EU AI Act Compliance Checklist For Every Risk Tier

Drew & AI Comply HQ™ Team · May 27, 2026

An EU AI Act compliance checklist only works if it starts with triage. The Act does not give every company the same homework: your obligations depend on your role (provider or deployer) and your system's risk tier (prohibited, high-risk, limited, or minimal, plus the separate general-purpose model rules). Answer those two questions first and most of the Act falls away. Here is the decision path we use.

Step 1: Which role are you?

You are a provider if you develop an AI system, or have one developed, and place it on the market under your own name. You are a deployer if you use an AI system under your authority in a professional context. Plenty of companies are both, for different systems. List every AI system you build or use, and tag each one.

Step 2: Which tier is each system?

Work down this ladder and stop at the first match:

Does it do anything in the Article 5 prohibited list (social scoring, manipulative techniques, scraping facial images)? Stop using it. The original bans have applied since February 2, 2025. Two new Article 5 bans follow on December 2, 2026.
Is it a safety component of a regulated product, or in an Annex III category (hiring, credit, education, essential services, law enforcement)? That is high-risk.
Does it talk to people, generate content, or read emotions? That is limited risk: Article 50 transparency duties.
None of the above? Minimal risk. Document the decision and move on.

Step 3: Work the short list for that tier

High-risk providers carry the heavy list: Articles 9 to 15 plus conformity assessment. We broke it into 12 rows in the high-risk checklist.
High-risk deployers get Article 26: oversight, input data, monitoring, log retention. See the deployer checklist.
Limited risk means disclosure: tell people they are talking to AI, label synthetic media. Our Article 50 guide shows example wording.
GPAI model providers follow Article 53, covered in the GPAI obligations guide.

The dates that anchor the plan

February 2, 2025: the Article 5 bans began.
August 2, 2025: the rules for general-purpose AI models began.
August 2, 2026: Article 50 transparency and most other rules began.
December 2, 2026: two new Article 5 bans begin. They cover AI that makes intimate images of real people without consent, and AI that makes child sexual abuse material.
December 2, 2027: high-risk rules begin for Annex III systems.
August 2, 2028: high-risk rules begin for AI in products like medical devices and toys (Annex I, Section A). Machinery, vehicles, and other Section B products get their AI rules through their own EU laws (Article 2(2)).

The Digital Omnibus on AI (Regulation (EU) 2026/1744) set the last three dates in July 2026. Pick your earliest date and work back from it.

FAQ

Can we do this triage ourselves?

Yes. Our free risk check asks the classification questions and hands you the tier plus the matching obligation list in about 3 minutes.

Get your tier in 3 minutes, free

Sources

This page is informational content, not legal advice. Talk to a qualified lawyer about your specific situation.