Many organisations still cannot say which AI systems they run, which role they hold for each one under the EU AI Act, and which obligations already apply to them today. This readiness checklist is a self-assessment for providers and deployers: twelve checks mapped to the Act's own article numbers, each with a measure, a data source type and green, amber and red bands, plus a cadence table, a findings log and a remediation map. It is run by the AI governance or compliance lead with legal, security and product owners, and signed off by the accountable executive. What the Act requires in full is covered in the EU AI Act Compliance Guide; this page tests whether you are ready for it.
Status (checked 13 November 2026): article references follow the consolidated text published by the European Commission's AI Act Service Desk as at 27 July 2026, which includes the amendments made by Regulation (EU) 2026/1744, the Digital Omnibus on AI. Prohibitions and AI literacy have applied since 2 February 2025, and most of the Act, including the Article 50 transparency duties, since 2 August 2026. New prohibitions in Article 5(1)(ba) and (bb) apply from 2 December 2026. High-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for systems covered by Annex I. Dates have moved once already; check the EU AI Act Implementation Timeline Tracker before relying on them.
What this health check covers
If you are asking "am I ready for the EU AI Act", this is the self-assessment. It covers the ten areas most organisations need to evidence: the AI system inventory, role determination, risk class assignment, the prohibited practice screen, fundamental rights impact assessment (FRIA) coverage, Article 50 notices, AI literacy, quality management system documents, the post-market monitoring plan and the conformity assessment route. Two further checks cover deployer log retention and registration.
It does not explain each obligation; the article guides do that and are linked from the remediation map. General-purpose AI model obligations in Chapter V are out of scope here: model providers need their own assessment. It parallels the NIS2 Readiness Checklist and DORA Readiness Checklist, so organisations under several EU regimes can run them in one cycle.
Key takeaways
- Inventory and role come first: every other check depends on a complete list of AI systems and a recorded decision on whether you are the provider, the deployer or both for each.
- Some duties are already live: prohibitions, AI literacy and Article 50 transparency apply now, so gaps there are current non-compliance, not future risk.
- High-risk work has a longer runway, not a pass: Annex III obligations apply from 2 December 2027, and quality management, technical documentation and conformity assessment take longer than most plans assume.
- A "not high-risk" decision is evidence too: a provider relying on the Article 6(3) derogation must document the assessment and register the system under Article 49(2).
- Deployers have their own list: instructions for use, human oversight, six-month log retention, worker information and, for some, a FRIA before first use.
How to use this template
Copy the checklist table and the findings log into your own tracker. Start with checks R1 and R2, because they set the denominator for everything else, then score each remaining check against its bands and record every amber or red result as a finding with an owner and a due date. Mark checks that do not apply to your role as "not applicable" with a one-line reason; an unexplained gap reads as a missed obligation. Repeat the run at the cadence below and keep each completed version as evidence of ongoing compliance work.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| New AI system intake (R1 to R4) | Before each new system or use case goes live | Product or business owner | AI governance lead | Intake form, role and risk class decision, prohibited practice screen |
| Transparency and literacy (R6, R7) | Quarterly | AI governance lead | Compliance lead | Notice inventory, screenshots of disclosures, training and awareness records |
| Full readiness run (R1 to R12) | Twice a year until December 2027, then yearly | AI governance lead | Accountable executive | Checklist workbook, findings log, sign-off record |
| High-risk documentation (R5, R8 to R10) | Quarterly for systems in Annex III or Annex I scope | System owner with quality lead | Legal | FRIA records, QMS documents, technical documentation index, monitoring plan |
| Independent re-performance | Yearly | Internal audit or second line | Audit or risk committee | Re-performed samples, variance notes |
Metrics
Each check is a readiness metric with a formula. NHI Mgmt Group recommended thresholds; adjust to your risk appetite. Where a duty already applies, anything below green is a compliance gap, not a planning gap.
