EU AI Act Compliance Checklist 2026: What Software Companies Must Do
Quick answer: EU AI Act compliance for a software company comes down to four moves. Find every AI system you build or use. Classify each one by risk. Work out whether you are a provider or a deployer. Then complete the duties that match, starting with the ones already in force. The big high-risk deadline moved to December 2027, but other rules apply today.
If you build software for customers in Europe, you have probably heard about the EU AI Act. You may also have heard that the deadlines moved. Both things are true, and that is why many teams are confused. Some are rushing for a date that no longer applies. Others have stopped working because they think the law was cancelled. It was not.
This guide gives you a clear EU AI Act compliance checklist for 2026. You will see the current timeline, who the law covers, how risk tiers work, and what to do in each of 12 steps. You will also see worked examples, penalty levels, and a 90-day plan. If you are adding AI to a product, it pairs well with our guide on how to integrate LLMs into your existing software product.
Key Takeaways
- The EU AI Act is already in force. Some rules apply today, and others come later.
- The Digital Omnibus pushed the main high-risk deadlines to 2 December 2027 and 2 August 2028.
- Transparency rules in Article 50 started on 2 August 2026, so chatbots and AI content need attention now.
- Your duties depend on your role and on your risk tier, so classify first.
- You can be covered even if your company is outside the EU.
- Good EU AI Act compliance is mostly documentation, testing and clear ownership, not magic.
- Start with an AI inventory. Everything else builds on it.
EU AI Act Compliance Timeline 2026: What Changed After the Digital Omnibus
The timeline is the most misunderstood part of EU AI Act compliance. The original law set 2 August 2026 as the date when most rules would apply. Then the EU passed the Digital Omnibus on AI. According to law-firm summaries, it entered into force on 27 July 2026 and changed several dates. The table below shows where things stand.
| Date | What applies | Status |
|---|---|---|
| 2 February 2025 | Bans on prohibited AI practices and the AI literacy duty | In force |
| 2 August 2025 | Rules for general-purpose AI (GPAI) models | In force |
| 2 August 2026 | Transparency duties under Article 50, plus wider application of the Act | In force |
| 2 December 2026 | Grace period ends for marking AI-generated content on older systems, and a new ban on AI that creates non-consensual intimate imagery or child abuse material starts | Next deadline |
| 2 December 2027 | High-risk duties for stand-alone systems in Annex III, such as hiring and credit tools | Moved from 2 August 2026 |
| 2 August 2028 | High-risk duties for AI built into regulated products in Annex I | Moved |
Dates come from law-firm reports on the final text, including Hunton, Gibson Dunn and Freshfields. Always check the Official Journal text before you rely on a date.
What Applies to Your Software Company Right Now
Three groups of rules already apply. First, the list of banned AI practices. Second, the AI literacy duty, which asks you to help staff understand the AI they use. Third, the rules for general-purpose AI models and the transparency duties in Article 50. Teams that wait for 2027 for all of EU AI Act compliance will miss these.
What Moved Later
The heavy duties for high-risk systems moved. Stand-alone high-risk systems, such as tools for hiring, education or credit, now have until 2 December 2027. AI that sits inside regulated products, such as medical devices, now has until 2 August 2028. That gives you time, but it is not a reason to stop. Documentation and testing take months.
What Did Not Move
The bans did not move. The GPAI rules did not move. The Article 50 transparency duties mostly did not move either. Only providers of generative AI whose systems were already on the market before 2 August 2026 get a short grace period, until 2 December 2026, for marking AI-generated content. Plan your EU AI Act compliance work around these facts, not around the headline “delay.”
The Digital Omnibus Changes in Plain Words
Beyond the dates, the Omnibus made other changes that matter to software teams:
- The AI literacy duty became softer. Companies must support AI literacy among staff, instead of guaranteeing a fixed level.
- Some simplified documentation rules now reach medium-sized companies, not only small ones.
- A simpler registration step returned for systems a provider judges to be not high-risk.
- The EU AI Office gained wider powers over AI systems built on general-purpose models from the same provider.
What Is the EU AI Act?
