EU AI Act Compliance Checklist: 2026 Update

What are the key EU AI Act dates?

• 2 February 2025: prohibited practices banned; AI-literacy provisions apply.
• 2 August 2025: general-purpose AI (GPAI) model obligations apply.
• 2 August 2026: Article 50 transparency duties apply (chatbots, deepfakes, AI-generated text).
• 2 December 2026: new bans on AI that generates non-consensual intimate imagery or child sexual abuse material; marking deadline for generative systems already on the market.
• 2 December 2027: high-risk obligations for Annex III systems (for example hiring, education, credit scoring, critical infrastructure).
• 2 August 2028: high-risk obligations for AI in products covered by Annex I (for example toys, lifts and medical devices).

These dates reflect Regulation (EU) 2026/1744, the Digital Omnibus on AI, which amended the Act from 27 July 2026. Our EU AI Act timeline explains each change, and the EU AI Act guide and glossary entry cover the regulation itself.

How do you work through the checklist?

Step 1 — Inventory your AI systems

You cannot classify what you have not catalogued. Build an inventory of every AI system you develop, deploy or embed, recording for each:

• Its purpose and the decisions it influences
• Whether you act as a provider, deployer, or both
• The data it is trained on and operates over
• Where and to whom it is made available

This inventory is the foundation for every later step and overlaps with the data mapping you may already maintain for the GDPR.

Step 2 — Classify each system by risk tier

The Act applies obligations according to risk:

• Prohibited: practices such as social scoring or harmful manipulation are banned outright.
• High-risk: systems used in the areas listed in Annex III, or as safety components of products in Annex I, carry the most extensive obligations.
• Limited-risk: systems that interact with people (for example, chatbots) or generate synthetic content carry transparency duties.
• Minimal-risk: most other AI faces no specific obligations.

Record your role for each system: provider, deployer, importer or distributor. The duties differ. Document the rationale for each classification and revisit it when a system changes.

Step 3 — Eliminate prohibited practices

For any system that falls into a prohibited category, the only compliant path is to stop the practice. Confirm that none of your systems engage in banned uses, including the two bans that apply from 2 December 2026, and record the assessment as evidence.

Step 4 — Meet high-risk obligations (by 2 December 2027 or 2 August 2028)

High-risk systems require a coordinated control set:

• Risk management system: a continuous process to identify and mitigate risks across the lifecycle
• Data governance: controls over training, validation and testing data quality and representativeness
• Technical documentation: enough detail to demonstrate conformity
• Record-keeping: automatic logging of system events for traceability
• Transparency: clear information that lets deployers use the system correctly
• Human oversight: measures allowing meaningful human intervention
• Accuracy, robustness and cybersecurity: appropriate performance and resilience measures
• Quality management system: organizational processes that keep the system conformant
• Conformity assessment: completed before placing the system on the market
• Registration: register Annex III systems in the EU database before placing them on the market (Article 49)
• Post-market monitoring and incident reporting: monitor performance in use and report serious incidents (Articles 72 and 73)
• Fundamental rights impact assessment: required before use by deployers that are public bodies or provide public services, and by deployers of credit-scoring and life or health insurance pricing systems (Article 27)

Many of these map onto controls you already operate for security and privacy. Control mapping lets you reuse that work rather than duplicate it.

Step 5 — Apply transparency duties

People must be told when they are interacting with an AI system unless it is obvious, and synthetic audio, image, video and text must be marked as AI-generated in a machine-readable way. Deployers must disclose deepfakes and AI-generated text published to inform the public. These duties have applied since 2 August 2026; generative systems already on the market before then have until 2 December 2026 to add marking.

Step 6 — Check general-purpose AI duties

If you provide a general-purpose AI model, you need technical documentation, a copyright policy and a public summary of the content used for training; models with systemic risk also need evaluations, serious-incident reporting and cybersecurity protections. If you build on a third-party model, collect the provider's documentation for your own file.

Step 7 — Operationalize governance and oversight

The Act expects governance to be ongoing, not a one-time exercise. Align your program with a recognized framework such as the NIST AI RMF, which structures AI risk work into GOVERN, MAP, MEASURE and MANAGE functions. Assign clear ownership, define human-oversight procedures, and schedule periodic review of each system's classification and controls.

Step 8 — Maintain continuous evidence

As with security frameworks, you must be able to demonstrate conformity, not just assert it. Maintain current documentation, event logs, risk assessments and oversight records. Continuous evidence collection keeps this material current as systems evolve and makes a conformity assessment or regulator inquiry far less disruptive.

What did the 2026 Digital Omnibus change?

It postponed the high-risk deadlines, added two prohibited practices (AI-generated non-consensual intimate imagery and child sexual abuse material), extended some SME simplifications to small mid-caps, softened the AI-literacy duty, simplified registration for systems a provider assesses as not high-risk, and gave the AI Office wider supervision of AI built on general-purpose models. The high-risk requirements themselves stay largely the same; what changed is when they apply.

How does it all fit together?

The EU AI Act rewards organizations that treat AI governance as an extension of their existing compliance program rather than a separate silo. Inventory and classify first, apply tier-appropriate controls, reuse mapped controls across frameworks, and keep evidence continuous. To see how ComplyEasyAI supports this, visit the EU AI Act guide or read what AI compliance involves.