EU AI Act compliance checklist by role, with dates to 2030

What does an EU AI Act compliance checklist need to cover?

An EU AI Act compliance checklist needs to cover four things: which role you hold for each AI system, which risk tier the system falls in, the duties that attach to that role and tier, and the date each duty applies. Regulation (EU) 2024/1689, as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744), sets separate obligations for providers (Article 16), authorised representatives (Article 22), importers (Article 23), distributors (Article 24), deployers (Article 26), and general-purpose AI model providers (Articles 53 to 55).

The lists below follow the consolidated text as of October 2026; the EU AI Act compliance guide explains the same duties in prose. A system that is not high-risk and has no Article 50 trigger carries two main sets of duties: the Article 4 measures to support AI literacy, and the Article 5 prohibitions, which include emotion recognition at work or in education except for medical or safety reasons. A provider that treats an Annex III system as not high-risk under Article 6(3) must also document that assessment and register the system once the high-risk rules apply (Articles 6(4) and 49(2)). Providers of systems that interact with people or generate synthetic content carry the Article 50 disclosure and marking duties now; generative systems placed on the market before August 2, 2026 have until December 2, 2026 to meet the marking duty (Article 111(4)).

Which role do you hold under the EU AI Act?

The test is what you do with each system, not what kind of company you are. A bank that builds its own credit scoring model is a provider and a deployer of the same system.

Which dates apply to each duty?

Article 113, as amended by Regulation (EU) 2026/1744, sets the dates. The high-risk dates moved. The original prohibitions, the model duties, and the transparency duties kept their dates, apart from a grace period to December 2, 2026 for the marking duty on generative systems already on the market (Article 111(4)).

What is on the provider checklist for a high-risk AI system?

The provider checklist is Article 16 and the articles it points to. Every item applies from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I Section A products. A high-risk system placed on the market or put into service before the applicable date is covered only if its design changes significantly from that date, but providers and deployers of high-risk systems intended to be used by public authorities must comply by August 2, 2030 (Article 111(2)).

• Classify each system under Article 6 and Annexes I and III; if you conclude an Annex III system is not high-risk, document that assessment before placing it on the market or putting it into service and register the system under Article 49(2) (Article 6(4))
• Run a risk management system across the system’s whole lifecycle (Article 9)
• Apply data governance to training, validation, and testing data (Article 10, as restructured by the Omnibus)
• Draw up the Annex IV technical documentation before placing the system on the market; SMEs, including start-ups, and small mid-caps may provide it in a simplified manner using the form the Commission is to establish (Article 11(1) as amended)
• Build in automatic logging and keep the logs under your control for at least six months, unless other Union or national law sets a different period (Articles 12 and 19)
• Write instructions for use that explain capabilities, limits, and oversight measures (Article 13), and design the system so deployers can exercise human oversight (Article 14)
• Meet the accuracy, robustness, and cybersecurity requirements (Article 15); a system that falls within the Cyber Resilience Act and meets the conditions of its Article 12(1), or that holds a certificate or statement of conformity under an EU cybersecurity certification scheme covering those requirements, is presumed to meet the cybersecurity requirement (Article 42(2) and (3))
• Put a quality management system in place (Article 17); EN 18286:2026 is the harmonised standard cited for this requirement as of October 2026
• Before placing on the market: complete the conformity assessment (Article 43), draw up the EU declaration of conformity (Article 47), affix the CE marking (Article 48), and, for Annex III systems, register in the EU database (Article 49(1)); repeat the conformity assessment after any substantial modification (Article 43(4))
• Indicate your name, registered trade name or registered trade mark, and contact address on the system or, where that is not possible, on its packaging or accompanying documentation (Article 16(b)); if established outside the EU, appoint an authorised representative by written mandate before making the system available (Article 22(1))
• Keep the technical documentation, quality management documentation, changes approved by notified bodies and notified body decisions where applicable, and declaration of conformity for 10 years after placing on the market or putting into service (Article 18)
• Run post-market monitoring under a documented plan (Article 72); report serious incidents to the market surveillance authorities of the Member States where they occurred immediately after establishing a causal link, or the reasonable likelihood of one, and not later than 15 days after becoming aware; not later than 10 days where a person has died; and not later than 2 days for a widespread infringement or a serious and irreversible disruption of critical infrastructure (Article 73(1) to (4)); take corrective action, withdraw, disable, or recall a non-conforming system and inform distributors, deployers, your authorised representative, and importers (Article 20)

What is on the deployer checklist for a high-risk AI system?