The EU AI Act is Regulation (EU) 2024/1689. It is the first broad law on AI in the European Union. It entered into force on 1 August 2024. Its goal is simple: make AI safe, fair and trustworthy while still allowing innovation.
The law uses a risk-based approach. The higher the risk to people’s safety or rights, the stricter the rules. Some uses are banned. Some need heavy controls. Others only need a clear notice. Most everyday software falls into the lightest group.
Does the EU AI Act Apply to Your Software Company?
In most cases, yes, if your AI reaches users in the EU. Where your office sits does not decide this. What decides it is your role and where your AI is used. Here is how to check.
Are You a Provider?
You are a provider if you develop an AI system, or have one developed, and put it on the market under your own name. Many software companies are providers. If you ship a product with AI features to EU customers, EU AI Act compliance starts with this question.
Are You a Deployer?
You are a deployer if you use an AI system in your own work. A company that uses a third-party AI tool to screen job applicants is a deployer. Deployers have fewer duties than providers, but the duties are real, especially for high-risk uses.
What About Importers and Distributors?
Importers bring AI systems from outside the EU into the EU market. Distributors make them available without changing them. Both must check that the provider did its job before they pass the product on.
Does the Act Apply to Companies Outside the EU?
Yes, it can. Providers outside the EU are covered if they place AI on the EU market. The law can also apply when the output of a system is used in the EU. A software company in India, the US or the UK that sells to European clients needs a plan for EU AI Act compliance. Providers of high-risk systems from outside the EU must also appoint an authorised representative in the EU.
Can You Be More Than One Role?
Yes. A company can be a provider of its own product and a deployer of another vendor’s tool at the same time. Write down each role per system. This simple table of roles drives every later step.
Understanding the Four Risk Tiers in the EU AI Act
Every part of EU AI Act compliance depends on the tier your system falls into. The law sorts AI into four levels.
| Risk tier | What it means | Examples | What you must do |
|---|---|---|---|
| Unacceptable | Banned | Social scoring, manipulative AI that harms people, certain biometric uses, AI that creates non-consensual intimate imagery | Do not build or sell it |
| High-risk | Allowed with strict controls | CV screening, exam scoring, credit scoring, safety parts of regulated products | Full provider or deployer duties |
| Limited risk | Allowed with transparency | Chatbots, AI-generated images, audio and video | Tell users it is AI and mark content |
| Minimal risk | Allowed, no special duties | Spam filters, game AI, simple recommendations | Follow good practice and AI literacy |
Unacceptable Risk: Banned Practices
These uses are prohibited. They include AI that manipulates people in harmful ways, exploits vulnerable groups, scores people on social behavior, or builds face databases by scraping images. The Omnibus added a ban on AI that generates non-consensual intimate imagery and child abuse material. Check your roadmap against this list before you look at anything else.
High-Risk AI Systems
High-risk systems fall into two groups. The first group is AI built into products that already have EU safety rules, such as medical devices or machinery. The second group is stand-alone AI in sensitive areas listed in Annex III. Those areas include employment, education, access to essential services such as credit, biometrics, critical infrastructure, law enforcement, migration and justice.
A system in an Annex III area may still avoid the high-risk label if it only performs a narrow task and does not materially influence decisions. If you claim this, write down your reasoning. Regulators can ask for it. Reading the 15 generative AI use cases enterprises are paying for can help you spot which of your features touch these areas.
Limited-Risk AI: Transparency Duties
Chatbots must tell people they are talking to AI. Deepfakes and other synthetic content must be labeled. Providers of generative AI must mark machine-generated content in a machine-readable way. These Article 50 duties are where much EU AI Act compliance work for everyday software teams sits today.
Minimal-Risk AI
Most tools sit here. The law adds no special duties, though the AI literacy duty and good engineering practice still apply.
EU AI Act Compliance Checklist 2026: 12 Steps for Software Companies
Use this checklist as your working plan. Each step lists who should own it and what evidence to keep. Evidence matters, because a regulator or an enterprise customer will ask you to prove it, not just say it.
Step 1: Build an AI Inventory
List every AI system you build, ship, buy or embed. Include features that use LLMs, scoring models, recommendation engines and third-party APIs. Note the purpose, users, data used and country of use. You cannot do EU AI Act compliance on systems you have not found.
