What are the key EU AI Act compliance deadlines?

February 2, 2025: Prohibited AI practices (Article 5) are banned. August 2, 2025: GPAI model obligations (Articles 51–56) fully in force. December 2, 2026: The two prohibitions added by Regulation (EU) 2026/1744 (Article 5(1)(ba) and (bb)) apply. August 2, 2027: Transitional deadline for pre-existing GPAI models (Article 111(3)). December 2, 2027: High-risk AI system requirements (Articles 9–49) enforceable for Annex III systems. August 2, 2028: the same requirements for Annex I regulated products.

Who must comply with the EU AI Act?

The EU AI Act applies to providers (who place AI systems on the market), deployers (who use AI systems professionally), importers, distributors, and GPAI model providers. It applies to any organisation — including non-EU companies — whose AI systems are used by persons in the EU.

What are the prohibited AI practices under Article 5?

Article 5 prohibits: subliminal manipulation below consciousness threshold, exploitation of vulnerabilities (age, disability, socioeconomic), social scoring by public authorities, real-time biometric ID in public spaces by law enforcement, biometric categorisation inferring sensitive attributes, emotion recognition in workplace/education, facial recognition database scraping, and predictive policing based solely on profiling.

What technical documentation is required under Article 11?

Article 11 requires providers of high-risk AI systems to maintain Annex IV technical documentation before placing the system on the market. The documentation must cover: general system description, system components, development steps and versions, risk management documentation, conformity assessment procedures, test results, and a post-market monitoring plan. Documentation must be retained for 10 years (Article 18).

What are the fines for non-compliance with the EU AI Act?

Fines scale with violation severity: prohibited practices (Article 5) carry fines up to EUR 35 million or 7% of worldwide annual turnover. Other violations (high-risk requirements, GPAI, transparency) carry fines up to EUR 15 million or 3% of worldwide annual turnover. Providing incorrect information to authorities carries fines up to EUR 7.5 million or 1% of worldwide annual turnover.

EU AI Act Compliance Checklist

A complete, article-referenced checklist for providers, deployers, and GPAI model providers preparing for EU AI Act enforcement.

Updated April 6, 2026

0 of 88 items completed0%

Save your progress across devices — Sign up free

This checklist covers every binding obligation under the EU AI Act (Regulation (EU) 2024/1689) — the world's first comprehensive AI regulation. It is organized by role (provider, deployer, GPAI model provider) and enforcement deadline, with article references for each item. High-risk AI system obligations under Articles 9–21 apply from 2 December 2027 for Annex III systems (2 August 2028 for Annex I systems), per Regulation (EU) 2026/1744. Prohibited practices under Article 5 have been enforceable since 2 February 2025.

Set Your Profile

optional

Select your role and AI system type to filter the checklist to the obligations that apply to you.

Enforcement timeline

2 Feb 2025

Prohibited Practices

Article 5 bans fully enforceable.

2 Aug 2025

GPAI Obligations

Chapter V (Articles 51–56) fully in force for GPAI model providers.

2 Dec 2026

Prohibited Practices Expansion

Article 5 bans extended to two new categories: non-consensual intimate material and CSAM generation/manipulation.

2 Aug 2027

Existing GPAI Models Deadline

Applies to pre-existing GPAI models placed on the market before August 2025.

2 Dec 2027

Annex III High-Risk Obligations

Articles 9–49 enforceable for Annex III high-risk AI systems — full provider and deployer obligation block.

2 Aug 2028

Annex I High-Risk Obligations

Articles 9–49 enforceable for Annex I high-risk AI systems — safety components of regulated products under Article 6(1).

Step 1 — Determine your role

Your obligations depend on which role(s) you hold. Most engineering teams fall under Provider or Deployer.

Provider

Art. 3(3)

You develop an AI system and place it on the EU market or put it into service — including open-source models, regardless of commercial intent.

Full Articles 9–21 obligations apply

Deployer

Art. 3(4)

You use an AI system under your authority in a professional context (not personal non-professional use).

Article 26 obligations apply

GPAI Model Provider

Art. 3(63)

You place a general-purpose AI model (LLM, multimodal foundation model) trained on large-scale data on the EU market.

