KI-Verordnung Compliance Checklist

Complete compliance checklist for the KI-Verordnung (EU AI Act) with all obligations for providers and deployers.

This checklist helps providers and deployers of AI systems to systematically implement the requirements of the AI Act (Regulation (EU) 2024/1689). It covers all essential obligations, from risk classification through technical documentation to ongoing monitoring.

The checklist is aligned with the AI Act deadlines and prioritizes measures by urgency. It is aimed at CTOs, engineering leads, and compliance officers.

Phase 1: Immediate Actions (Already enforceable)

Deadline: February 2, 2025 (already passed)

Check whether prohibited AI practices under Article 5 are being used (social scoring, manipulative AI, real-time biometrics in public spaces)

Identify, document, and shut down prohibited systems

Conduct employee training on prohibited practices

Plan AI literacy training for affected employees (Article 4)

Phase 2: GPAI Obligations (General Purpose AI)

Deadline: August 2, 2025

Check whether deployed AI models are classified as GPAI models

Create technical documentation for GPAI models (Article 53)

Ensure EU copyright law compliance (training data transparency)

Publish summary of training data

Check for systemic risks (for high-impact GPAI)

Phase 3: High-Risk Obligations

Deadline: 2 December 2027

Create complete AI system inventory and assign risk levels

Establish risk management system (Article 9) — continuous, not one-time

Implement data governance policies (Article 10) — check training data for bias and representativeness

Create technical documentation per Annex IV

Set up automatic logging and tamper-proof audit trail (Article 12)

Create instructions for use for deployers (Article 13)

Implement human oversight mechanisms, including kill switch (Article 14)

Conduct accuracy, robustness, and cybersecurity tests (Article 15)

Establish quality management system (Article 17)

Conduct conformity assessment and apply CE marking

Create EU declaration of conformity (Article 47)

Phase 4: Deployer Obligations

Deadline: 2 December 2027

Use high-risk AI systems only as intended (Article 26)

Appoint and train natural persons for human oversight

Verify input data for relevance (insofar as the deployer has control)

Retain logs for at least 6 months (or longer if legally required)

Inform affected persons about the use of high-risk AI

Conduct data protection impact assessment (DPIA) if required

Ongoing Obligations

Operate post-market monitoring system and report incidents (Article 72)

Inform the competent authority within 15 days in case of serious incidents

Update technical documentation when significant changes are made

Conduct regular audits and conformity checks

Integrate compliance scans into CI/CD pipeline and run with every release

Related Guides

KI-Verordnung High-Risk AI Systems

Guide to high-risk AI systems under the KI-Verordnung (EU AI Act) with classification, requirements, and implementation guidance.

KI-Verordnung Requirements for Companies

Overview of all KI-Verordnung (EU AI Act) requirements for companies, including documentation, risk management, and transparency.

How Scanara Helps

Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.