EU AI Act Compliance Checklist: 55-Point Guide for High-Risk AI Systems [2026]

Determine Your Obligations

1. Complete AI system inventory — all AI systems deployed or in development are catalogued
2. Each AI system classified against Annex III risk categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice)
3. Prohibited AI practices reviewed — confirm no systems fall under Article 5 prohibitions
4. Role determined for each system — are you provider, deployer, importer, or distributor?
5. GPAI model obligations assessed — do any systems use or provide general-purpose AI models?

Phase 0 Score: ___ / 10

6. Risk management system established as a continuous, iterative process throughout the AI system lifecycle
7. Known and reasonably foreseeable risks identified and documented
8. Risks estimated and evaluated, including risks from reasonably foreseeable misuse
9. Risk mitigation measures adopted — technical, organisational, or both
10. Residual risks documented and communicated to deployers
11. Testing procedures defined to ensure risk management measures are effective
12. Risk management system reviewed and updated when significant changes occur
13. Risk management documentation maintained for regulatory inspection

Phase 1 Score: ___ / 16

14. Training, validation, and testing datasets are subject to appropriate data governance practices
15. Data relevance, representativeness, and accuracy assessed and documented
16. Possible biases in datasets identified and addressed
17. Data gaps or shortcomings identified with mitigation measures
18. Special category data processing (Article 10(5)) justified and documented where used for bias detection
19. Statistical properties of datasets documented, including intended purpose and limitations
20. Data retention policies defined and implemented for training data

Phase 2 Score: ___ / 14

21. General description of the AI system including intended purpose, developer identity, and system version
22. Detailed description of system elements: algorithms, data, training methodologies, key design choices
23. Information on monitoring, functioning, and control of the system
24. Description of the computational resources used (hardware, compute, training time)
25. Validation and testing procedures documented with results
26. Cybersecurity measures documented
27. Technical documentation kept up-to-date throughout the system lifecycle

Phase 3 Score: ___ / 14

28. Automatic logging of events enabled throughout the AI system's operation
29. Logging captures: operating period, reference database, input data, identity of persons involved in verification
30. Log retention period defined (appropriate to intended purpose, at least 6 months unless regulated otherwise)
31. Logs accessible to deployers for monitoring and post-market surveillance
32. Logging design enables traceability of AI system decisions

Phase 4 Score: ___ / 10

33. Instructions for use provided to deployers — clear, accessible, and comprehensive
34. Intended purpose and foreseeable misuse scenarios documented
35. Level of accuracy, robustness, and cybersecurity declared with metrics
36. Known limitations communicated, including conditions where system may not perform as intended
37. Human oversight measures documented in instructions for use

Phase 5 Score: ___ / 10

38. Human oversight measures designed into the system (human-in-the-loop, human-on-the-loop, or human-in-command)
39. Oversight persons can fully understand the AI system's capabilities and limitations
40. Oversight persons can correctly interpret outputs and decide not to use the system
41. Ability to override or reverse AI system decisions is implemented
42. Ability to interrupt or stop the AI system via a "stop" button or similar procedure

Phase 6 Score: ___ / 10

43. Accuracy levels declared and tested with appropriate metrics and benchmarks
44. System is resilient to errors, faults, and inconsistencies in the environment
45. Technical redundancy solutions implemented (including backup and fail-safe plans)
46. Cybersecurity measures protect against vulnerabilities, manipulation of training data, model poisoning, and adversarial examples
47. System resilient to attempts to alter use or performance by exploiting vulnerabilities

Phase 7 Score: ___ / 10

48. Conformity assessment procedure identified (self-assessment for most, third-party for biometric and critical infrastructure)
49. Quality management system established covering compliance strategy, design control, testing, and post-market monitoring
50. EU declaration of conformity drawn up
51. CE marking affixed to the AI system
52. Registration in the EU database for high-risk AI systems completed
53. Post-market monitoring system established and documented
54. Serious incident reporting procedure established (reporting to market surveillance authorities)
55. All documentation retained for 10 years after the AI system is placed on the market

Phase 8 Score: ___ / 16

• 90-110: Compliance-ready. Proceed to conformity assessment.
• 70-89: Strong foundation. Address gaps in Phases 3-4 (documentation, logging) and Phase 8 (conformity).
• 50-69: Significant work needed. Prioritise Phase 1 (risk management) and Phase 2 (data governance) — they underpin everything else.
• 30-49: Early stage. Focus on Phase 0 (classification) first — you may have fewer obligations than you think.
• 0-29: Pre-compliance. The December 2027 deadline still requires immediate programme mobilisation — the extension buys time, not room for complacency.