Articles 51–56 obligations apply

Importer / Distributor

Art. 3(6)/(7)

You bring a non-EU provider's AI system into the EU market (importer) or make an AI system available without being the provider (distributor).

Articles 23–24 due-diligence obligations apply

Step 3 — Classify your AI system's risk level

The Annex III categories below trigger full Articles 9–21 provider obligations. AI used as a safety component in products governed by Annex I sector legislation (medical devices, machinery, aviation) is also high-risk.

Annex III, point 1 — Biometrics

Remote biometric identification, categorisation, and emotion recognition systems

Annex III, point 2 — Critical Infrastructure

AI managing safety components in energy, water, gas, heating, road traffic, rail

Annex III, point 3 — Education

AI determining access, admission, assessment outcomes, or monitoring in educational/training contexts

Annex III, point 4 — Employment

CV screening, promotion/termination decisions, task allocation, performance monitoring

Annex III, point 5 — Essential Services

Credit scoring, insurance risk, eligibility for public benefits, emergency services dispatch

Annex III, point 6 — Law Enforcement

Criminal analytics, polygraphs, evidence reliability, crime pattern analysis, individual risk profiling

Annex III, point 7 — Migration & Border Control

Risk assessment, document authenticity, refugee status determination, visa processing

Annex III, point 8 — Administration of Justice

AI assisting judicial interpretation of law or influencing electoral processes

Exclusions from high-risk (Article 6(3))

A system in an Annex III category may be excluded from high-risk classification if it does not pose a significant risk to health, safety, or fundamental rights — for example: narrow procedural tasks, improving existing human activities, detecting patterns in prior human data, or preparing assessments reviewed by human professionals. Providers must document the exclusion rationale and register the decision in the EU database.

Step 2 — Prohibited practices sweep (Article 5)

Enforcement deadline: 2 February 2025 — Fine: EUR 35M or 7% of global turnover

Verify none of the following apply to any system you develop or deploy. These are absolute prohibitions with no compliance pathway.

Art. 5(1)(a)No AI system using subliminal techniques below the consciousness threshold to materially distort behavior and cause harm

Art. 5(1)(b)No AI exploiting vulnerabilities of age, disability, or socioeconomic situation to distort behavior and cause harm

Art. 5(1)(c)No social scoring systems by public authorities that evaluate trustworthiness and cause detrimental treatment

Art. 5(1)(d)No real-time remote biometric identification in public spaces by law enforcement (narrow exceptions require prior judicial/administrative authorisation)

Art. 5(1)(e)No biometric categorisation systems inferring race, political opinions, trade union membership, religion, sexual orientation, or health

Art. 5(1)(f)No emotion recognition systems used in workplace or educational contexts (except for medical or safety reasons)

Art. 5(1)(g)No AI creating facial recognition databases by scraping facial images from the internet or CCTV feeds

Art. 5(1)(h)No predictive policing systems assessing individual crime risk based solely on profiling or personality traits

Step 5 — Conformity assessment and EU database registration

Required before market placement.

Articles 43–44 — Conformity assessment

Complete a conformity assessment before placing the system on the market — self-assessment (Annex VI) for most Annex III systems; third-party Notified Body assessment for remote biometric ID and Annex I regulated products

Draw up an EU Declaration of Conformity in Annex V format

Affix CE marking to the AI system or accompanying documentation

Repeat the conformity assessment after any substantial modification that could affect compliance

Retain conformity assessment records for 10 years

Article 49 — EU database registration

Include all Annex VIII mandatory fields: provider details, system name and version, Annex III category, intended purpose, capabilities/limitations summary, risk management summary, conformity assessment status, and post-market monitoring plan summary

Update registration when any material information changes

Deployers in law enforcement, migration, or administration of justice must also register before putting systems into use

Step 6 — Deployer obligations (Article 26)

Applies to organisations using high-risk AI systems in a professional context. Enforcement deadline: 2 December 2027.

