checklist item with “How to comply” tips, article references, and the August 2026 priority items — formatted for print and team distribution. Free to download.

↓ Download PDF Checklist

EU AI Act Compliance Checklist — FAQ

Common questions from legal, technical, and operations teams working through EU AI Act implementation.

Where do I start if I have never done any EU AI Act compliance work? +

Start with Phase 1 — Scoping & Classification. Build your AI System Inventory first: list every AI tool your organisation develops or uses. Then classify each against the prohibited practices (Article 5) and Annex III high-risk categories. Only once you know which of your systems are in scope can you plan the work required. This classification step alone typically takes 2–4 weeks for a medium-sized organisation with 10–30 AI systems.

How long does EU AI Act compliance realistically take? +

For a single high-risk AI system, a well-resourced compliance team should expect 4–9 months end-to-end: 2–4 weeks for scoping and classification, 4–8 weeks for gap analysis, 3–6 months for technical documentation and implementation, and 4–8 weeks for conformity assessment and registration. Organisations with multiple high-risk systems running in parallel can compress this timeline but need more resources. Given the August 2026 deadline, organisations should target internal completion by April 2026 at the latest to allow buffer time for unforeseen issues.

Do I need a dedicated AI compliance officer? +

The EU AI Act does not require a specific “AI Compliance Officer” role by name, but practically speaking, large organisations with multiple high-risk AI systems need a dedicated lead. Smaller organisations can often manage compliance with a part-time programme owned by the legal, data protection, or technology team. In all cases, clear ownership is essential — compliance programmes without a named accountable person consistently fall behind. Whoever leads the programme needs both legal and technical fluency, or access to both disciplines.

What is the difference between a conformity assessment and a Fundamental Rights Impact Assessment? +

A conformity assessment (Article 43) is a technical and procedural verification that a high-risk AI system meets the Act’s mandatory requirements — done by the Provider before market placement. It covers data governance, documentation, accuracy, human oversight, cybersecurity, and the QMS. A Fundamental Rights Impact Assessment (Article 27) is a separate assessment done by the Deployer before deploying a high-risk AI system in a regulated public-service or essential-services context. It evaluates the system’s potential impact on individuals’ fundamental rights — not its technical compliance. Both are required, by different parties, at different stages.

Can I use an existing ISO 9001 or ISO 27001 QMS to meet Article 17 requirements? +

Yes — partially. An existing ISO 9001 QMS provides a strong foundation for Article 17 compliance and can significantly reduce the work required. However, you will need to extend it with AI-specific procedures that ISO 9001 does not cover: AI-specific risk management integrated with Article 9, AI system testing protocols, bias detection procedures, and post-market AI monitoring. ISO 42001 (the AI Management System standard published in 2023) is specifically designed to bridge this gap and aligns closely with Article 17 requirements. Organisations already holding ISO 27001 for information security will also find strong overlap with the cybersecurity requirements of Article 15.

What happens if I miss the August 2026 deadline? +

From 2 August 2026, national market surveillance authorities are empowered to enforce the Act against non-compliant high-risk AI systems. Missing the deadline does not mean you must immediately withdraw your system — enforcement will be risk-prioritised and authorities are likely to focus first on the highest-risk sectors. However, you will be operating in violation of EU law and exposed to fines of up to €15 million or 3% of global turnover per violation. Your system may be ordered withdrawn from the EU market. Critically, you will also face reputational and contractual risk with EU clients who have their own compliance obligations and need their AI vendors to be compliant. The safest position is to have a documented compliance programme underway even if not fully complete by the deadline.

Where can I find official EU AI Act compliance guidance and standards? +

The primary authoritative sources are: the full regulation text on EUR-Lex; the EU AI Office guidance documents; the ISO 42001 AI Management System standard; and CEN-CENELEC harmonised standards for AI (which, when cited in the Official Journal, create a presumption of conformity). The NIST AI RMF and OECD AI Principles are internationally recognised complementary frameworks.

Martina Fowler

EU AI Act Expert

Senior AI Regulatory Counsel & Lead Author, EU AI Act Guide

Martina Fowler is a senior AI regulatory counsel with over a decade of experience advising multinational organisations on technology law, data governance, and EU digital policy. She has closely tracked the EU AI Act since the Commission’s initial proposal in April 2021 and has guided dozens of enterprises through risk classification, conformity assessment design, and cross-border compliance strategy. Martina holds an LL.M. in European Law from KU Leuven and is a frequent speaker at EU policy forums on AI regulation and fundamental rights. Her work at EU AI Act Guide focuses on translating complex legislative text into actionable compliance frameworks for legal, technical, and business audiences.

[email protected]