| ID | Check (article) | Formula (numerator / denominator) | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| R1 | AI system inventory (basis for all articles) | AI systems and use cases found by discovery (procurement records, software inventory, cloud and SaaS logs, survey) that are in the AI register / all found | AI register; procurement and software inventory; SaaS discovery | ≥ 98% | 90% to below 98% | < 90% |
| R2 | Role determination (Art 3, Art 25) | Registered systems with a recorded role decision (provider, deployer, importer, distributor) and rationale / registered systems | AI register role field; legal decision log | 100% | 90% to below 100% | < 90% |
| R3 | Risk class assignment (Art 6, Annex I, Annex III) | Registered systems with a documented risk class, including any Article 6(3) derogation reasoning / registered systems | Classification records; Article 6(4) assessments | 100% | 90% to below 100% | < 90%, or any Annex III system that profiles people classed as not high-risk |
| R4 | Prohibited practice screen (Art 5) | Registered systems screened against Article 5(1)(a) to (h), and (ba) and (bb), in the last 12 months / registered systems | Screening records | 100% and no open hits | 90% to below 100%, no open hits | < 90%, or any unresolved possible hit |
| R5 | FRIA coverage (Art 27) | In-scope high-risk deployments with a FRIA completed before first use and notified to the market surveillance authority / in-scope high-risk deployments | FRIA records; notification receipts; DPIA cross-references | 100% | Plan in place for every in-scope deployment, completion below 100% | Any in-scope deployment live without a FRIA or plan |
| R6 | Article 50 notices (Art 50(1) to (5)) | Systems in Article 50 scope with the required disclosure or marking in place and tested / systems in Article 50 scope | Notice inventory; user interface captures; content marking test results | 100% | 95% to below 100%, gaps scheduled | < 95% |
| R7 | AI literacy measures (Art 4) | Staff and contractors operating or using AI systems who received role-relevant AI literacy measures in the last 12 months / that population | Learning records; role mapping from the AI register | ≥ 90% | 70% to below 90% | < 70%, or no measures defined |
| R8 | QMS documents (Art 16(c), Art 17) | Article 17(1)(a) to (m) aspects documented and approved / 13, per high-risk system or shared QMS | QMS document register | 13 of 13 | 10 to 12 | Below 10 |
| R9 | Post-market monitoring plan (Art 72) | High-risk systems (provider role) with an approved monitoring plan in the technical documentation / high-risk systems (provider role) | Technical documentation index; monitoring plans | 100% | Draft for every system, approved below 100% | Any system with no plan or draft |
| R10 | Conformity route (Art 43) | High-risk systems (provider role) with the route selected and evidenced (Annex VI internal control, Annex VII notified body, or sectoral procedure) / high-risk systems (provider role) | Conformity assessment plan; harmonised standards gap analysis | 100% | 80% to below 100% | < 80% |
| R11 | Deployer log retention (Art 26(6)) | High-risk deployments where logs under the deployer's control are kept for at least six months / high-risk deployments | Logging configuration; retention policy | 100% | 90% to below 100% | < 90% |
| R12 | Registration (Art 49, Art 6(4)) | Systems that must be registered in the EU database and have a registration record or dated plan / systems that must be registered | Registration records; AI register | 100% | Plan for every system, registration below 100% | Any system with no record or plan |
For R5, the FRIA duty falls on deployers that are bodies governed by public law, private entities providing public services, and deployers of the credit scoring and life and health insurance pricing systems in Annex III point 5(b) and (c); Annex III point 2 systems are excluded. Article 27(4) now lets a deployer cross-reference an existing data protection impact assessment. For R8, Article 17(2) allows a proportionate implementation for SMEs and small mid-caps but keeps the required rigour.
Provider and deployer checks at a glance
| Area | Provider of a high-risk system | Deployer of a high-risk system |
|---|---|---|
| Core duty list | Article 16(a) to (l) | Article 26 |
| Documentation | QMS (Art 17), documentation (Art 18), technical documentation with monitoring plan (Art 72(3)) | FRIA where Art 27 applies; DPIA under GDPR Article 35 where applicable (Art 26(9)) |
| Logs | Keep logs under its control (Art 16(e), Art 19) | Keep logs under its control at least six months (Art 26(6)) |
| People | AI literacy (Art 4) | AI literacy (Art 4); oversight staff with competence and authority (Art 26(2)); inform workers' representatives (Art 26(7)) |
| Market steps | Conformity assessment, declaration, CE marking, registration (Art 16(f) to (i)) | Public authorities: use only registered systems (Art 26(8)) |
How to collect the data
- Build the population: combine procurement records, the software and SaaS inventory, cloud service logs showing AI service use, and a short owner survey. Each system or use case gets one register entry with a named owner.
- Record decisions, not opinions: for R2 and R3, store the role, risk class and reasoning as a dated decision with the reviewer's name. Note where a deployer's change could make it a provider under Article 25.
- Screen with a fixed question set: for R4, use one question per Article 5(1) point and keep the answers, including "no".
