EU AI Act Compliance Checker

Risk tier classification is unclear. Teams build AI features without first determining whether they fall under prohibited, high-risk, limited-risk, or minimal-risk categories. Misclassification is the most common gap — features perceived as low-risk often qualify as high-risk under Annex III, particularly anything involving medical decisions, employment screening, or biometric identification.

Training data lineage isn't documented. Article 10 requires training, validation, and testing datasets be relevant, representative, and free of errors. High-risk providers must document the data's source, collection process, and any preprocessing. Most teams cannot reconstruct training data provenance for models trained 18+ months ago.

Human oversight is named but not designed. Article 14 requires human oversight measures that allow humans to understand, monitor, intervene, and override AI system outputs. 'A human reviews the output' is not sufficient — the design must enable meaningful intervention with adequate time, information, and authority.

Transparency obligations to users aren't met. Article 13 requires high-risk system providers to give users instructions for use including the AI's intended purpose, accuracy levels, foreseeable circumstances of use, and limitations. Article 50 requires AI systems interacting with humans to disclose AI involvement. Both are routinely missed in user-facing features.

No conformity assessment plan. High-risk systems require conformity assessment before market placement — either internal control (Annex VI) for most providers or notified body involvement (Annex VII) for biometrics. Teams discover this requirement when they're already in market.

Post-market monitoring is not designed. Article 72 requires high-risk system providers to actively collect performance data, document predictable risks, and report serious incidents to authorities within 15 days (3 days for widespread infringements). Most teams have product analytics but not a regulated post-market monitoring system.

Generative AI model usage isn't documented. Article 53 introduces transparency obligations for general-purpose AI (GPAI) model providers; Article 55 adds systemic risk obligations for the largest models. Downstream users (deployers) need documentation from their GPAI provider — most teams use OpenAI, Anthropic, or others without reviewing the GPAI compliance posture.

Classify every AI feature against Annex III high-risk categories. Healthcare-adjacent classifications (medical devices, employment, biometric ID, public service decisions) trigger the highest obligations. Document the reasoning even when the classification is low-risk — auditors evaluate the analysis, not just the conclusion.

Build a technical documentation file per high-risk system. Annex IV specifies the contents: system description, design specifications, training data, testing methodologies, risk management, change management. The file must be ready when the system is placed on the market and maintained throughout.

Stand up a risk management system per Article 9. Continuous (not one-time) identification, analysis, and mitigation of risks across the system lifecycle. Document the methodology.

Identify GPAI provider obligations downstream. If you use third-party models (OpenAI, Anthropic, Google, Meta), confirm what compliance documentation they provide and what residual obligations fall to you as the deployer.

Plan for the conformity assessment timeline. Internal control conformity assessment takes 4–12 weeks; notified body assessment can take 6–9 months. Place this on the roadmap as a non-negotiable gate before market launch.