Home Insights Guides EU AI Act checklist for companies

EU AI Act checklist for companies

What a company has to do under the EU AI Act, as amended by the Digital Omnibus in July 2026: list its AI systems, classify their risk, map the obligations of its role and plan for each deadline.

Written and reviewed by Solorai

In short

Under the EU AI Act, a company lists its AI systems, classifies each use by risk, works out whether it is the provider or the deployer, and meets the obligations of that role by the date they apply. The bans on prohibited practices and the AI literacy duty already apply, transparency obligations since 2 August 2026, and high-risk obligations from 2 December 2027.

This checklist follows the Act as amended by Regulation (EU) 2026/1744, the Digital Omnibus. It is a planning tool, not legal advice.

Who the AI Act applies to

The AI Act applies to organisations that develop, supply or use AI systems in the EU, including companies based outside the EU whose AI systems are placed on the EU market or whose output is used in the EU. What you have to do depends on your role for each system:

Provider: develops an AI system or a general-purpose AI model, or has one developed, and places it on the market or puts it into service under its own name.
Deployer: uses an AI system under its authority in a professional activity, such as a company using a vendor’s recruitment tool.
Importer and distributor: bring a system from outside the EU to the EU market, or make it available there.

Most companies are deployers. A deployer becomes a provider if it puts its name or trademark on a high-risk system, makes a substantial modification to one, or changes the purpose of a system so that it becomes high-risk.

The deadlines

The dates follow the AI Act as amended by Regulation (EU) 2026/1744, the Digital Omnibus, in force since 27 July 2026.

1 Aug 2024The AI Act enters into force.
2 Feb 2025Prohibited practices are banned, and the AI literacy obligation applies.
2 Aug 2025Rules for general-purpose AI models, governance and penalties apply.
2 Aug 2026Transparency obligations under Article 50 apply. The AI Office can enforce the rules for general-purpose AI models, and national authorities supervise AI literacy.
2 Dec 2026Two new prohibitions apply, on AI that creates non-consensual intimate or sexual images and on child sexual abuse material. Generative systems already on the market before 2 August 2026 must mark their output by this date.
2 Aug 2027General-purpose AI models placed on the market before 2 August 2025 must comply.
2 Dec 2027Obligations for high-risk uses listed in Annex III apply.
2 Aug 2028Obligations for high-risk AI in products covered by Annex I apply.
2 Aug 2030High-risk systems used by public authorities that were already on the market must comply.

Step 1: List every AI system

Collect the AI tools people useAssistants such as Claude, ChatGPT, Copilot or Gemini, with the plan and the teams using them.
Find the AI inside your softwareFeatures in HR, CRM, finance and security tools that rely on AI, from screening to scoring.
Add what you buildModels, agents and automations developed in-house or by a partner.
Record the purpose and the dataWhat each system is used for, which data it uses and who is affected by its output.
Assign an owner and a roleA named person for each system, and whether you are its provider or its deployer.

Step 2: Classify the risk

Every use falls into one of four levels. Classify each use, not each product: the same assistant can be minimal risk for drafting emails and high-risk when it is used to screen job applicants.

Level	What it covers	What it means for you
Prohibited	Practices banned by Article 5, such as social scoring or emotion recognition at work, and from 2 December 2026 AI that creates non-consensual intimate images	Stop using it
High risk	Uses listed in Annex III, such as recruitment, credit scoring and access to essential services, and AI in products covered by Annex I	Full obligations from 2 December 2027 or 2 August 2028
Transparency	Systems that interact with people, generate content or create deepfakes	Inform people and mark content, under Article 50, since 2 August 2026
Minimal	Most other uses, such as drafting, summarising and analysis	No specific obligations beyond AI literacy

Check one AI use with the EU AI Act risk check.

The Commission published guidelines on the definition of an AI system and on prohibited practices in February 2025, and draft guidelines on high-risk classification in May 2026. High-risk systems already on the market before their date are covered only if they are significantly changed afterwards; those used by public authorities must comply by 2 August 2030.

Step 3: Map the obligations of your role

Every provider and deployer

Take measures to support the AI literacy of staff and of other people who operate or use AI systems on your behalf, under Article 4.