- Owner: CTO or head of engineering, with product.
- Evidence: A living register, reviewed every quarter.
Step 2: Decide Your Role for Each System
For every item in the inventory, mark whether you are a provider, deployer, importer or distributor. Many companies are two roles at once. Your role decides your duties, so do not skip this.
- Owner: Legal or compliance lead.
- Evidence: A role column in the inventory, with a short reason for each choice.
Step 3: Classify Each System by Risk Tier
Match each system to the four tiers. Read Annex III carefully, and check whether your system is a safety component of a regulated product. When a case is borderline, record why you chose your answer. A written reason is part of EU AI Act compliance, not paperwork for its own sake.
- Owner: Legal, with a technical reviewer.
- Evidence: A classification memo for each system.
Step 4: Check for Prohibited Practices
Scan your features and roadmap for banned uses. This applies today, and the fines for breaking it are the highest in the Act. If anything looks close to the line, stop and get advice before shipping.
- Owner: Product and legal.
- Evidence: A signed review for each release that touches AI.
Step 5: Put AI Literacy in Place
Help the people who build and use your AI understand it. That means short training on how the systems work, their limits and the main risks. Since the Omnibus, the duty is to support literacy, but regulators still expect to see a real program.
- Owner: HR or people lead, with engineering.
- Evidence: Training content, attendance records and role-based guides.
Step 6: Add Transparency Notices
If users talk to a chatbot, tell them it is AI. If your product creates synthetic images, audio or video, label them and add machine-readable marks where the law requires. Deployers of deepfakes must disclose them. These duties apply from 2 August 2026, so this is a near-term task in your EU AI Act compliance plan.
- Owner: Product and design.
- Evidence: Screenshots of notices and a technical note on content marking.
Step 7: Set Up Risk Management and Data Governance
For high-risk systems, you need a risk management process that runs across the full life of the product. You also need data governance: clear sources, quality checks and bias tests for training, validation and test data. Strong data engineering makes this much easier to prove.
- Owner: Head of data or ML lead.
- Evidence: Risk register, dataset documentation and bias test results.
Step 8: Prepare Technical Documentation and Logging
High-risk providers must keep technical documentation that shows how the system works and why it meets the rules. The system must also log events automatically so that its behavior can be traced. Start documenting early. Writing it after launch costs far more.
- Owner: Engineering lead.
- Evidence: Design docs, model cards, test reports and log samples.
Step 9: Design Human Oversight, Accuracy and Cybersecurity
High-risk systems need controls so a person can understand, supervise and override the output. They also need proven accuracy, robustness and cybersecurity. Test for failure, drift and attack, and write down the results. The same basics used to secure a web application apply here, plus AI-specific tests.
- Owner: Engineering and security.
- Evidence: Oversight design, red-team results and accuracy metrics.
Step 10: Complete Conformity Assessment, CE Marking and Registration
Before a high-risk system goes to market, the provider must run a conformity assessment, issue an EU declaration of conformity, apply the CE marking and register the system in the EU database. Many Annex III systems can use an internal check. Some need a notified body. Provider-side EU AI Act compliance peaks at this step.
- Owner: Compliance lead.
- Evidence: Declaration of conformity, CE marking file and registration record.
Step 11: Manage Third-Party Models and Suppliers
Most software companies build on someone else’s model. Ask your model providers for their documentation, usage limits and copyright policy. Put duties in your contracts. When you choose a partner, use a clear process, such as this guide on how to choose an AI integration partner.
- Owner: Procurement and legal.
- Evidence: Supplier file, signed terms and a record of what each model is used for.
Step 12: Monitor After Launch and Review Every Quarter
Compliance does not end at release. Providers must monitor performance, collect feedback and report serious incidents to authorities within strict deadlines. Review your inventory, classification and dates every quarter, because the rules are still being refined. Good QA testing in the age of AI keeps this monitoring honest.
- Owner: Product owner and compliance.
- Evidence: Monitoring dashboards, incident log and quarterly review notes.
