The EU AI Act Compliance Checklist: What to Do Now, and What Can Wait Until December 2027

Updated 6 October 2026. This checklist was first written around a single 2 August 2026 deadline. That changed. The Digital Omnibus on AI, Regulation (EU) 2026/1744, became law on 27 July 2026 and moved the high-risk deadlines. Everything below reflects the rules as they stand now. For the full story of what changed, read our Digital Omnibus explainer.

If you're a European SME with AI in your product or operations, the EU AI Act no longer has one deadline. It has several, and some of them have already passed.

Most checklists online were written for enterprises with dedicated compliance teams and six-figure budgets. They're not wrong, just not realistic for a 30-person startup or a fintech with three engineers and a part-time COO. This is the version for everyone else: the actual sequence of work, in the order it's due.

The timeline that applies today

So the work splits in two. Part 1 is what you should already have done, or need to finish this quarter. Part 2 is the high-risk roadmap, which now has a realistic runway instead of a panic window.

Part 1: What is already in force

Step 1: Inventory every AI system in your business

Before anything else, you need to know what you have. Most SMEs have more AI than they realise. Check:

Customer-facing AI: chatbots and support automation, recommendation engines, personalisation, search and ranking, pricing optimisation, content moderation, AI-generated content features.

Internal AI: recruitment and screening tools, performance evaluation, fraud detection, lead scoring, marketing copy generation, code assistants, document automation, translation.

Third-party AI: AI features inside your SaaS stack (CRMs, help desks, note-takers), and any foundation model APIs you call directly (OpenAI, Anthropic, Google, Mistral).

For each one, capture: a one-paragraph description, who built it, what data it processes, who is affected by its outputs, and whether it's live or in development.

The output is a single spreadsheet. For most SMEs it lists 5 to 15 systems, not 1.

Step 2: Classify each system and decide your role

For each system, decide its risk tier (prohibited, high-risk, limited-risk transparency, or minimal-risk) and document why. The classification guide walks through the framework, and the free classifier does it in about five minutes per system.

Then record your role for each one:

• Built it? You're the provider. Most obligations sit with you.
• Bought it and use it as-is? You're the deployer. Fewer obligations, focused on use, oversight and informing people.
• Rebranded it, changed its intended purpose, or substantially modified it? You may have become a provider yourself (Article 25).

This takes an afternoon, and it decides everything that follows.

Step 3: Check for prohibited practices (in force since February 2025)

Article 5 bans have applied since 2 February 2025. If any of your systems does one of these, it has been unlawful for well over a year:

• Subliminal or manipulative techniques that materially distort behaviour and cause significant harm
• Exploiting vulnerabilities linked to age, disability or social or economic situation
• Social scoring that leads to unjustified or disproportionate detrimental treatment (by any organisation, public or private)
• Predicting criminal offences based solely on profiling or personality traits
• Untargeted scraping of facial images to build facial recognition databases
• Emotion recognition in the workplace or in education (narrow medical and safety exceptions)
• Biometric categorisation to infer race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation
• Real-time remote biometric identification in public spaces for law enforcement, outside narrow exceptions

The Omnibus adds one more. From 2 December 2026, AI systems that generate non-consensual intimate imagery ("nudifiers") or child sexual abuse material are prohibited. For providers, this also catches general systems where that output is a reasonably foreseeable result and adequate safeguards are missing. If you ship image or video generation, check your safeguards now.

Prohibited practices carry the Act's highest fines: up to €35 million or 7% of global annual turnover.

Step 4: Implement Article 50 transparency (in force since August 2026)

This is the obligation most SaaS companies actually face right now. It applies regardless of risk tier:

• Chatbots and other AI that interacts with people: tell people they're talking to an AI, unless it's obvious from the context.
• Generative AI (text, images, audio, video): providers must mark outputs in a machine-readable, detectable way. Systems already on the market before 2 August 2026 have until 2 December 2026 for this marking piece only.
• Deepfakes: deployers must disclose that image, audio or video content has been artificially generated or manipulated.
• AI-generated text published to inform the public on matters of public interest: disclose it, unless a human has reviewed it and someone takes editorial responsibility.
• Emotion recognition or biometric categorisation (where lawful): inform the people exposed to it.

The Commission finalised a Code of Practice on marking and labelling in June 2026 and guidelines on Article 50 in July 2026. Our Article 50 guide covers what each obligation looks like in a real product.