Use high-risk AI systems only in accordance with the provider's instructions for use (Art. 26(1))

Assign human oversight responsibility to natural persons with adequate competence, training, and authority (Art. 26(2)-(3))

Monitor system operation and report non-conformity or serious incidents to the provider (Art. 26(4))

Retain automatically generated logs for a minimum of 6 months where feasible (Art. 26(6))

Conduct a fundamental rights impact assessment before deploying systems in Annex III categories 5(b), 6, 7, 8 — credit scoring, law enforcement, migration, justice (Art. 26(9))

Inform affected workers when AI monitors or makes decisions affecting them (Art. 26(7))

If you substantially modify a high-risk AI system, you become the provider and inherit all provider obligations

Step 8 — Limited-risk transparency obligations (Article 50)

Applies to chatbots, deepfake generators, emotion recognition, and biometric categorisation systems outside the prohibited or high-risk scope. Enforcement deadline: 2 August 2026.

Chatbots / conversational AI: inform users they are interacting with an AI system in a clear and timely manner before and during the interaction (Art. 50(1))

AI-generated or manipulated content (deepfakes): ensure outputs are labelled as AI-generated in machine-readable format; technical measures must persist through transmission (Art. 50(2))

Emotion recognition and biometric categorisation: inform persons subjected to these systems of their operation before or at the time of interaction (Art. 50(3))

AI-generated text about real persons/events published for public information: label as AI-generated unless human editorial responsibility is taken (Art. 50(4))

Step 9 — Post-market monitoring and incident reporting (Articles 72–73)

Providers must report serious incidents within 15 days of becoming aware.

Implement a post-market monitoring plan integrated into the QMS (Article 72)

Collect data on system performance, accuracy degradation, and emerging risks after deployment

Report serious incidents to the national market surveillance authority within 15 days of becoming aware — incidents causing death, serious injury, fundamental rights breaches, or critical infrastructure disruption (Article 73). Providers of high-risk systems that fall under the AI Office's exclusive competence (Article 75(1)) report to the AI Office instead, which forwards the report to your national authority.

Update the risk management system based on post-market monitoring findings

Log near-misses and investigate root causes; retain incident records for regulatory inspection

Enforcement fines (Article 99)

Violation category	Maximum fine
Prohibited practices (Article 5)	EUR 35 million or 7% of worldwide annual turnover
High-risk, GPAI, and technical requirement violations (Articles 9–21, 51–56)	EUR 15 million or 3% of worldwide annual turnover
Incorrect or misleading information to authorities	EUR 7.5 million or 1% of worldwide annual turnover

Fines apply to the higher of the fixed amount or the percentage of global annual turnover. SMEs and startups benefit from proportionality provisions. For non-EU providers, fines apply to the EU-established authorised representative.

Print or save as PDF

Use your browser's print dialog to save the full checklist as a PDF.

Tip: choose "Save as PDF" as the destination in the print dialog.

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.

EU AI Act Compliance Checklist

Set Your Profile

Enforcement timeline

Prohibited Practices

GPAI Obligations

Prohibited Practices Expansion

Existing GPAI Models Deadline

Annex III High-Risk Obligations

Annex I High-Risk Obligations

Step 1 — Determine your role

Provider

Deployer

GPAI Model Provider

Importer / Distributor

Step 3 — Classify your AI system's risk level

Exclusions from high-risk (Article 6(3))

Step 2 — Prohibited practices sweep (Article 5)

Step 4 — High-risk provider obligations (Articles 9–21)

Article 9 — Risk management system

Article 10 — Data governance and management

Article 11 — Technical documentation (Annex IV)

Article 12 — Record-keeping and logging

Article 13 — Transparency and information provision

Article 14 — Human oversight

Article 15 — Accuracy, robustness, and cybersecurity

Article 17 — Quality management system

Step 5 — Conformity assessment and EU database registration

Articles 43–44 — Conformity assessment

Article 49 — EU database registration

Step 6 — Deployer obligations (Article 26)

Step 7 — GPAI model obligations (Articles 51–56)

All GPAI model providers (Article 53)

Systemic risk models (Article 55)

Step 8 — Limited-risk transparency obligations (Article 50)

Step 9 — Post-market monitoring and incident reporting (Articles 72–73)

Enforcement fines (Article 99)

Related guides

The Engineer's Guide to the EU AI Act

AI Risk Classification Guide

Article 12 Audit Trail Requirements

EU AI Act Compliance for Developers

How Scanara Helps