The EU AI Act sets out clear obligations, but knowing what they are and knowing how to meet them are two different things. Working through the EU AI Act compliance checklist gives you a clear understanding of your obligations. This article explains what each requirement means and what meeting it looks like in practice.
Conformity assessment
Before a high-risk AI system can be deployed, providers must demonstrate that it meets the requirements of the Act. For most organizations, this is an internal process, and no third party is required.
The exception is biometric systems, such as facial recognition or emotion recognition tools. These require an independent assessment by an authorized body.
One thing to keep in mind: if a system is substantially modified after its initial assessment, the process needs to be repeated.
Risk management system
A risk management system is an ongoing process that runs throughout the entire lifecycle of a high-risk AI system. In practice, it means identifying and addressing risks before they become problems.
The process has four steps:
- Identifying known and foreseeable risks
- Estimating the likelihood and impact of those risks
- Monitoring for new risks that emerge after deployment
- Putting measures in place to address them
The key word is iterative. The risk management system needs to be reviewed and updated regularly. Testing must be conducted before deployment, and continued monitoring is required after.
Data quality and governance
This obligation requires providers to ensure their training, validation, and testing data meets a defined set of quality standards.
The data must be relevant and sufficiently representative of the people and situations the system will encounter in the real world. It must be examined for potential biases, and appropriate measures must be taken to address any biases identified.
Providers must also document where their data comes from, how it was processed, and what assumptions were made in preparing it. If gaps or shortcomings in the data are identified, those must be addressed before deployment.
One practical note: if bias testing requires processing sensitive personal data such as ethnicity or health information, the Act allows this under strict conditions, but only for the purpose of detecting and correcting bias, and the data must be deleted once that purpose is fulfilled.
Technical documentation
Technical documentation is the paper trail that proves your system complies with the Act. It must be prepared before deployment and kept up to date throughout the system's lifecycle.
The documentation needs to be detailed enough for regulators and auditors to assess whether the system meets the Act's requirements. At minimum it covers how the system works, what it was designed to do, the data it was trained on, its known limitations, and the results of testing and risk assessments.
For smaller organizations, the Act provides a simplified documentation format specifically designed for SMEs and startups, so the burden is proportionate to the size of the organization.
Human oversight mechanisms
The Act requires that high-risk AI systems are designed and deployed in a way that allows humans to effectively monitor, understand, and intervene in their outputs. This obligation applies to both providers and deployers, but in different ways.
Providers must build oversight capabilities into the system itself, ensuring it can be monitored, paused, or overridden by the people using it.
Deployers must assign oversight to specific individuals who have the competence, training, and authority to act. Oversight is not a passive role — the designated person must be capable of interpreting the system's outputs and making independent judgments when needed.
No high-risk AI system can be the sole decision-maker in consequential situations. A human must always be in a position to review and if necessary override the outcome.
EU database registration
Before a high-risk AI system can be deployed, providers must register it in a publicly accessible EU database managed by the European Commission. This creates a centralized record that regulators and the public can access.
Registration requires submitting basic information about the system: contact details, a description of what it does and how it works, its current status, and a copy of the EU declaration of conformity. For systems that have undergone third-party assessment, the relevant certificate must also be included. The registration must be kept up to date throughout the system's lifecycle.
For deployers that are public authorities, there is an additional obligation: if a system they intend to use is not registered in the database, they cannot use it.
Monitor system performance and log activity
Deployers are required to monitor the performance of high-risk AI systems throughout their use and maintain logs of their operation. Logs must be kept for a minimum of six months unless other applicable law requires a longer retention period.
Monitoring is not passive record-keeping. If a deployer identifies that a system is presenting a risk, they are required to inform the provider and the relevant market surveillance authority, and suspend use of the system if necessary.
Staff training and AI literacy
Everyone in your organization who works with AI systems must have a sufficient understanding of what those systems do, how they work, and what their limitations are. This does not mean technical expertise, it means informed use.
For high-risk systems specifically, the individuals assigned to oversight must have the competence and training to interpret outputs and intervene when needed. For the rest of the organization, the requirement is baseline AI literacy appropriate to their role.
Serious incident reporting
Providers of high-risk AI systems must report serious incidents to the market surveillance authority in the member state where the incident occurred. The standard reporting window is 15 days from becoming aware of the incident. For widespread incidents the window is 2 days, and in the event of a death, 10 days.
Deployers who become aware of a serious incident must inform the provider immediately. If the provider cannot be reached, the deployer reports directly to the relevant authorities.
Label AI content and inform users
Organizations operating limited-risk AI systems have two transparency obligations. Users must be told when they are interacting with an AI system. This applies to chatbots and any system that could be mistaken for a human. AI-generated content, including text, images, audio, and video, must be labeled as such.
Conclusion
These obligations may look extensive on paper. In practice, most organizations find that the hardest part is knowing where to start, not the requirements themselves. If you have worked through the compliance checklist and identified your risk tier, you already have what you need to begin.