EU AI Act Compliance Checklist for Businesses Implementing AI

The EU Artificial Intelligence Act is the first comprehensive law on AI. It applies to companies inside the EU and to companies elsewhere, including in the UK, the USA and the UAE, whose AI systems are used in the EU. If you're implementing AI for European customers or staff, you need to know where you stand.

This checklist explains the main obligations in plain language. It's written from an engineering perspective to help you plan, not as legal advice, so confirm the details for your situation with a qualified adviser.

1. Work out your role

The Act assigns different duties to different parties. The two most common roles are:

Provider: you develop an AI system, or have one developed, and place it on the market or put it into service under your name.
Deployer: you use an AI system in your business, for example a support chatbot or a document-processing tool built by someone else.

Importers, distributors and providers of general-purpose AI models have their own obligations. A company can hold more than one role, and if you substantially modify a system or put your name on it, you may become its provider.

2. Check for prohibited practices

Some uses of AI are banned outright, and these bans have applied since February 2025. They include, among others:

Manipulative or deceptive techniques that cause significant harm
Exploiting vulnerabilities related to age, disability or social or economic situation
Social scoring that leads to unjustified or disproportionate treatment
Predicting criminal behaviour based only on profiling or personality traits
Untargeted scraping of facial images to build facial recognition databases
Emotion recognition in workplaces and schools, except for medical or safety reasons

Most business use cases are nowhere near these lines, but it's worth recording that you checked.

3. Classify the risk level

Most obligations depend on how the AI system is classified:

High-risk: AI used in areas listed in the Act, such as recruitment and worker management, credit scoring, access to education, essential services, certain insurance pricing, law enforcement and critical infrastructure, plus AI that is a safety component of regulated products.
Transparency risk: chatbots, AI-generated content and certain biometric or emotion-recognition systems, which carry disclosure duties.
Minimal risk: most other business AI, such as internal knowledge assistants, spam filters or document summarisation, which has no specific obligations beyond AI literacy.

There are exceptions: a system in a listed area may not be high-risk if it only performs a narrow procedural task or doesn't materially influence decisions. Document your reasoning either way.

4. Meet the transparency duties

If people interact with your AI directly, they must be told they're dealing with an AI system, unless it's obvious. Providers of systems that generate synthetic audio, images, video or text need to mark the output in a machine-readable way so it can be detected as AI-generated. Deployers that publish deepfakes, or AI-generated text on matters of public interest, must disclose it.

In practice, this means clear labels in chat interfaces, notices in your terms, and technical watermarking or metadata for generated media.

5. If your system is high-risk

High-risk systems carry the heaviest obligations. Providers must, among other things:

Run a risk management system throughout the life cycle
Use training, validation and test data that is relevant, representative and examined for bias
Prepare technical documentation and keep automatic logs
Give deployers clear instructions for use
Design for effective human oversight
Achieve appropriate accuracy, robustness and cybersecurity
Operate a quality management system, complete a conformity assessment, register the system and monitor it after launch

Deployers of high-risk systems must use them according to the instructions, assign competent human oversight, monitor operation, keep logs, inform affected workers, and in some cases carry out a fundamental rights impact assessment.

6. Build AI literacy

Since February 2025, providers and deployers must take measures to ensure a sufficient level of AI literacy among staff who operate or use AI systems. Short, role-specific training on what your AI tools do, their limits and how to use them responsibly is a sensible way to meet this.

7. General-purpose AI models

If you build on a general-purpose model such as a large language model, most model-level obligations fall on the model provider. They have applied since August 2025 and include technical documentation, information for downstream providers and a copyright policy. If you fine-tune or substantially modify a model, check whether you take on some of these duties.

8. Remember GDPR still applies

The AI Act sits alongside GDPR, not instead of it. Any AI that processes personal data still needs a lawful basis, data minimisation, transparency to individuals and, where risk is high, a data protection impact assessment. Decisions based solely on automated processing that significantly affect people have extra safeguards under Article 22.

Key dates

1 August 2024: the Act entered into force.
2 February 2025: prohibitions and AI literacy duties apply.
2 August 2025: rules for general-purpose AI models, governance and penalties apply.
2 August 2026: most remaining obligations apply, including transparency duties and many high-risk requirements.
2 August 2027: obligations for high-risk AI in products covered by existing EU safety legislation.

In late 2025 the European Commission proposed changes, as part of its "Digital Omnibus" package, that would delay some high-risk deadlines. Check the current timetable with your adviser before you plan around a specific date.

Penalties

Fines can reach €35 million or 7% of worldwide annual turnover for prohibited practices, and €15 million or 3% for most other breaches, with lower caps for SMEs and start-ups. Beyond fines, non-compliant high-risk systems can be withdrawn from the market.

Your checklist

List every AI system you build or use, and your role for each.
Confirm none fall under prohibited practices.
Classify each system's risk level and record why.
Add AI disclosures and content marking where required.
For high-risk systems, plan documentation, logging, human oversight and conformity assessment.
Train staff on AI literacy.
Review GDPR obligations, including impact assessments.
Assign an owner and review the inventory regularly.

Frequently asked questions

Does the EU AI Act apply to companies outside the EU?

Yes, if they place AI systems on the EU market or the output of their AI is used in the EU. A US, UK or UAE company serving EU customers can be covered.

Is a customer service chatbot high-risk under the EU AI Act?

Usually not. Most chatbots fall under the transparency rules: people must be told they're talking to an AI. It becomes high-risk only if used for listed purposes, such as deciding access to essential services.

What is AI literacy under the EU AI Act?

Providers and deployers must take measures so that staff who operate or use AI have enough understanding of how it works, its limits and its risks. Role-based training is the usual approach.

Does the AI Act replace GDPR?

No. Both apply. GDPR governs personal data; the AI Act adds rules specific to AI systems.

Key takeaways

Know your role: provider, deployer or both.
Most business AI is minimal or transparency risk; check carefully for high-risk uses.
AI literacy and prohibited-practice rules already apply.
Confirm current deadlines, as parts of the timetable may change.

Building AI for Europe?

AnAInfo builds AI for UK and European businesses with these obligations designed in: risk classification at discovery, transparency notices, logging, human oversight and EU data hosting. See our AI implementation services or contact us to discuss your project.