AI Act: questions to assess your obligations

Deadline: Parts applicable from 2.2.2025; general applicability 2.8.2026. Chapter III Sections 1–3 (except Art. 6(5)) apply from 2.12.2027 (Annex III) and 2.8.2028 (Annex I) under Art. 113 as amended by Regulation (EU) 2026/1744; also check the Art. 111 transitional rules.

Part A: AI Act Compliance

Use this checklist after recording the system’s intended purpose, your legal role and applicable date. A3–A7, A9–A12 and A15–A17 mainly address high-risk providers, not every user of a GPAI API. Deployer duties are in Article 26; A13 has the specific Article 27 scope. A1/A2 are preparation methods; A14 is supplier governance with separate GDPR triggers. An Annex IV template needs system-specific evidence and review; it is not a complete technical file or a guarantee of auditor acceptance.

The references identify requirements to assess, not a universal list of mandatory methods. Terms such as system owner, drift testing and the listed log fields are implementation examples. Articles 43, 49, 72 and 73 are outside Chapter III Sections 1–3: do not infer their applicable dates from that deferral alone; determine the route and Article 111 transition for the system.

#	Activity	Reference	Phase	Description
A1	AI Inventory	Art. 2, 3	Preparation	List all AI/ML systems (in-house, third-party, embedded)
A1.1	— Internal AI systems	Art. 3(1)	Preparation	Data pipeline, recommender, fraud detection
A1.2	Third-party AI systems and models	Art. 3(1), (63)	Preparation	Distinguish the AI system or service used from the underlying GPAI model; assess definitions and role
A1.3	— Embedded AI	Art. 3(1)	Preparation	AI in product for end-users (incl. open-source)
A2	Classification	Arts. 5, 6, 50; Annexes I and III	Analysis	Assess prohibitions and high-risk status; assess Art. 50 separately, including overlap
A2.1	Prohibited practices	Art. 5	Analysis	Assess exact conditions and exceptions; emotion recognition at work/in education is restricted, not every use involving children
A2.2	High-risk AI	Art. 6; Annexes I and III	Analysis	Specific purposes in Annex III; product/safety-component route subject to all Art. 6(1)–(1c) conditions
A2.3	GPAI role assessment	Arts. 3, 25, 53–55	Analysis	Distinguish model provider, downstream system provider and deployer; RAG alone does not decide the role
A3	AI Governance & QMS	Art. 16, 17	Governance	Quality Management System for AI
A3.1	— AI Policy document	Art. 17(1) (QMS written policies); otherwise recommended governance	Governance	Policy: How we use AI, roles, approval process
A3.2	— AI governance structure	Art. 17	Governance	Responsibilities, roles, reporting lines
A3.3	Accountability framework	Art. 17(1)(m)	Governance	Allocate responsibilities; a system owner is one implementation approach
A4	Risk Management System	Art. 9	Implementation	Risk management for high-risk AI
A4.1	— Risk identification	Art. 9(2)(a)	Implementation	Identify risks for each high-risk AI
A4.2	— Risk mitigation	Art. 9(2)(d)	Implementation	Mitigation measures
A4.3	— Residual risk assessment	Art. 9(5)	Implementation	Acceptance of residual risks
A5	Data Governance	Art. 10	Implementation	Training data quality, representativeness, completeness
A5.1	Training, validation and test data quality	Art. 10(3)	Implementation	Relevant, sufficiently representative and, to the best extent possible, error-free and complete for the intended purpose
A5.2	— Data bias assessment	Art. 10(2)(f)	Implementation	Assessment of potential biases in data
A5.3	Data governance procedures	Art. 10(2); special categories under Art. 4a	Implementation	Document collection, preparation, suitability and gaps; Art. 4a processing is exceptional, strictly necessary and subject to all its conditions and safeguards
A6	Technical Documentation	Arts. 11, 18; Annex IV	Documentation	System-specific technical file; provider retention: 10 years after placement on the market or putting into service
A6.1	— Model documentation	Art. 11, Annex IV	Documentation	Architecture, training process, performance
A6.2	Testing results	Art. 11; Annex IV	Documentation	Testing results, benchmarks and their limitations
A6.3	Incident and corrective-action record	Arts. 20, 72, 73	Documentation	Record incidents, investigation and corrective action for the applicable role
A7	Logging & Record-Keeping	Art. 12, 19	Implementation	Automatic logging of AI system operations
A7.1	Automatic logging	Art. 12(1)–(3)	Implementation	Log events relevant to traceability and the applicable system-specific requirements; no blanket requirement to store every input/output
A7.2	Log retention	Arts. 19, 26(6)	Implementation	Automatically generated logs under the actor’s control: appropriate period, at least 6 months unless other applicable law provides otherwise
A8	Transparency	Arts. 13, 26(11), 50	Implementation	Distinguish instructions and interpretability for deployers from information to affected persons; apply the relevant role, trigger and exceptions