- Test, do not assume, transparency: for R6, capture the disclosure as the user sees it and run a marking check on generated output where Article 50(2) applies.
- Link learning records to roles: for R7, join the AI register's list of operating roles to learning records rather than counting all staff.
- Index the document sets: for R8 to R10, keep a single index per high-risk system pointing to each QMS aspect, the monitoring plan and the conformity route evidence.
- Check configurations: for R11, read the retention setting on each log store, not the policy alone.
Red flags that need action now
- Any possible Article 5 hit that has not been resolved, especially uses that touch the new Article 5(1)(ba) and (bb) prohibitions applying from 2 December 2026.
- Chatbots or voice agents talking to the public with no AI disclosure under Article 50(1).
- Generative systems placed on the market without a plan for machine-readable marking before the 2 December 2026 transition ends.
- No AI register, or a register the business does not maintain.
- Emotion recognition or biometric categorisation in use with no notice to the people exposed (Article 50(3)).
- Annex III systems that profile people recorded as "not high-risk" under Article 6(3).
- Deployments in FRIA scope with no FRIA planned before first use.
- High-risk providers with no conformity route chosen and no harmonised standards gap analysis.
Findings log
| Finding ID | Finding | Check | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-AIA-01 | [Fourteen SaaS features with AI not in the register] | R1 | [High] | [AI governance lead] | [DD/MM/YYYY] | [Open] |
| HC-AIA-02 | [Customer service chatbot lacks AI disclosure] | R6 | [Critical] | [Digital channels owner] | [DD/MM/YYYY] | [In progress] |
| HC-AIA-03 | [Recruitment screening tool has no role decision] | R2 | [High] | [HR systems owner] | [DD/MM/YYYY] | [Open] |
| HC-AIA-04 | [Logs for credit decision model kept 90 days] | R11 | [Medium] | [Platform engineering lead] | [DD/MM/YYYY] | [Open] |
| HC-AIA-05 | [QMS covers 8 of 13 Article 17 aspects] | R8 | [Medium] | [Quality lead] | [DD/MM/YYYY] | [Open] |
Rate a finding critical when the duty already applies and the gap affects people now; high when the duty applies within twelve months.
Remediation map
| Finding type | Where to fix it |
|---|---|
| Role and duty confusion (R2) | EU AI Act Provider vs Deployer Obligations Guide |
| Risk class gaps (R3) | EU AI Act High-Risk AI Systems Guide |
| Prohibited practice hits (R4) | EU AI Act Prohibited Practices Guide |
| FRIA gaps (R5) | EU AI Act Fundamental Rights Impact Assessment |
| Missing notices or marking (R6) | EU AI Act Article 50 Transparency Obligations Guide |
| Literacy gaps (R7) | EU AI Act AI Literacy Obligations (Article 4) Guide |
| QMS, risk management and conformity gaps (R8, R10) | EU AI Act Conformity Assessment and Harmonised Standards Guide; EU AI Act Article 9 Risk Management System Guide |
| Monitoring plan gaps (R9) | EU AI Act Post-Market Monitoring Guide (Article 72) |
| Log retention and oversight (R11) | EU AI Act Article 14 Guide |
Related guides
- EU AI Act Compliance Guide: the full set of obligations this checklist tests.
- EU AI Act Implementation Timeline Tracker: every application date after the Digital Omnibus.
- EU AI Act Executive Briefing: the board view of the same obligations.
- EU AI Act for AI Agents: how the Act applies to agentic systems and their identities.
- ISO 42001 Readiness Checklist: a management system that supports many of the provider duties.
References
- European Commission AI Act Service Desk: Timeline for the implementation of the EU AI Act
- European Commission AI Act Service Desk: Article 6, Classification rules for high-risk AI systems
- European Commission AI Act Service Desk: Article 16, Obligations of providers of high-risk AI systems
- European Commission AI Act Service Desk: Article 26, Obligations of deployers of high-risk AI systems
- European Commission AI Act Service Desk: Article 27, Fundamental rights impact assessment
- European Commission AI Act Service Desk: Article 50, Transparency obligations
- European Commission AI Act Service Desk: Article 43, Conformity assessment
- EUR-Lex: Regulation (EU) 2026/1744 (Digital Omnibus on AI)
This guide summarises obligations under Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 and is not legal advice. Related NHI Mgmt Group resources: EU AI Act Compliance Guide · EU AI Act Provider vs Deployer Obligations Guide · EU AI Act Implementation Timeline Tracker · NIS2 Readiness Checklist