PricingLog in

AI Act compliance checklist.

Reviewed

Short answer

To prepare for the AI Act, list every AI system you build or use, work out your role for each (provider, deployer, importer or distributor), check each against the prohibited practices, the high-risk areas and the transparency duties, and then apply the obligations that match, by their date. For a business that only uses AI tools, the duties already in force include AI literacy (Article 4) and, when it publishes deepfakes or public-interest AI text, a visible disclosure (Article 50(4)); high-risk duties follow only for uses listed in Annex III, from 2 December 2027.

Official sources: AI Act, Articles 2, 4, 5, 6 and 50 (consolidated) · Article 113

The checklist

  • Inventory: list each AI system and model you develop, sell, import, distribute or use, with its purpose.
  • Role: for each one, are you its provider, deployer, importer or distributor? Did you rebrand or substantially modify a high-risk system? (who must comply)
  • Prohibited practices: check every use against Article 5, applicable since 2 February 2025, and the two new bans from 2 December 2026. (Article 5)
  • AI literacy: take measures to support the AI literacy of the staff who operate or use AI, and keep a record. (Article 4)
  • People talk to it? As provider, make sure it tells them they are interacting with an AI. (Article 50(1))
  • It generates content? As provider, mark outputs in a machine-readable, detectable way; systems already on the market by 2 December 2026. (Code of Practice)
  • You publish AI content? As deployer, disclose deepfakes and unreviewed public-interest AI text at first exposure. (labelling guide)
  • Emotion recognition or biometric categorisation? As deployer, inform the people exposed (Article 50(3)).
  • General-purpose AI model? As its provider: documentation, copyright policy, training-content summary since 2 August 2025. (GPAI)
  • High-risk use (Annex I or III)? Plan the provider or deployer duties for 2 December 2027 or 2 August 2028, or document why Article 6(3) applies. (high-risk AI)
  • Personal data involved? Run the GDPR analysis in parallel; a DPIA can feed the fundamental rights impact assessment. (AI Act and GDPR)
  • Outside the EU? Check whether you need an authorised representative in the EU (Articles 22 and 54).
  • Review: repeat when you add a tool, change its purpose, or when guidelines change.

By role: what applies when

Common roles and their main AI Act duties
You areMain dutiesFrom
A business that uses AI toolsAI literacy; disclose deepfakes and certain AI text you publish2 Feb 2025; 2 Aug 2026
A provider of a chatbot or voice agentTell people they interact with an AI, clearly, at the first interaction2 Aug 2026
A provider of an image, video, audio or text generatorMachine-readable marking and detection of outputs2 Aug 2026; 2 Dec 2026 for systems already on the market
A provider of a general-purpose AI modelArticle 53 duties; Article 55 for systemic-risk models2 Aug 2025; 2 Aug 2027 for earlier models
A deployer of an HR, credit or insurance AI systemArticle 26 deployer duties; a fundamental rights impact assessment for credit and insurance pricing2 Dec 2027
A provider of a high-risk systemRequirements of Articles 8–15, quality management, conformity assessment, CE marking, registration2 Dec 2027 (Annex III); 2 Aug 2028 (Annex I)

The Commission’s AI Act Service Desk also offers questions and answers and an official compliance checker. Whether a duty applies to your system is a legal question; this list helps you ask it.

Questions

What should a small business do first?
Make the inventory and check your role for each tool. For a business that only uses AI tools, the duties in force today usually come down to AI literacy for staff, staying clear of the prohibited practices, and visible disclosure of any deepfakes or unreviewed public-interest AI text it publishes.
Is there an official AI Act compliance checker?
The Commission’s AI Act Service Desk offers a compliance checker alongside its questions and answers and the AI Act Explorer. Like this list, it is guidance; the legal text and the Commission’s guidelines remain the reference.

Sources

Last reviewed by Volkan Çatak, Founder, Proofcan.

Not legal advice. This page explains official texts in plain words and links each one; check the sources, or a lawyer, before relying on it for a decision.