A8.1	AI interaction disclosure	Art. 50(1)	Implementation	Providers inform natural persons unless obvious in context; assess the statutory law-enforcement exception
A8.2	— Instructions for use	Art. 13	Implementation	Documentation for deployers
A9	Human Oversight	Art. 14	Implementation	Risk-proportionate human oversight measures for high-risk AI
A9.1	Override capability	Art. 14(4)(d)	Implementation	Ability to disregard, override or reverse the output; where appropriate and proportionate under Art. 14(4)
A9.2	— Stop mechanism	Art. 14(4)(e)	Implementation	Ability to stop the AI system; where appropriate and proportionate under Art. 14(4)
A10	Accuracy & Robustness	Art. 15	Testing	Testing, monitoring, drift detection
A10.1	— Accuracy testing	Art. 15(1)	Testing	Regular accuracy testing
A10.2	Robustness and cybersecurity testing	Art. 15(4)–(5)	Testing	Adversarial and edge-case tests are example methods chosen according to the system’s circumstances and risks
A10.3	Drift detection	Arts. 15(1), 15(4); Art. 72	Testing	Example method for monitoring performance degradation and harmful feedback loops, chosen for the system’s risks
A11	Conformity Assessment	Art. 43, 47-48	Conformity	Conformity assessment for high-risk AI
A11.1	Internal assessment	Art. 43(2)	Conformity	Annex III points 2–8: internal control under Annex VI; biometric and product routes follow Art. 43(1)/(3)
A11.2	— CE marking	Art. 48	Conformity	CE marking before placing on market
A12	Registration	Arts. 49, 71	Conformity	Determine EU/national registration, actor and scope under Art. 49(1)–(5); not every high-risk system uses the EU database
A12.1	Provider registration	Art. 49(1)	Conformity	Provider/representative registers itself and Annex III system, except point 2, before placement on market or putting into service
A12.2	Other registration rules	Art. 49(2)–(5)	Conformity	Art. 6(3) exception: provider/system registration; deployers that are public authorities, Union institutions, bodies, offices or agencies, or persons acting on their behalf, register use under paragraph 3; secured non-public part for specified fields; Annex III point 2 registration is national
A13	FRIA (Deployers)	Art. 27	Governance	Fundamental Rights Impact Assessment
A13.1	FRIA scope	Art. 27(1)	Governance	Public-law bodies, private public-service providers and deployers of Annex III 5(b)/(c) uses; Annex III point 2 excluded
A13.2	FRIA notification	Art. 27(3)	Governance	Notify the market surveillance authority where the FRIA duty applies, subject to the provision’s exception
A14	Third-party AI supplier review	Recommended governance; GDPR where applicable	Governance	Review privacy, security, terms and supplied documentation; not a universal Chapter V deployer duty
A14.1	DPA where supplier is processor	GDPR Art. 28	Governance	Processing agreement where personal data is processed on your behalf
A14.2	Terms and intended-use review	Contract; Arts. 13, 26(1) for high-risk systems	Governance	Check permitted uses and relevant provider instructions
A14.3	Personal-data handling rules	GDPR Arts. 5, 6, 9, 32, 44–49	Governance	Lawful purpose and basis, minimisation, security and transfer safeguards; encryption alone is insufficient
A14.4	Proportionate evidence and logging	Recommended governance; Arts. 19, 26(6) where applicable	Governance	Document necessary events; no blanket requirement to archive every GPAI prompt
A15	AI Incident Management	Art. 72, 73	Monitoring	Procedure for reporting AI incidents
A15.1	— Incident classification	Art. 73	Monitoring	Classification of AI incident severity
A15.2	— Serious incident reporting	Art. 73(1)	Monitoring	Reporting serious incidents to authorities
A16	Post-Market Monitoring	Art. 72	Monitoring	Continuous monitoring after deployment
A16.1	— Monitoring plan	Art. 72(3)	Monitoring	Post-market monitoring plan
A16.2	— Feedback collection	Art. 72(2)	Monitoring	Collection of user feedback
A17	Bias Testing (High-Risk)	Art. 10, 15	Testing	Regular bias testing for high-risk AI
A17.1	— Bias testing setup	Art. 10(2)(f)	Testing	Setup of bias testing
A17.2	Bias review cadence	Arts. 10, 15	Testing	Set testing frequency by system risks and change; monthly/quarterly reviews are examples, not statutory intervals

Implementation sequence

Inventory and role/scope assessment.
Applicable-duty matrix with legal dates and accountable owners.
Governance, data, risk and technical evidence for the relevant high-risk role.
Testing, remediation and the applicable conformity/registration process before its legal trigger.

The month ranges below are an illustrative project plan, not AI Act deadlines. Schedule against Articles 111 and 113 and the actual system’s placement on the market or use.

Implementation Phases

Resources

Primary sources: AI Act — informative consolidated version 27 July 2026; Regulation (EU) 2026/1744 — published 24 July 2026; GDPR — published version 4 May 2016.