Step 5: Run AI literacy measures for your team

Article 4 has applied since February 2025. The Omnibus softened it: you must take measures to support AI literacy among staff who operate or use AI systems, but you're no longer required to guarantee a specific level. In practice: a short internal policy, role-appropriate training for the people who build, operate or rely on AI outputs, and a record of who was trained and when. A few hours of work, and an easy thing to show a customer or regulator.

Step 6: Document your general-purpose AI relationships

If you build on GPT, Claude, Gemini, Llama or similar, the model provider carries the general-purpose AI model obligations (in force since August 2025). You usually don't. But:

• Calling a model through an API and building a product on top of it makes you the provider of your AI system, with whatever obligations its risk tier brings.
• Substantially modifying a model, for example through extensive fine-tuning, can make you a model provider with your own obligations.

Record which models you use, for what, and what your vendor has published about its own compliance.

Part 2: The high-risk roadmap to 2 December 2027

If any of your systems is high-risk under Annex III, the deadline is now 2 December 2027. That's not a reason to stop. Annex IV technical documentation alone typically takes 12 to 18 months for a team doing it alongside product work, and enterprise customers are already asking for it in procurement. The difference is that you can now do it properly instead of in a rush.

Phase A (Q4 2026): Foundations

Step 7: Quality management system (Article 17). Providers need a documented QMS covering design controls, testing, data management, change management, incident handling and accountability. This is the backbone the other documents hang on. SMEs can use simplified routes, and the Omnibus extended simplified documentation and QMS options to small mid-caps as well.

Step 8: Risk management system (Article 9). Document how you identify, evaluate and mitigate risks across the system's lifecycle: discriminatory outcomes, accuracy failures, misuse, adversarial attacks, model drift. It has to be a living process, not a one-off document. Typically 8 to 15 pages per system.

Phase B (H1 2027): Core documentation

Step 9: Data governance (Article 10). Data sourcing and provenance, lawful basis, quality assurance, bias examination and mitigation, gaps in representation. The Omnibus added a clearer legal basis (Article 4a) for processing special category personal data where strictly necessary to detect and correct bias, under strict safeguards. Typically 10 to 20 pages.

Step 10: Technical documentation (Article 11 and Annex IV). System description, intended purpose, architecture, training methodology, performance across relevant groups, known limitations, validation, cybersecurity, and the post-market monitoring plan. Typically 20 to 40 pages per system, and where most of the effort goes.

Step 11: Instructions for use (Article 13). What deployers receive from you: capabilities and limitations, how to interpret outputs, what it must not be used for, human oversight measures, and maintenance. This is a document for your customers, not a public marketing page.

Step 12: Human oversight design (Article 14). How people monitor, interpret, override and stop the system, and how you prevent automation bias. Build this into the product, not just the paperwork.

Phase C (H2 2027): Make it operational

Step 13: Logging (Article 12). Automatic, tamper-evident event logs that let you trace how the system behaved. Most cloud logging stacks can do this if configured deliberately.

Step 14: Accuracy, robustness and cybersecurity (Article 15). Declared accuracy metrics, resilience to errors, and protection against AI-specific attacks such as data poisoning and adversarial inputs.

Step 15: Post-market monitoring and incident reporting (Articles 72 and 73). What you track after launch, the thresholds that trigger investigation, and how you report serious incidents to the authorities.

Step 16: Conformity assessment, declaration and CE marking (Articles 43, 47 and 48). For most Annex III systems this is an internal assessment against your own documentation. Third-party assessment by a notified body is mainly relevant to biometric systems. You then sign an EU declaration of conformity and affix the CE marking.

Step 17: EU database registration (Article 49). Register high-risk systems before placing them on the market. If you conclude that an Annex III system is not high-risk under the Article 6(3) exemption, you still register it, with a simplified set of information after the Omnibus.

If you're a deployer of high-risk AI

If you use someone else's high-risk system, your obligations under Article 26 are lighter but real, and they apply from the same date:

• Use the system according to the provider's instructions, with competent human oversight
• Keep the logs under your control for at least six months
• Inform workers and their representatives before using high-risk AI in the workplace
• Inform people when a high-risk system is used to make or assist decisions about them
• Carry out a Fundamental Rights Impact Assessment (Article 27) if you're a public body, a private entity providing public services, or using AI for credit scoring or life and health insurance pricing

People affected by such decisions also gain a right to an explanation of the AI's role (Article 86).

