# EU AI Act checklist for companies that use AI

Updated 9 November 2026. Free to copy and use. Article text from EUR-Lex and the AI Act Service Desk.

A company that uses AI systems under its own authority is a deployer under the EU AI Act (Article 3(4)). This checklist lists what the Act asks of deployers, the article each duty comes from and the evidence that shows the work is done: AI literacy since 2 February 2025, transparency from 2 August 2026, and the Article 26 and 27 duties for high-risk uses from 2 December 2027.

14 October 2026: the first harmonised standard under the AI Act, EN 18286 (quality management for providers of high-risk AI systems), was cited in the Official Journal. [What it means for deployers](https://standardcompute.com/eu-ai-act-harmonised-standard-en-18286).

## 1. Every company that uses AI

_Applies whatever the tool: chat assistants, AI features in other software, coding agents and models called through an API._

| Done | No. | What to do | Article | How to evidence it |
| --- | --- | --- | --- | --- |
| [ ] | 1 | AI literacy. Take measures to support the AI literacy of staff and of others who operate or use AI systems on your behalf, matched to their knowledge, experience and training and the context of use. | Art. 4 (since 2 Feb 2025, as amended by Reg. 2026/1744) | Training records per role (date, attendees, content), the AI usage policy staff have acknowledged, and guidance on risks such as hallucination. No certificate is required. |
| [ ] | 2 | Inventory. List every AI system and use case: what it does, who owns it, who uses it, which models and providers serve it and what data goes in. | Basis for Art. 4, 6, 26 and 50 | An AI register with owner, purpose, users, models, providers, data categories, whether output is published, and the date of the last review. A per-app or per-key export of the models and providers in use. |
| [ ] | 3 | Risk classification. Check each use case against the eight Annex III areas: biometrics, critical infrastructure, education, employment and worker management, essential private and public services (including creditworthiness and life and health insurance pricing), law enforcement, migration and border control, and justice and democratic processes. Drafting, translating, summarising and coding assistance are not Annex III areas. Such a use becomes high-risk when the AI serves a listed purpose, for example filtering job applications. | Art. 6(2), 6(3), Annex III | A classification note per use case naming the Annex III point checked and the reasoning, any Article 6(3) derogation relied on, sign-off by legal, and a re-check whenever the purpose changes. Profiling of natural persons in an Annex III area is always high-risk. |
| [ ] | 4 | Role check. Confirm you are still a deployer. You take on provider obligations if you put your name or trademark on a high-risk system, substantially modify one, or change the purpose of an AI system so that it becomes high-risk. | Art. 25(1) | A note in the register per system: own brand or not, modifications made, intended purpose compared with the provider's. |

## 2. Only if you deploy a high-risk AI system

_Annex III uses, from 2 December 2027 (Article 113 as amended by the Digital Omnibus on AI)._

| Done | No. | What to do | Article | How to evidence it |
| --- | --- | --- | --- | --- |
| [ ] | 5 | Use per instructions. Take technical and organisational measures to use the system in accordance with the provider's instructions for use. | Art. 26(1) | The instructions for use on file with their version, and an internal procedure that maps each instruction to a control. |
| [ ] | 6 | Human oversight. Assign oversight to people with the necessary competence, training and authority, and give them the support they need. | Art. 26(2) | Named overseers per system, their training records, their authority to stop or override the system, and the escalation path. |
| [ ] | 7 | Input data. Where you control the input data, make sure it is relevant and sufficiently representative for the intended purpose. | Art. 26(4) | A description of the input data sources and a dated review of relevance and representativeness. |
| [ ] | 8 | Monitoring. Monitor the system on the basis of the instructions for use. If it may present a risk, inform the provider or distributor and the market surveillance authority and suspend use. Report serious incidents. | Art. 26(5) | A monitoring log, an incident procedure with the provider's and authority's contacts, and records of any notification or suspension. |
| [ ] | 9 | Log keeping. Keep the logs the high-risk system automatically generates, to the extent they are under your control, for a period appropriate to its intended purpose and of at least six months, unless Union or national law, in particular data protection law, provides otherwise. | Art. 26(6) | The retention setting and storage location of the system's logs, the deletion schedule, and a sample export showing six months or more. |
| [ ] | 10 | Inform workers. Before putting a high-risk system into service or using it at the workplace, employers inform workers' representatives and the affected workers. | Art. 26(7) | The dated notice to staff and the minutes or letter to the works council or other workers' representatives. |
| [ ] | 11 | Inform affected people. When an Annex III system makes or assists decisions about natural persons, tell them they are subject to its use. | Art. 26(11) | The notice text and where and when it is shown to the people concerned. |
| [ ] | 12 | Fundamental rights impact assessment (FRIA), where required: bodies governed by public law, private entities providing public services, and deployers of creditworthiness or life and health insurance pricing systems (Annex III 5(b) and (c)) assess the impact before first use and notify the market surveillance authority of the results. Critical infrastructure (Annex III point 2) is excepted. | Art. 27, Art. 26(9) | The completed FRIA (processes, period and frequency of use, affected groups, risks, oversight, measures and complaint mechanisms), the notification sent, and cross-references to your GDPR Article 35 DPIA. |

## 3. Transparency

_Article 50 applies from 2 August 2026._

| Done | No. | What to do | Article | How to evidence it |
| --- | --- | --- | --- | --- |
| [ ] | 13 | Provider marking. Providers of AI systems that generate synthetic audio, image, video or text must mark the output in a machine-readable format as artificially generated or manipulated. This is the provider's duty. For systems placed on the market before 2 August 2026 it applies from 2 December 2026. | Art. 50(2), Art. 111(4) | For each generative tool in the register, the provider's statement or documentation on how its output is marked, with the date you checked it. |
| [ ] | 14 | Deep fakes and public-interest text. Disclose that deep fake image, audio or video content has been artificially generated or manipulated. Disclose AI-generated or manipulated text published to inform the public on matters of public interest, unless it has had human review or editorial control and a person holds editorial responsibility. | Art. 50(4) | A labelling rule in the publishing workflow, examples of labelled content, and the name of the person holding editorial responsibility for reviewed text. |
| [ ] | 15 | Emotion recognition and biometric categorisation. Inform the people exposed to such a system. | Art. 50(3) | The notice text and where it is shown, or a note in the register that no such system is used. |

## 4. Documents to request from model providers

_General-purpose AI model obligations sit with the providers and have applied since 2 August 2025._

| Done | No. | What to do | Article | How to evidence it |
| --- | --- | --- | --- | --- |
| [ ] | 16 | GPAI documentation. If you build a general-purpose AI model into your own AI system, request the information and documentation its provider must make available to downstream providers, plus the public summary of training content and the copyright policy. Open-source models are exempt from the documentation duty unless they carry systemic risk. | Art. 53(1)(b), (c), (d), Annex XII | A folder per model with the provider documentation, training content summary link, copyright policy, data processing terms and the date retrieved, linked from the register. |

---

## Sources

- [Regulation (EU) 2024/1689, the AI Act, EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)
- [Regulation (EU) 2026/1744, the Digital Omnibus on AI, EUR-Lex](https://eur-lex.europa.eu/eli/reg/2026/1744/oj)
- AI Act Service Desk, consolidated text: [Article 4](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-4), [Article 6](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6), [Article 25](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-25), [Article 26](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26), [Article 27](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27), [Article 50](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50), [Article 53](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-53), [Article 111](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-111), [Article 113](https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113), [Annex III](https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3)

_Free EU AI Act deployer checklist from https://standardcompute.com/eu-ai-act-deployer-checklist (version of 9 November 2026). Free to copy and edit. Not legal advice._