EU AI Act Compliance Checklist for 2025

The EU AI Act (Regulation 2024/1689) is the world's first comprehensive legal framework for artificial intelligence. It entered into force on 1 August 2024 with a staged implementation timeline. This guide breaks down every obligation by role, risk level, and deadline.

Key Deadlines

Prohibited AI Practices (Article 5)

The following AI practices are banned outright, with fines up to EUR 35 million or 7% of global annual turnover:

• Subliminal manipulation or deceptive techniques causing significant harm
• Exploitation of vulnerabilities due to age, disability, or social/economic situation
• Social scoring by public authorities leading to detrimental treatment
• Real-time remote biometric identification in public spaces for law enforcement (with narrow exceptions)
• Untargeted scraping of facial images from the internet or CCTV for facial recognition databases
• Emotion recognition in workplaces and educational institutions (with narrow exceptions)
• Biometric categorisation to infer race, political opinions, trade union membership, religious beliefs, or sexual orientation
• Individual predictive policing based solely on profiling

Provider Obligations (Article 16)

Providers of high-risk AI systems bear the heaviest compliance burden. Before placing a system on the market or putting it into service, providers must:

1. Risk management system (Art. 9) — Establish a continuous, iterative process throughout the AI system's entire lifecycle
2. Data governance (Art. 10) — Ensure training, validation, and testing datasets meet quality criteria with appropriate statistical properties
3. Technical documentation (Art. 11, Annex IV) — Prepare comprehensive documentation covering all 9 required sections before market placement
4. Record-keeping (Art. 12) — Build in automatic logging capabilities proportionate to the system's intended purpose
5. Transparency (Art. 13) — Design the system so deployers can interpret output and use it appropriately
6. Human oversight (Art. 14) — Implement measures enabling effective human oversight during the system's use
7. Accuracy, robustness & cybersecurity (Art. 15) — Achieve appropriate levels throughout the lifecycle
8. Quality management system (Art. 17) — Document policies and procedures ensuring ongoing compliance
9. Conformity assessment (Art. 43) — Complete the appropriate assessment procedure before market placement
10. EU Declaration of Conformity (Art. 47) — Draw up and keep updated for each high-risk AI system
11. CE marking (Art. 48) — Affix visibly, legibly, and indelibly to the system
12. EU database registration (Art. 49) — Register the system and the provider in the EU database before market placement

Deployer Obligations (Article 26)

Organisations that use high-risk AI systems (deployers) have their own set of obligations:

• Use per instructions — Implement appropriate technical and organisational measures to use the system according to the provider's instructions for use
• Human oversight — Assign qualified persons with necessary competence, training, authority, and support to oversee the system's operation
• Input data relevance — Where the deployer controls the input data, ensure it is relevant and sufficiently representative for the intended purpose
• Monitoring — Monitor the system's operation based on the instructions for use and inform the provider of any risks or serious incidents
• Log retention — Keep automatically generated logs for at least 6 months
• Worker notification — Inform workers' representatives and affected workers before deploying a high-risk AI system in the workplace
• Fundamental rights impact assessment — For certain deployers (public bodies, private entities providing public services), conduct an assessment of the system's impact on fundamental rights before use

Importer & Distributor Obligations

Importers (Articles 23) must verify that the provider has completed the conformity assessment, prepared technical documentation, affixed CE marking, and appointed an authorised representative. They must not place a non-conforming system on the market.

Distributors (Article 24) must verify CE marking, the EU declaration of conformity, and instructions for use are present. They must ensure storage and transport conditions don't jeopardise compliance.

Penalty Structure (Article 99)

For SMEs and start-ups, fines are capped at the lower of the percentage or fixed amount. Mitigating factors include self-reporting, degree of cooperation, and technical measures already implemented.