EU AI Act Compliance Checklist (Updated for 2027 Deadlines)

EU AI Act compliance: a practical checklist for companies that use AIMost organisations affected by the EU AI Act do not build AI — they buy it and use it. That makes them deployers, with duties of their own. This guide turns the Act into a working checklist: what applies already, what the 2026 Digital Omnibus moved to December 2027, and how to produce the evidence an auditor or supervisor will ask for — with AI agents and AI-driven analytics as the running example. It is a practical summary, not legal advice.

The dates that matter now

The Act — Regulation (EU) 2024/1689 — entered into force on 1 August 2024 and applies in stages. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, postponed the high-risk obligations but left the rest of the timetable in place:

2 February 2025 — prohibited practices and the AI literacy duty apply
2 August 2025 — obligations for providers of general-purpose AI models apply
2 August 2026 — transparency duties under Article 50 apply
2 December 2026 — generative AI systems already on the market must mark synthetic content; new prohibitions on AI-generated non-consensual intimate imagery and child sexual abuse material apply
2 December 2027 — high-risk obligations for the use cases listed in Annex III, such as credit scoring, recruitment and access to essential services
2 August 2028 — high-risk obligations for AI that is a safety component of products regulated under Annex I

Step 1 — Know which AI you run

Compliance starts with an inventory. List every AI system in use — bought, built or embedded in another product — with its purpose, business owner, the data it uses, the model behind it and the version in production. Include the tools teams adopted on their own: an AI assistant used to draft customer letters belongs in the inventory as much as a credit model.

Step 2 — Decide your role and classify each use

For each system, decide whether you are its provider (you developed it or put your name on it) or its deployer (you use it under your authority). Substantially modifying a system, or using it for a high-risk purpose it was not intended for, can turn a deployer into a provider. Then classify the use:

Prohibited — for example social scoring, manipulative techniques that cause significant harm, emotion recognition at work or school: stop the use
High-risk — Annex III uses such as creditworthiness of individuals, life and health insurance pricing, recruitment and employee management, and access to essential services
Transparency — chatbots, assistants and systems producing synthetic content: people must be told
Minimal risk — most internal productivity uses: no specific duties, though good governance still applies

Step 3 — What every company using AI must do already

These duties apply today, whatever the risk tier:

AI literacy — staff who operate or rely on AI understand its capabilities and limits
Transparency — tell people when they interact with an AI system, and disclose deepfakes and AI-generated text published to inform the public
Prohibited-practice check — confirm no use falls on the banned list, including the two prohibitions added for December 2026
Vendor information — for general-purpose AI models, obtain the technical information the provider must supply and keep it on file

Step 4 — Prepare high-risk uses before December 2027

If any use is high-risk, the deployer's duties are concrete, and they take time to build into daily operations. The extra time from the Digital Omnibus is a grace period, not a repeal:

Use the system according to the provider's instructions for use
Assign human oversight to people with the competence, training and authority to intervene
Make sure input data under your control is relevant and sufficiently representative
Monitor operation, and report serious incidents and risks to the provider and the authorities
Keep the automatically generated logs for at least six months where they are under your control
Inform workers' representatives before using high-risk AI at work, and inform people when a decision about them is made with high-risk AI
Carry out a fundamental rights impact assessment if you are a public body or use AI for credit scoring or life and health insurance pricing

Step 5 — Make evidence a by-product of operation

Supervisors and auditors will not ask for a policy; they will ask what a system did on a given day and who approved it. Evidence assembled by hand at audit time is expensive and incomplete. The durable approach is a platform that produces it on every run: versioned systems with recorded approvals, test results before each release, a log of every input, output and human decision, and monitoring that shows failures and drift.

AI agents under the EU AI Act

An AI agent is classified by what it is used for, not by being an agent. An agent that drafts internal answers from procedure manuals is usually minimal-risk; the same technology pre-scoring loan applicants is high-risk. Agents that act raise the practical stakes either way: they need bounded permissions, human approval for consequential actions and a trace of every step — which is also how a deployer shows that human oversight is effective.

How ATX Institute products support the checklist

No software makes an organisation compliant on its own. What a platform can do is provide controls that produce evidence. ATX Agent Hub and ATX AnalyticsTable are built for that, and both run on your own infrastructure:

Human oversight (Art. 14 and 26) — ATX Agent Hub approval nodes stop a workflow until a named person approves, edits or rejects
Record-keeping and logs (Art. 12 and 26) — trace logs of every run with inputs, retrieved evidence, model and each step's output, plus immutable audit events
Transparency (Art. 13 and 50) — answers with citations and document lineage; Ask Greg in ATX AnalyticsTable shows the SQL behind every answer
Accuracy and robustness (Art. 15) — test suites with golden cases run before a version is promoted, and four-eyes release of immutable versions
Data governance (Art. 10) and GDPR — PII masking before data reaches a model, and self-hosted or air-gapped deployment with the model endpoint you choose
AI inventory — every workflow is a versioned item with an owner, an environment, an approval history and its own manual

Example: a bank preparing for December 2027

A retail bank's inventory finds eleven AI uses. One — a consumer credit-scoring model bought from a vendor — is high-risk, and the bank is its deployer: it assigns trained credit officers as overseers with authority to override, sets log retention well beyond six months, plans its fundamental rights impact assessment and asks the vendor for the instructions for use. Two customer-facing assistants get AI disclosure notices. The remaining internal AI agents — policy questions, complaint triage, report commentary — are minimal-risk, but they run on a platform with versioned releases, human approval and trace logs, so the bank can show control over all of them with the same evidence.

Frequently asked questions

What is EU AI Act compliance?

Meeting the obligations the AI Act sets for your role and for each AI use: avoiding prohibited practices, ensuring AI literacy and transparency, and — for high-risk uses — risk management, human oversight, logging, monitoring and documentation. It is shown with evidence, not declared.

Who has to comply with the EU AI Act?

Providers that develop AI systems or place them on the EU market, deployers that use AI systems under their authority in the EU, and importers and distributors — including companies outside the EU whose AI output is used in the EU.

What are the EU AI Act compliance deadlines now?

Prohibitions and AI literacy since 2 February 2025, general-purpose AI obligations since 2 August 2025, transparency duties since 2 August 2026, high-risk obligations for Annex III uses from 2 December 2027 and for AI in regulated products from 2 August 2028, as set by the Digital Omnibus, Regulation (EU) 2026/1744.

What are the penalties for non-compliance with the EU AI Act?

Up to €35 million or 7% of worldwide annual turnover for prohibited practices, up to €15 million or 3% for most other obligations, and up to €7.5 million or 1% for supplying incorrect information, with lower caps for SMEs and small mid-caps.

We only use a general-purpose AI assistant internally. Do we have to do anything?

Usually a little. Make sure staff using it have adequate AI literacy, record the use in your AI inventory, check that no use is prohibited or high-risk, and disclose AI where you publish AI-generated text or let customers talk to an AI system.

Is there software for EU AI Act compliance?

Software cannot make you compliant, but it can provide the controls and the evidence: an AI inventory, approvals, human oversight steps, logs and test records. ATX Agent Hub builds these into how AI agents are developed and run.

Glossary terms on this page

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.