EU AI Act compliance checklist: what providers and deployers must do, step by step

Step 1: build an inventory of every AI system you build, buy or use

You cannot classify what you have not found. Most SMEs underestimate how many AI systems they run, because AI arrives embedded in SaaS tools: the applicant tracking system that ranks CVs, the CRM that scores leads, the support chatbot, the fraud filter in the payment stack. The AI Act definition in Article 3(1) is broad: a machine-based system that operates with some autonomy and infers from input how to generate outputs such as predictions, content, recommendations or decisions.

Start with a simple register. For each system record the name, the vendor or internal team, the business owner, the intended purpose in one sentence, who is affected by the output (customers, employees, applicants, the public) and whether a human reviews the output before it has an effect. This register becomes the backbone of everything that follows, and it is the first thing a customer, investor or authority will ask to see.

• Survey department heads, not only IT: HR, sales, finance and customer service are where embedded AI hides.
• Check vendor release notes and contracts for features described as AI, machine learning, smart scoring or automated decisions.
• Include internal scripts and models built by data teams, and general-purpose AI tools staff use with company data.

Step 2: determine your role for each system

The Act distinguishes several operators. A provider develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority in a professional context. Importers and distributors have narrower duties around checking that the provider did its job. One company can hold different roles for different systems: a software house is the provider of the scoring model it sells and a deployer of the chatbot it licenses for its own helpdesk.

Watch Article 25 closely. A deployer, distributor or importer becomes a provider of a high-risk system if it puts its own name or trademark on it, makes a substantial modification, or changes the intended purpose of a system so that it becomes high-risk. Rebranding a white-label model or repurposing a general chatbot to screen job applicants are typical ways companies slide into provider obligations without noticing.

Step 3: classify each system into a risk category

The Act works with four practical buckets. Prohibited practices under Article 5 are banned outright, for example manipulative techniques that cause significant harm, social scoring, untargeted scraping of facial images to build recognition databases, and emotion recognition in the workplace or in education except for medical or safety reasons. High-risk systems are either safety components of products covered by the EU harmonisation legislation in Annex I, or systems used in the areas listed in Annex III such as employment, credit scoring, education, essential services and critical infrastructure. Limited-risk systems carry transparency duties under Article 50. Everything else is minimal risk with no specific obligations beyond AI literacy.

General-purpose AI models form a separate track. If you only use a GPAI model through an API or a product, the model obligations sit with the model provider, but the system you build on top of it is still classified by its own intended purpose. Document the reasoning behind each classification. If you rely on the Article 6(3) exception to argue that an Annex III use is not high-risk, the Act requires you to document that assessment before placing the system on the market.

Step 4: obligations for providers of high-risk AI systems

Providers carry the heaviest load. The requirements in Chapter III, Section 2 are design obligations: they must be built into the system and its documentation before it reaches the market, which is why they take months rather than weeks.

• Risk management system across the whole life cycle (Article 9).
• Data and data governance: relevant, representative training, validation and test data, with bias examination (Article 10).
• Technical documentation following Annex IV, kept up to date (Article 11).
• Automatic logging of events to enable traceability (Article 12).
• Instructions for use that give deployers what they need, including limitations and accuracy levels (Article 13).
• Human oversight measures designed into the system (Article 14).
• Appropriate accuracy, robustness and cybersecurity (Article 15).
• A quality management system with written policies and procedures (Article 17).
• Conformity assessment, EU declaration of conformity, CE marking and registration in the EU database (Articles 43, 47, 48 and 49).
• Post-market monitoring and reporting of serious incidents to market surveillance authorities (Articles 72 and 73).

Step 5: obligations for deployers of high-risk AI systems

Deployers are not off the hook just because they bought the system. Article 26 requires them to use the system according to the provider's instructions, assign human oversight to people with the necessary competence, training and authority, make sure input data under their control is relevant and sufficiently representative, monitor operation and inform the provider and authorities of serious incidents, and keep the automatically generated logs for at least six months unless other law says otherwise.

Employers deploying high-risk AI in the workplace must inform workers' representatives and affected workers before putting it into use. Deployers that take decisions about people with the help of an Annex III system must inform those people that they are subject to such a system. Public bodies, private entities providing public services, and deployers using AI for creditworthiness assessments or for life and health insurance pricing must also carry out a fundamental rights impact assessment under Article 27 before first use.

Step 6: transparency, AI literacy and the rules that apply to everyone

Two obligations reach almost every organisation. First, Article 4 on AI literacy requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff and others who operate AI systems on their behalf. In practice that means role-based training, a short acceptable-use policy for AI tools and a record of who was trained on what.

Second, Article 50 transparency duties apply to specific use cases regardless of risk class: people must be told when they interact with an AI system such as a chatbot unless it is obvious, synthetic audio, image, video and text output must be marked in a machine-readable way by providers, and deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest.

Step 7: put your actions on the right timeline

The Act entered into force on 1 August 2024 and applies in stages. Prohibited practices and the AI literacy duty have applied since 2 February 2025. Obligations for general-purpose AI model providers and the penalty framework have applied since 2 August 2025. The bulk of the remaining rules, including Annex III high-risk obligations and Article 50 transparency, were scheduled for 2 August 2026, while high-risk systems embedded in Annex I products follow on 2 August 2027.

The European Commission proposed a digital omnibus package in late 2025 that would postpone and link some high-risk application dates to the availability of harmonised standards and support tools. Do not plan on a delay until it is formally adopted and published: check the current status in the Official Journal and on the Commission's AI Act pages before you reschedule work. Prohibited practices, AI literacy and GPAI duties are not affected by that debate.

Step 8: turn the checklist into a management system

Fines under Article 99 reach up to 35 million euros or 7 percent of worldwide annual turnover for prohibited practices and up to 15 million euros or 3 percent for most other breaches, with the lower amount applying to SMEs. More immediately, enterprise customers are already adding AI Act questions to procurement questionnaires. A one-off spreadsheet does not survive that scrutiny for long.

ISO/IEC 42001:2023 gives you a structure to keep the work alive: an AI policy, defined roles, AI risk and impact assessments, life-cycle controls, supplier management and internal audit. It does not equal AI Act conformity on its own, but it produces much of the evidence the Act expects, such as documented risk management and a quality management approach. A free self-assessment on baltum.ai shows where your AI governance stands against ISO 42001 and which gaps to close first.

This article is for general information and is not legal advice. baltum.ai is independent software, not a certification body.