Deployer duties sit in Article 26 and govern how a high-risk system is used once it is running. They apply from the same dates as the provider list.

• Take technical and organisational measures to use the system in accordance with the provider’s instructions for use (Article 26(1))
• Assign human oversight to people who have the necessary competence, training, authority, and support (Article 26(2))
• Where you control the input data, ensure it is relevant and sufficiently representative for the system’s intended purpose (Article 26(4))
• Monitor operation under the instructions; where you have reason to consider that use in accordance with the instructions may result in the system presenting a risk, inform the provider or distributor and the market surveillance authority without undue delay and suspend use; where you identify a serious incident, immediately inform the provider, then the importer or distributor and the market surveillance authorities (Article 26(5))
• Keep the automatically generated logs under your control for at least six months, unless other Union or national law provides otherwise (Article 26(6))
• Before putting a high-risk system into use at a workplace, inform workers’ representatives and the affected workers (Article 26(7))
• If you are a public authority or Union body, register your use in the EU database, and do not use a system that has not been registered; inform the provider or distributor instead (Article 26(8) and Article 49(3))
• Where the system makes or assists decisions about natural persons, tell them they are subject to its use (Article 26(11)), and be ready to give an affected person clear and meaningful explanations of the role of the system in the decision-making procedure and the main elements of the decision, where a decision based on the output of an Annex III system (other than point 2) produces legal effects or similarly significantly affects that person in a way they consider adverse to their health, safety, or fundamental rights (Article 86)
• If you are a body governed by public law, a private entity providing public services, or a deployer of creditworthiness scoring or life and health insurance risk assessment and pricing systems, complete a fundamental rights impact assessment before use and notify the market surveillance authority; the assessment may cross-reference your GDPR data protection impact assessment (Article 27 as amended)

A deployer that is a financial institution subject to internal governance requirements under EU financial services law meets the monitoring duty by complying with those rules and keeps the logs as part of the documentation kept under that law (Article 26(5) and (6)). Deployers also carry two Article 50 duties that already apply: tell people exposed to an emotion recognition or biometric categorisation system how it operates (Article 50(3)), and disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless that text has been through human review with editorial responsibility (Article 50(4)).

What is on the importer and distributor checklist?

Importers and distributors do not build or operate the system. Their duties are gatekeeping and record-keeping, and they apply from the high-risk dates. The importers and exporters page covers them alongside US export controls.

• Importer: before placing a high-risk system on the market, verify that the provider carried out the Article 43 conformity assessment, drew up the Article 11 technical documentation, affixed the CE marking, supplied the EU declaration of conformity and instructions for use, and appointed an authorised representative under Article 22(1) (Article 23(1))
• Importer: do not place a system you have sufficient reason to consider non-conforming, falsified, or accompanied by falsified documentation; where it presents a risk, inform the provider, the authorised representative, and the market surveillance authorities (Article 23(2))
• Importer: put your name and contact address on the system, its packaging, or its documentation (Article 23(3)), and keep a copy of any notified body certificate, the instructions for use, and the EU declaration of conformity for 10 years after placing on the market or putting into service (Article 23(5))
• Distributor: before making a system available, verify the CE marking, the EU declaration of conformity, the instructions for use, and that the provider and importer met Article 16(b) and (c) and Article 23(3) (Article 24(1))
• Distributor: withhold a system you consider non-conforming; for a system already made available, take corrective action, withdraw it, or recall it, or ensure the provider or importer does, and inform the authorities where it presents a risk (Article 24(2) and (4))
• Both: give authorities the information they request on a reasoned request and cooperate on actions to reduce risk (Articles 23(6) and (7), 24(5) and (6))
• Both: do not put your own name on the system, modify it substantially, or change its intended purpose unless you are prepared to take on the full provider list (Article 25(1))

What is on the general-purpose AI model provider checklist?

These duties have applied since August 2, 2025. The AI Office’s powers to enforce them, including fines under Article 101, apply from August 2, 2026.