Quick Summary of the 12 Steps
| Step | Action | Needed for |
|---|---|---|
| 1 to 3 | Inventory, roles, classification | Every company |
| 4 to 6 | Bans, AI literacy, transparency | Every company, now |
| 7 to 10 | Risk, data, documents, oversight, conformity | High-risk providers |
| 11 | Third-party models and suppliers | Anyone building on other models |
| 12 | Monitoring and quarterly review | Every company |
EU AI Act Compliance for General-Purpose AI and Third-Party Models
Many software companies do not train their own models. They call an API from a large model provider and build features on top. That raises a fair question: who carries the duty? The answer is both of you, but in different ways.
What the Model Provider Must Do
Providers of general-purpose AI (GPAI) models have had duties since 2 August 2025. They must keep technical documentation, share information with the companies that build on their models, publish a summary of training content, and follow EU copyright rules. Models with systemic risk face extra duties, such as testing and incident reporting.
What You Must Do as the Company Building on Top
If you place a product on the market that uses a GPAI model, you become the provider of that AI system. You still need to classify it, add transparency notices and, if it is high-risk, complete the full set of duties. Do not assume the model vendor covers you. Ask for their documentation and keep it on file. Teams that need help designing this layer often work with a generative AI engineering partner.
Changing a Model Can Change Your Role
If you fine-tune a model in a major way, or put your own name on a system, you may take on more provider duties. Track which models you use, which versions and why. This record makes EU AI Act compliance far easier when you swap models later.
AI Agents Need Extra Care
Autonomous agents that take actions, call tools and make decisions raise new questions about oversight and logging. Their risk tier depends on what they do, not on the word “agent.” If you build them, read this comparison of AI agents vs traditional automation, then classify each agent by its actual task.
Worked Examples of EU AI Act Compliance
These are simple, general scenarios, not client cases. They show how the checklist works in practice.
Example 1: A CV Screening Tool
A software company builds a tool that ranks job applicants for EU employers. Hiring is an Annex III area, so the tool is high-risk. The company is the provider, and its customers are deployers. It must complete risk management, data governance, documentation, human oversight and conformity assessment before the 2 December 2027 deadline. Customers must use it as instructed and keep logs. This is a full-scale EU AI Act compliance project.
Example 2: A Customer Support Chatbot
A SaaS company adds an LLM chatbot to its help center. It does not make decisions about people’s rights. It is limited-risk. The main duty is to tell users they are talking to AI. The team also needs AI literacy training, a basic inventory entry and logs for quality checks. EU AI Act compliance here is light, but it still applies from 2 August 2026.
Example 3: A Healthcare Symptom Checker
A startup builds an app that suggests next steps based on symptoms. If it counts as a medical device under EU product law, it falls into the Annex I group, with a later deadline of 2 August 2028. It will also face medical device rules and strict data protection duties. Health founders can start with this guide to AI development for healthcare startups, then get specialist legal advice.
Example 4: An Internal Code Assistant
A company uses an AI coding assistant for its own developers. It is a deployer of a minimal-risk tool. It needs AI literacy for staff and sensible data rules. There is little else to do for EU AI Act compliance, which shows why classification saves effort.
How Much Does EU AI Act Compliance Cost?
Nobody can give an honest flat price, because it depends on your tier and on how much you already document. Instead of made-up numbers, here are effort bands that you can use to plan.
| Situation | Effort level | Main cost drivers |
|---|---|---|
| Minimal-risk tools only | Low | Inventory, AI literacy training, a few policies |
| Chatbots and AI content | Low to medium | Transparency notices, content marking, testing |
| Building on GPAI models | Medium | Supplier review, contracts, documentation |
| High-risk provider | High | Risk management, data governance, technical files, conformity assessment, quality management |
| Regulated product with AI | Highest | All of the above, plus sector rules and notified bodies |
Three things keep costs down. Classify early so you do not over-build. Document as you go, not at the end. Reuse work you already do for security, privacy and quality standards.
EU AI Act Penalties: What Happens If You Do Not Comply?
