EU AI Act Compliance Checklist for Every Risk Tier
An EU AI Act compliance checklist only works if it starts with triage. The Act does not give every company the same homework: your obligations depend on your role (provider or deployer) and your system's risk tier (prohibited, high-risk, limited, or minimal, plus the separate general-purpose model rules). Answer those two questions first and most of the Act falls away. Here is the decision path we use.
Step 1: Which role are you?
You are a provider if you develop an AI system, or have one developed, and place it on the market under your own name. You are a deployer if you use an AI system under your authority in a professional context. Plenty of companies are both, for different systems. List every AI system you build or use, and tag each one.
Step 2: Which tier is each system?
Work down this ladder and stop at the first match:
- Does it do anything in the Article 5 prohibited list (social scoring, manipulative techniques, scraping facial images)? Stop using it. Those rules already apply.
- Is it a safety component of a regulated product, or in an Annex III category (hiring, credit, education, essential services, law enforcement)? That is high-risk.
- Does it talk to people, generate content, or read emotions? That is limited risk: Article 50 transparency duties.
- None of the above? Minimal risk. Document the decision and move on.
Step 3: Work the short list for that tier
- High-risk providers carry the heavy list: Articles 9 to 15 plus conformity assessment. We broke it into 12 rows in the high-risk checklist.
- High-risk deployers get Article 26: oversight, input data, monitoring, log retention. See the deployer checklist.
- Limited risk means disclosure: tell people they are talking to AI, label synthetic media. Our Article 50 guide shows example wording.
- GPAI model providers follow Article 53, covered in the GPAI obligations guide.
The dates that anchor the plan
Prohibitions applied from 2 February 2025. General-purpose AI rules applied from 2 August 2025. Most of the rest, including Annex III high-risk and Article 50, applies from 2 August 2026 under the current text. A proposed amendment in Brussels may shift parts of the 2026 date. It is not law. Plan for 2026.
FAQ
Can we do this triage ourselves?
Yes. Our free risk check asks the classification questions and hands you the tier plus the matching obligation list in about 3 minutes.
Get your tier in 3 minutes, free
Sources
This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.