EU AI Act Compliance Checklist for AI-Powered Applications
By the Netallion AI Assurance Team
The EU Artificial Intelligence Act (Regulation 2024/1689) is the world's first comprehensive legal framework for AI systems. It establishes obligations for providers, deployers, importers, and distributors of AI systems based on the risk level of the system. If your organization develops or deploys AI-powered applications that serve EU users or operate within the EU market, the AI Act applies to you regardless of where your company is headquartered.
This guide provides a practical overview of the regulation, a clear explanation of the risk classification system, and a 20-item compliance checklist that maps directly to the technical and organizational requirements in the Act.
1. EU AI Act Overview
The AI Act was formally adopted in March 2024 and published in the Official Journal of the EU in July 2024. It follows a risk-based approach: the higher the risk an AI system poses to health, safety, or fundamental rights, the stricter the requirements. The Act applies across the AI value chain, from foundation model providers to organizations that deploy AI systems in production.
Key concepts include the distinction between "providers" (organizations that develop AI systems) and "deployers" (organizations that use AI systems in their operations). Most organizations are deployers, but any organization that fine-tunes a foundation model or builds a custom AI application becomes a provider under the Act. The obligations differ significantly between these roles.
Penalties for non-compliance are severe: up to 35 million euros or 7% of global annual turnover for prohibited AI practices, and up to 15 million euros or 3% of turnover for other violations. These penalties are designed to be proportionate but dissuasive, similar to GDPR fines.
2. Risk Classification
The AI Act defines four risk tiers. Correctly classifying your AI systems is the essential first step toward compliance:
Unacceptable Risk (Prohibited)
These AI practices are banned outright:
- Social scoring systems by public authorities
- Real-time biometric identification in public spaces (with limited exceptions)
- AI that exploits vulnerabilities of specific groups (age, disability)
- Subliminal manipulation techniques that cause harm
- Emotion recognition in workplaces and educational institutions
- Untargeted scraping of facial images for recognition databases
High Risk
AI systems that require conformity assessment and ongoing monitoring:
- Biometric identification and categorization
- Safety components of critical infrastructure
- Education and vocational training (access, assessment)
- Employment and worker management (recruitment, evaluation)
- Access to essential services (credit scoring, insurance)
- Law enforcement (risk assessment, evidence evaluation)
- Migration and border control
- Justice and democratic processes
Limited Risk (Transparency Obligations)
AI systems that require disclosure to users:
- Chatbots and conversational AI (must disclose AI interaction)
- Deepfake generation (must label as AI-generated)
- Emotion recognition systems (must inform subjects)
- AI-generated content (must be machine-readable labeled)
Minimal Risk
Most AI applications fall here: spam filters, AI-powered search, recommendation engines, language translation. No specific obligations under the AI Act, though voluntary codes of conduct are encouraged.
3. Obligations by Risk Level
High-risk AI systems carry the most extensive obligations. Providers of high-risk systems must implement:
- Risk management system — A continuous, iterative process throughout the AI system's lifecycle that identifies, analyzes, estimates, and evaluates risks.
- Data governance — Training, validation, and testing data sets must be relevant, representative, free of errors, and complete. Data governance practices must address bias.
- Technical documentation — Comprehensive documentation of the system's design, capabilities, limitations, and intended purpose before market placement.
- Record-keeping and logging — Automatic logging of events to enable traceability and post-market monitoring. Logs must be retained for an appropriate period.
- Transparency — Instructions for use must be clear and include information about capabilities, limitations, and potential risks.
- Human oversight — Systems must be designed to allow effective human oversight, including the ability to override or interrupt the system.
- Accuracy, robustness, and cybersecurity — Systems must achieve appropriate levels of accuracy and be resilient against errors, faults, and adversarial attacks.
Deployers of high-risk AI systems have lighter but significant obligations: they must use the system according to the provider's instructions, ensure human oversight is in place, monitor the system for risks during operation, and report serious incidents to the provider and authorities.