Ongoing: keep it current

Change management. Any significant change to a system (retraining, new features, new data, a new intended purpose) triggers a compliance review and updated documentation.

Vendor management. Make sure contracts with AI vendors give you access to their documentation, notice of material changes, and a clear split of responsibilities.

Quarterly review. Are systems still correctly classified? Any new ones? Any new guidance from the Commission or the AI Office? Is oversight happening in practice, not just on paper?

The total work estimate

For an SME with 3 to 5 AI systems, one or two of them high-risk:

• Part 1 (inventory, classification, Article 5, Article 50, AI literacy, GPAI): 20 to 40 hours, now
• Part 2 Phase A (QMS, risk management): 30 to 50 hours
• Part 2 Phase B (data governance, technical documentation, instructions, oversight): 60 to 120 hours
• Part 2 Phase C (logging, robustness, monitoring, conformity, registration): 40 to 80 hours

Spread over the next twelve months, that's a few hours a week across product, engineering and compliance. Doing it without tooling means writing every document from scratch. ActScope's Pro tier generates the foundation documents from your system descriptions and tracks every obligation, which cuts the documentation work roughly in half.

What to do this month

1. This week: build the AI inventory. One spreadsheet, one to two hours.
2. This week: classify each system and record your role. The free classifier takes about five minutes per system.
3. Now: confirm nothing breaches Article 5, and check generation safeguards against the 2 December 2026 nudifier ban.
4. Now: close any Article 50 gaps. Chatbot disclosure first, then content labelling, then machine-readable marking before 2 December 2026.
5. This quarter: put AI literacy measures in place and document them.
6. This quarter: if you have high-risk systems, start Phase A of the roadmap.

Start your classification →

Article 50 notices are included from the Starter plan (€39/month). The Pro plan (€99/month, or €83/month billed annually) generates Risk Management Plans, Data Governance Frameworks, Technical Documentation and the rest of the high-risk set, tailored to your systems. Both are cancellable anytime.

---

Common questions

Did the high-risk deadline really move? Yes. The Digital Omnibus on AI (Regulation (EU) 2026/1744) was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. Annex III high-risk obligations now apply from 2 December 2027, and Annex I product-related obligations from 2 August 2028. Article 50 and the earlier deadlines did not move.

What happens if we're not compliant with Article 50 yet? You're already late, since it has applied since 2 August 2026. Breaches of Article 50 can be fined up to €15 million or 3% of global turnover. Chatbot disclosure is usually a small product change, so close it first.

How big are the fines? Up to €35 million or 7% of global turnover for prohibited practices. Up to €15 million or 3% for most other obligations, including high-risk requirements and Article 50. Up to €7.5 million or 1% for supplying incorrect information to authorities. For SMEs and start-ups, the cap is whichever of the two amounts is lower.

Can we use the same documentation for multiple AI systems? Partly. Your QMS, data governance processes, monitoring infrastructure and training programme can be shared. Technical documentation and risk management need to be system-specific where the systems are functionally distinct.

Do we need to do this for AI we buy from someone else? Yes, as a deployer. Your obligations are smaller than a provider's, but they exist: Article 50 disclosures where relevant, AI literacy, and for high-risk systems, oversight, logs, informing workers and affected people, and possibly a Fundamental Rights Impact Assessment.

What about open-source models? Open-source general-purpose models get some reduced obligations at the model level. If you build a product on one, your obligations as the provider of that product are the same as with a commercial model.

Should we do this ourselves or hire consultants? For SMEs with a handful of systems and straightforward use cases, self-serve tooling plus legal review at key milestones is usually enough. For novel, high-stakes or heavily regulated use cases, specialist counsel adds real value.

---

Run the free classifier to start your compliance work →

Related guides:

• The Digital Omnibus Explained: The New EU AI Act Timeline
• Article 50 in Practice: Chatbot Disclosure, AI Content Labels and Watermarking
• Is My AI System High-Risk Under the EU AI Act?
• The EU AI Act for HR Tech: A Vertical Guide
• Article 6(3) Exemption: When Annex III Doesn't Mean High-Risk
• EU AI Act vs GDPR: How They Overlap and Where They Don't