The fines are set in Article 99 and stay unchanged by the Omnibus. They are tiered by the type of breach.
| Type of breach | Maximum fine |
|---|---|
| Using a prohibited AI practice | Up to EUR 35 million or 7% of worldwide annual turnover |
| Breaking most other duties, such as provider or deployer rules | Up to EUR 15 million or 3% of worldwide annual turnover |
| Giving incorrect or misleading information to authorities | Up to EUR 7.5 million or 1% of worldwide annual turnover |
For large firms, the higher of the two figures applies. For small and medium-sized businesses, the lower one applies. Fines are not the only risk. Enterprise buyers are already adding EU AI Act compliance questions to security reviews, so a missing answer can cost you a deal long before a regulator calls.
EU AI Act Compliance for Startups and SMEs
Small teams worry that the law is built for giants. The Act does include some help: lower fine caps for small firms, simpler documentation in some cases, and regulatory sandboxes where you can test with supervision. The Omnibus extended some of this relief to medium-sized companies.
Still, startups should keep the plan simple. Build the inventory, classify, add transparency notices, and keep a short file for each system. If you lack an in-house AI team, this guide on how to build an AI-powered product without an in-house AI team shows how to plan the work. The sooner you start, the cheaper EU AI Act compliance will be.
7 Common Mistakes in EU AI Act Compliance
- Treating the delay as a cancellation. Bans, GPAI rules and transparency duties already apply.
- Skipping the inventory. You cannot classify what you have not found.
- Assuming the model vendor handles everything. You are still the provider of your own product.
- Over-classifying everything as high-risk. This wastes budget. Classify with evidence.
- Under-classifying to save effort. A weak memo will not survive a regulator or a customer audit.
- Writing documents at the end. Records made after launch are thin and costly.
- Never reviewing. Dates, guidance and standards are still moving, so review every quarter.
How Does EU AI Act Compliance Relate to GDPR?
The AI Act does not replace the GDPR. The two laws work side by side. If your AI processes personal data, you must follow both. The GDPR covers lawful use of personal data, user rights and data protection impact assessments. The AI Act adds rules on how AI systems are built, tested and monitored.
In practice, the work overlaps. Your data inventory, access controls and deletion processes support both laws. The Omnibus also clarified how the two fit together, and it kept a strict standard for using special-category personal data to detect and fix bias. For EU AI Act compliance, treat your privacy team as a partner, not a separate project.
Working With Outsourced and Offshore Development Partners
Many software companies use outside teams to build AI features. That does not move the legal duty away from you. If your product ships under your name, you are still the provider. So your contracts should say who writes the technical documentation, who keeps the logs, who runs tests and who reports incidents.
Ask partners to share their own EU AI Act compliance process before you sign. Request sample documentation, test reports, and their approach to model changes. Keep the evidence in your own files, not only in theirs.
EU AI Act Compliance Self-Audit: 10 Questions for Your Team
Use these questions in your next planning meeting. If you cannot answer one, that is your first task.
- Do we have a complete list of every AI system we build, use or embed?
- Have we recorded our role (provider, deployer, importer, distributor) for each one?
- Has each system been placed in a risk tier, with a written reason?
- Have we checked our features and roadmap for banned practices?
- Do chatbots and AI content show the notices and marks the law expects?
- Do staff who use AI have documented AI literacy training?
- Do we have documentation from every third-party model supplier?
- For high-risk systems, do we have a risk register, data governance file and test plan?
- Can a human oversee, pause and override each high-risk system?
- Who owns EU AI Act compliance in our company, and when is the next review?
If you answered “yes” to eight or more, your EU AI Act compliance program is in good shape. If you answered “yes” to fewer than five, start with Steps 1 to 3 of the checklist above.
A 90-Day EU AI Act Compliance Plan for Software Teams
Use this simple plan to move from reading to doing.
Days 1 to 30: Find and Classify
- Build the AI inventory across all products and internal tools.
- Mark your role for each system: provider, deployer, importer or distributor.
- Classify each system and write a short memo for borderline cases.
- Check roadmaps and features for banned practices.
Days 31 to 60: Close the Near-Term Gaps
- Add AI notices to chatbots and label AI-generated content.
- Launch a short AI literacy program for engineers, support and sales.