Deployers of high-risk systems, under Article 26

Use the system as instructedFollow the provider’s instructions for use.
Assign human oversightTo people with the competence, training and authority to do it.
Control the input dataWhere you control it, keep it relevant and representative for the purpose.
Monitor and reactIf a risk appears, inform the provider and the authority and suspend use. Report serious incidents.
Keep the logsFor at least six months.
Inform peopleTell workers and their representatives before using high-risk AI at work, and tell people when such a system is used in decisions about them.
Use the provider’s informationIn your data protection impact assessment under the GDPR.

Providers of high-risk systems

Risk management, data governance, technical documentation, logging, instructions for deployers, human oversight, accuracy, robustness and cybersecurity, a quality management system, conformity assessment, CE marking, registration in the EU database and post-market monitoring.

Transparency, under Article 50

Providers design systems that interact with people so that those people know they are dealing with AI, unless it is obvious, and mark AI-generated content in a machine-readable way. Deployers disclose deepfakes, and AI-generated text published to inform the public on matters of public interest unless a person has reviewed it and holds editorial responsibility. The Commission published guidelines on these obligations on 20 July 2026.

Providers of general-purpose AI models

Technical documentation, information for the companies that build on the model, a copyright policy and a public summary of the training content, with further duties for models with systemic risk. The General-Purpose AI Code of Practice of July 2025 is a recognised way to show compliance.

Step 4: Build AI literacy

Article 4 has applied since 2 February 2025. As amended in July 2026, it requires providers and deployers to take measures to support the AI literacy of their staff and of others who use AI on their behalf, without having to guarantee any specific level. National authorities supervise it from 2 August 2026, and no certificate is required.

Map who uses which systemsBy role, from occasional users to the people who oversee high-risk systems.
Train by roleOpportunities, risks and the rules of your AI policy, matched to each role and system.
Keep a recordWho was trained, when and on what, to show the measures you took.

See AI literacy training under Article 4.

Step 5: Set up governance

Write an AI policyApproved tools, permitted data, review of outputs and who decides on new uses.
Keep an AI registerThe inventory from step 1, kept current, with the risk level and owner of each system.
Check your vendorsAsk providers for their AI Act documentation and instructions for use, and build them into contracts.
Set an incident processHow problems are reported, assessed and, for high-risk systems, notified to the authorities.
Review every quarterNew tools, new uses and new guidance from the Commission.

A management system standard such as ISO/IEC 42001 gives this governance a structure that auditors recognise.

Fines

Breach	Maximum fine
Prohibited practices	EUR 35 million or 7% of worldwide annual turnover
Obligations of operators, including deployers and transparency	EUR 15 million or 3%
Incorrect, incomplete or misleading information to authorities	EUR 7.5 million or 1%

The higher of the two amounts applies. For SMEs and start-ups the lower one applies, in every tier, and small mid-caps benefit from the lower amount in the two lower tiers.

Sources

FAQ

Questions about the EU AI Act

When does the EU AI Act apply?

In stages: prohibited practices and AI literacy since 2 February 2025, rules for general-purpose AI models since 2 August 2025, transparency since 2 August 2026, two new prohibitions from 2 December 2026, high-risk uses in Annex III from 2 December 2027 and high-risk products in Annex I from 2 August 2028.

Does the AI Act apply to companies outside the EU?

Yes, when they place AI systems or models on the EU market, or when the output of their AI systems is used in the EU.

What is the difference between a provider and a deployer?

A provider develops an AI system, or has it developed, and supplies it under its own name. A deployer uses an AI system under its authority for professional purposes. Most companies are deployers of the AI tools they buy.

What are the fines under the EU AI Act?

Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, EUR 15 million or 3% for most other obligations, and EUR 7.5 million or 1% for incorrect information, whichever is higher. For SMEs and start-ups, whichever is lower.

Do we need an AI literacy certificate?

No. Article 4 requires measures to support the AI literacy of staff, matched to their roles and the systems they use. No certificate is required, but a record of the training helps show what you did.

Get ready for the AI Act. Start with a 30-minute briefing.

Tell us which AI systems you use today. We will reply with a clear next step.

Book a briefing Email us