EU AI Act compliance means identifying every AI system you build or use, classifying it by risk (prohibited, high-risk, transparency), determining your legal role, closing the gaps against the rules that apply, and documenting the result. Do it in that order.
The Act is binding, it phases in over several dates, and part of it is already in force. Yet according to the Center for Data Innovation, fewer than 30% of small and medium-sized enterprises in Europe had started their compliance process as of 2026. This guide gives you a sequenced checklist, not a legal summary.
What is EU AI Act compliance, and does it apply to you?
The EU AI Act (the regulation behind the "ai act" searches you may have seen) sets rules for AI systems based on how much harm they could cause. EU AI Act compliance is the work of showing that each system you build or use meets the rules for its risk level and for your role in its supply chain.
In practice, that means four things: knowing what AI you have, knowing which rules apply to each system, fixing what falls short, and keeping records that prove it.
Does it apply to you? Probably, if any of these is true:
- You build or sell AI systems in the EU market.
- You use AI systems in your business operations, even ones you bought from a vendor.
- You are based outside the EU, including in the US, but your system's output is used in the EU.
If your company has a chatbot answering EU customers, a screening tool used on EU applicants, or a model sold to EU buyers, plan as if the Act covers you.
What are the EU AI Act compliance deadlines for 2026 and beyond?
The Act phases in over time, so "the 2026 deadline" is one date among several. Treat this table as a planning aid and confirm each date against the current legal text before you commit budget to it.
| Date | What applies |
|---|---|
| February 2025 | Bans on prohibited AI practices |
| August 2026 | Transparency duties under Article 50, plus other general provisions |
| December 2027 | Later date for certain high-risk obligations |
The Digital Omnibus on AI shifted some high-risk dates. Because of that, don't assume every high-risk duty lands in August 2026. Check which of your systems fall under the later dates, and read the current text before you rely on any single deadline.
Is the Act mandatory? Yes. It is a regulation, not a voluntary code. The penalties show how seriously it is meant: violations involving prohibited AI practices can bring fines of up to €35 million, according to ActScope's 2026 compliance checklist. That figure is vendor-reported, so verify it against the Act itself.
The practical takeaway: bans are the first thing to check, and transparency is the next date to plan around.
Step 1: Build an AI registry of every system in use
Every later step depends on this one: you can't classify, assign roles, or close gaps for systems you don't know exist. Start with a single registry, a living list of every AI system your organization builds, buys, or runs. This is the first item on any EU AI Act compliance checklist.
Cast the net wider than you expect. Include:
- AI features inside software you already pay for, such as a CRM's lead scoring or a helpdesk's auto-replies.
- Tools your teams adopted on their own, such as a writing assistant or a resume screener.
- Agents and automations that call tools and data sources without anyone watching them day to day.
For each system, record a handful of fields:
- Name and vendor: what it is and who supplies it.
- Owner: the named person accountable for it.
- Purpose: what it decides or produces, and for whom.
- Data used: what it reads, including personal data.
- Where it runs: which teams, markets, and regions it touches.
Say your sales team uses a vendor tool that scores inbound leads. The registry entry names the vendor, the sales operations lead as owner, "ranks leads for follow-up" as the purpose, and CRM contact data as the input. That one row is enough to classify it in the next step.
Spreadsheets work for a small firm. Once agents multiply, manual lists go stale fast. A platform like Trust3 AI can discover AI agents across your environment and show their prompts, tool calls, and data access, which feeds the registry and later monitoring. It does not classify risk or certify compliance; that judgment stays with you and your legal advisers. The agent security controls are most useful once the registry exists and you need to see what each agent actually does.
Step 2: What does the EU AI Act prohibit, and how do you classify risk?
The Act sorts AI systems into tiers, and each system in your registry lands in one of them. Prohibited practices are banned outright. High-risk systems carry the heaviest obligations. Transparency-only systems must tell people they are dealing with AI. Everything else is minimal risk, with no specific duties under the Act. Work through your registry one row at a time and assign a tier to each.
What is banned outright? Prohibited practices include AI that manipulates people in harmful ways, exploits vulnerabilities, or scores people socially in ways that lead to unfair treatment. Check this tier first, because these bans already apply and carry the steepest penalties described earlier.
Here are examples of how real systems sort:
- Prohibited: a system that exploits a user's vulnerabilities to push them into a decision against their interest. Stop using it.
- High-risk: a tool that screens job applicants or ranks them for hiring. Decisions about people's jobs, credit, or access to services draw the strictest rules.
- Transparency: a customer chatbot. You must make clear to users that they are talking to AI.
- Minimal risk: a spam filter or an internal tool that tidies meeting notes. No specific Act duties.
Take the lead-scoring tool from your registry. It ranks sales prospects, not people applying for jobs or credit, so it most likely sits in minimal risk. Write down your reasoning anyway, since a documented decision is better than an assumed one.
Don't assume most of your systems will be heavily regulated, either. A 2023 study of German AI products, run against the initial draft of the Act, found that only about 30% would be subject to regulation and the rest were low-risk. That study predates the final text, so treat it as a sign that many systems land in lighter tiers, not as a current share.
To scope quickly, try the Future of Life Institute's EU AI Act Compliance Checker. It helps you judge whether a system falls within the regulation and at what risk level. It is a diagnosis only: it produces no exportable report and no list of next steps, and it does not certify anything. Use it to check your reasoning, not to replace it.
Step 3: Determine your legal role for each AI system
Your obligations depend on both the risk tier and your role, so decide your role for every system in the registry. The Act names several roles, and the two you will meet most are provider and deployer.