4. Compliance Timeline
Prohibitions on unacceptable-risk AI practices take effect
Obligations for general-purpose AI (GPAI) models take effect, including transparency requirements for GPAI providers
Main body of the regulation applies: high-risk AI system requirements, conformity assessments, and deployer obligations
Full enforcement for high-risk AI systems embedded in products regulated by existing EU sectoral legislation (medical devices, machinery, etc.)
5. Practical Compliance Checklist (20 Items)
Use this checklist to assess your organization's readiness for the EU AI Act. Items are grouped by category and applicable to both providers and deployers of high-risk AI systems:
Governance and Risk Management
1. Inventory all AI systems in use and classify each by risk level (unacceptable, high, limited, minimal)
2. Establish an AI governance committee or assign responsibility to an existing risk function
3. Implement a risk management system that covers the full AI lifecycle (design, development, deployment, monitoring, decommission)
4. Define and document the intended purpose of each high-risk AI system
5. Conduct a Fundamental Rights Impact Assessment (FRIA) for each high-risk AI system before deployment
Data Governance
6. Audit training data sets for relevance, representativeness, accuracy, and completeness
7. Implement bias detection and mitigation procedures for training and validation data
8. Establish data provenance tracking for all training data used in high-risk AI systems
9. Ensure GDPR compliance for any personal data used in AI training or inference
Technical Requirements
10. Implement automatic logging for all high-risk AI system events with appropriate retention periods
11. Deploy monitoring for accuracy degradation, bias drift, and adversarial input detection
12. Implement cybersecurity controls including prompt injection defense, data poisoning prevention, and model extraction protection
13. Design human oversight mechanisms including override, interrupt, and escalation capabilities
14. Test AI systems for robustness against adversarial attacks and edge cases
Documentation and Transparency
15. Prepare technical documentation covering system design, capabilities, limitations, and intended purpose
16. Create instructions for use that are clear, comprehensive, and include risk warnings
17. Implement transparency measures for limited-risk AI systems (chatbot disclosure, content labeling)
18. Register high-risk AI systems in the EU database before market placement
Incident Response and Monitoring
19. Establish a post-market monitoring system for high-risk AI systems with defined incident reporting procedures
20. Create a serious incident response plan with procedures for reporting to national authorities within the required timeframes
6. How Netallion AI Assurance Maps to EU AI Act Requirements
Netallion AI Assurance addresses several technical requirements of the EU AI Act directly:
- Automatic logging (Art. 12) — Tamper-evident audit logging captures all AI system events with cryptographic integrity verification. Logs are retained according to configurable policies.
- Cybersecurity (Art. 15) — Runtime defense with 19 prompt injection detection rules, Prompt DLP for data loss prevention, and MCP governance for agentic AI tool access control.
- Risk management (Art. 9) — AI risk dashboards, compliance mapping to EU AI Act, NIST AI RMF, ISO 42001, and OWASP LLM Top 10 frameworks.
- Human oversight (Art. 14) — Alert routing, escalation workflows, and human-in-the-loop controls for AI system decisions that require review.
- Post-market monitoring (Art. 72) — Continuous monitoring of AI system behavior with anomaly detection and trend reporting.
- FRIA support (Art. 27) — Built-in FRIA workflow templates that guide deployers through the fundamental rights impact assessment process.
For a deeper dive into the EU AI Act and how it applies to your AI applications, visit our EU AI Act overview page or use the EU AI Act Readiness Assessment tool to evaluate your current compliance posture.
7. Next Steps
The EU AI Act is not a future problem. The prohibition on unacceptable-risk AI practices is already in effect as of February 2025. GPAI obligations apply from August 2025. If you are developing or deploying AI systems that serve EU users, start your compliance assessment now. Use the 20-item checklist above as your starting point. Classify your AI systems by risk level. Identify gaps. Build a remediation roadmap with clear milestones aligned to the regulatory timeline.
Organizations that begin compliance work early will have a competitive advantage. Compliance is not just a legal obligation; it is a trust signal to customers, partners, and regulators that your AI systems are built responsibly.
Related Guides
Start your EU AI Act compliance journey
Start a 14-day Business trial of Netallion AI Assurance. Map your AI systems to EU AI Act requirements automatically.
Start Free Trial