• Confirm the model is a general-purpose AI model under Article 3(63); a model used only for research, development, or prototyping before release is outside the definition
• Keep up-to-date technical documentation covering training, testing, and evaluation (Annex XI) and provide it to the AI Office or national authorities on request (Article 53(1)(a))
• Give downstream providers the information they need to understand the model’s capabilities and limits and meet their own duties (Annex XII), subject to protecting trade secrets (Article 53(1)(b))
• Put in place a policy to comply with EU copyright law, including rights reservations under Directive (EU) 2019/790 (Article 53(1)(c)), and publish a sufficiently detailed summary of training content using the AI Office template (Article 53(1)(d))
• If you release the model under a free and open-source licence with public parameters, weights, architecture, and usage information, the duties in Article 53(1)(a) and (b) do not apply, unless the model has systemic risk (Article 53(2))
• If established outside the EU, appoint an authorised representative in the Union before placing the model on the market, with the same open-source exemption (Article 54)
• If training compute exceeds 10²⁵ floating-point operations, the model is presumed to have high-impact capabilities (Article 51(2)); notify the Commission without delay and in any event within two weeks after that threshold is met or it becomes known that it will be met, with any arguments that the model nonetheless does not present systemic risks (Article 52(1) and (2)). A model classified as having systemic risk, by that route or by Commission designation (Articles 51(1)(b) and 52(4)), adds model evaluation with adversarial testing, systemic risk assessment and mitigation, serious incident reporting to the AI Office, and cybersecurity protection (Article 55)
• Decide whether to sign the General-Purpose AI Code of Practice published in July 2025 or demonstrate alternative adequate means of compliance for assessment by the Commission (Article 53(4) and Article 55(2))

Does completing the checklist mean a high-risk system conforms?

No. A checklist shows which duties exist and when they apply; it does not discharge them or replace the conformity assessment. For Annex III systems other than biometrics, Article 43(2) requires internal control under Annex VI, with no notified body. For biometric systems in Annex III point 1, the provider chooses between Annex VI and the notified body route in Annex VII, and must use Annex VII where it has not applied harmonised standards or common specifications in full (Article 43(1)). For Annex I Section A products, the sectoral conformity assessment procedure applies and the AI Act requirements are checked inside it (Article 43(3)).

Article 40 gives a presumption of conformity only for standards whose references have been published in the Official Journal. As of October 23, 2026, one such reference exists. Commission Implementing Decision (EU) 2026/2274 of October 12, 2026, published October 14, 2026, cited EN 18286:2026 (Artificial intelligence – Quality management system for EU AI Act regulatory purposes). That standard covers the Article 17 quality management system, and the Commission says providers that implement it benefit from a presumption of conformity with the Article 17 requirements it covers. The Commission also says further harmonised standards are expected to follow and has given no date. No harmonised standard has been cited for the requirements in Articles 9 to 15 (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, and cybersecurity). A provider must show compliance with those requirements by its own means, subject to the specific presumptions in Article 42, which include one for Article 15 cybersecurity where the system meets the Cyber Resilience Act conditions or holds an EU cybersecurity certificate covering those requirements.

The Commission’s guidelines on high-risk classification under Article 6(5), due by February 2, 2026, were published in draft for consultation on May 19, 2026; as of October 25, 2026 no final version had been published.

What fines apply if a checklist duty is missed?

Article 99 caps fines at €35 million or 7% of worldwide annual turnover for prohibited practices, €15 million or 3% for breaches of the operator duties in Articles 16, 22, 23, 24, 25(2) and (4), 26, and 50 and of the notified body requirements in Articles 31, 33(1), (3), and (4), and 34, and €7.5 million or 1% for supplying incorrect, incomplete, or misleading information to notified bodies or national competent authorities in reply to a request, with the higher figure applying in each case. For small and medium-sized enterprises the lower figure applies, and the Omnibus extended that treatment to small mid-caps for the second and third tiers (Article 99(6) and (6a)). Fines on general-purpose AI model providers fall under Article 101.

Which guides cover these duties in more depth?

The EU AI Act compliance guide explains the risk tiers, the Omnibus changes, and the penalties. The manufacturers page covers Annex I products and the machinery track, the importers and exporters page covers Articles 23 and 24 next to US export controls, and the governance frameworks guide maps NIST and ISO programs onto the duties listed here.

This page is general information as of October 2026, not legal advice. Confirm each duty against the consolidated text of Regulation (EU) 2024/1689 and with EU counsel or the market surveillance authority in the Member State where you sell or operate.