- Provider: you develop an AI system, or have one developed, and place it on the market or put it into service under your own name.
- Deployer: you use an AI system in your own operations, under your authority.
- Importer: you bring a system from a non-EU provider into the EU market.
- Distributor: you make a system available in the supply chain without being its provider or importer.
The same company can hold different roles for different systems, and sometimes more than one for a single system. Run the question per row of the registry: who built this, who sells it, and who runs it?
Here is a worked example. Say your company takes a third-party language model and fine-tunes it on your own support tickets, then sells the result inside your product to EU customers. For the base model, you are a deployer. For the fine-tuned product you ship under your own name, you may well be the provider, and provider duties are heavier. The more you change a system, the more likely you are to take on the provider role.
A simple rule helps: if your name is on the product and you shaped how it works, assume provider until a legal adviser says otherwise. If you only switch on a vendor's tool and use it as shipped, you are probably a deployer.
Add a "role" column to your registry now, and mark any row where the answer is unclear. Those unclear rows are the ones to bring to counsel, since the role decides which obligations land on you.
Step 4: Run a gap analysis against your obligations
With tier and role recorded, compare what you do today with what each system requires. A gap analysis is that comparison: for each system, list the obligations that apply, note what you already have, and mark what is missing. The output is a prioritized list you can reuse as an EU AI Act compliance checklist.
Build it in three passes:
- List the obligations per system. Start from its tier and your role. A deployer of a high-risk hiring tool has different duties from the provider of a transparency-only chatbot.
- Check current practice. For each obligation, ask whether you have a document, a process, or a named owner for it. If you can't point to one, it is a gap.
- Rank the gaps. Put prohibited-practice issues first, then high-risk gaps, then transparency gaps, then the rest.
A completed row might look like this:
| System | Tier | Your role | Gap | Priority |
|---|---|---|---|---|
| Applicant screening tool | High-risk | Deployer | No record of human review of its rankings | High |
| Support chatbot | Transparency | Provider | No notice telling users they are talking to AI | Medium |
| Lead scoring | Minimal | Deployer | No written reason for the tier decision | Low |
Keep the list short enough to act on. A sheet with 80 vague gaps stalls; a sheet with ten dated, owned actions gets done. Give each gap an owner and a target date.
Being late is common, not shameful. Most European SMEs have not yet started, so a finished gap list already puts you ahead of them.
Step 5: How do you meet Article 50 transparency and conformity assessment rules?
Article 50 requires you to tell people when they are dealing with AI, and high-risk systems must pass a conformity assessment before they go to market. Both items come straight from your gap list, so work through them in that order.
Start with transparency, because it covers the most systems. If a chatbot talks to your EU customers, say plainly at the start of the conversation that it is AI. Check the current text of Article 50 for the other cases it covers, such as AI-generated content, and add a notice to every system that falls under it. Put the wording in your registry so you can show what users saw.
For high-risk systems, plan for a shift in mindset. A readiness assessment asks, "Are we ready?" Conformity assessment under Article 43 asks you to prove it, through documented checks you complete before the system is placed on the market. Work through these steps:
- Confirm your role. Providers carry the main workload; deployers rely on the provider's work.
- As a provider, list the requirements that apply to your system and attach evidence for each one (technical documentation, risk management records, testing results).
- Record who signed off and on what date, and store the file where auditors can find it.
- As a deployer, ask your vendor for their conformity evidence, keep a copy on file, and note any gaps in your gap list.
What about smaller companies? The EU defines an SME as a business with fewer than 250 employees. The Act is meant to ease the documentation load for smaller firms, but confirm exactly what applies to you with a legal adviser before you assume a shortcut. Don't skip records because you are small.
Prices and plan limits verified as of November 2026.
FAQs
Does the EU AI Act apply to companies based in the US?
Yes, it can. Where your company is headquartered is not the test. If you place an AI system on the EU market, or the output of your system is used in the EU, the Act can cover you. A US firm with a chatbot serving EU customers should plan as if the rules apply.
Is the EU AI Act mandatory for small and medium-sized enterprises?
Yes. It is a regulation, not a voluntary code, and it applies to businesses of any size. The EU defines an SME as a business with fewer than 250 employees. Smaller firms may get lighter documentation treatment, but the core duties still apply, so confirm the details for your case.
What does the EU AI Act prohibit outright?
It bans practices such as AI that manipulates people in harmful ways, exploits their vulnerabilities, or scores people socially in ways that lead to unfair treatment. These bans already apply. Violations involving prohibited practices draw the highest penalties under the Act.
What is the difference between a provider and a deployer under the AI Act?
A provider develops an AI system, or has one developed, and offers it under its own name. A deployer uses a system in its own operations. Provider duties are heavier. If you fine-tune a model and ship it as your product, you may count as a provider.
How much can a company be fined for breaking the EU AI Act?
Fines are highest for prohibited AI practices, and other violations carry different penalty levels. Check the exact amounts in the legal text before you set a risk budget.
What is the Digital Omnibus on AI and does it change my deadlines?
It is a legislative change that affects the timing of some high-risk obligations. Don't assume every high-risk duty lands in August 2026. Check the current legal text, and have counsel confirm which dates apply to each of your systems.
Conclusion
EU AI Act compliance is a sequence, not a single deadline: inventory your systems, classify the risk, fix your role, find the gaps, then meet transparency and conformity duties. Most firms have not started, so a finished registry and gap list already sets you apart.
Do two things first. Build your registry this week, including vendor tools and unattended agents. Then check every row against the prohibited tier, since bans are the rules already in force.
Related Articles