- Request model documentation from every third-party AI supplier.
- Update contracts with clear duties and data rules.
Days 61 to 90: Build the Foundation for High-Risk Work
- For any high-risk system, start the risk register and the data governance file.
- Set up logging, test plans, and human oversight design.
- Name an owner for each step and set a quarterly review date.
- Brief leadership on the new dates and the effort bands.
By day 90, your EU AI Act compliance work should be visible, owned, and dated, even if the heavy high-risk duties are still ahead.
How Evolution Helps With EU AI Act Compliance
Evolution Infosystem builds AI features into real software products. That includes LLM integrations, data pipelines, testing and secure deployment. Our engineers can help you map your systems, design logging and oversight, and build the technical evidence your legal team needs. You can explore our AI services, read about our AI edge and browse our case studies.
We build the engineering side of EU AI Act compliance. For legal sign-off on classification, we recommend working with qualified EU counsel alongside our team.
Frequently Asked Questions About EU AI Act Compliance
What is the deadline for EU AI Act compliance in 2026?
There is no single deadline. Bans and AI literacy have applied since February 2025, GPAI rules since August 2025, and Article 50 transparency duties since 2 August 2026. A grace period for marking older AI-generated content ends on 2 December 2026. High-risk duties now start on 2 December 2027 and 2 August 2028.
Was the EU AI Act delayed?
Only in part. The Digital Omnibus moved the high-risk deadlines for Annex III systems to 2 December 2027 and for Annex I products to 2 August 2028. Bans, GPAI rules and most transparency duties were not delayed. So teams still have real work to do now.
What are the penalties for breaking the EU AI Act?
Fines are tiered. Prohibited practices can cost up to EUR 35 million or 7% of worldwide turnover. Most other breaches can reach EUR 15 million or 3%. Giving misleading information to authorities can reach EUR 7.5 million or 1%. Smaller firms face the lower of the two figures.
What is a high-risk AI system under the EU AI Act?
A high-risk system is AI built into a regulated product, or stand-alone AI used in sensitive areas listed in Annex III. Those areas include hiring, education, credit, biometrics, critical infrastructure and law enforcement. Narrow, non-influential tasks may be exempt if you document the reasoning.
Does EU AI Act compliance apply to companies outside the EU?
Yes, it can. The Act covers providers who place AI on the EU market, and it can apply when a system’s output is used in the EU. A software firm in India or the US selling to European customers should plan for it. Some high-risk providers must appoint an EU authorised representative.
Do chatbots need EU AI Act compliance?
Yes, in a light way. Chatbots are usually limited-risk. You must tell users they are talking to an AI system, unless it is obvious. If the chatbot makes decisions in an Annex III area, such as hiring or credit, it may become high-risk. Classify by what it does.
What is the difference between a provider and a deployer?
A provider develops an AI system, or has it developed, and places it on the market under its name. A deployer uses an AI system in its own work. Providers carry the heaviest duties. Many companies are both, for different systems.
Is the EU AI Act mandatory for open-source AI?
Partly. Some exemptions exist for open-source components, but they do not cover prohibited practices, high-risk systems or Article 50 transparency duties. Models with systemic risk also stay in scope. If you ship open-source AI inside a product, ask counsel to confirm your position.
How do I start EU AI Act compliance?
Start with an AI inventory. List every system you build or use, note your role and classify each one by risk tier. Then fix the near-term items: bans, AI literacy and transparency notices. Leave heavy documentation for high-risk systems until classification is done.
Do startups need EU AI Act compliance?
Yes, if they place AI on the EU market or serve EU users. The Act offers some relief for small firms, such as lower fine caps, simpler documentation in some cases and sandboxes. Startups should keep the plan lean and start early, because it is cheaper to build in.
Is AI literacy mandatory under the EU AI Act?
Yes, the AI literacy duty has applied since 2 February 2025. After the Omnibus, companies must support AI literacy among staff and others who use their AI. It is no longer a guarantee of a fixed level. A short, documented training program is the practical answer.
Who enforces the EU AI Act?
National market surveillance authorities enforce most rules in each member state. The EU AI Office supervises general-purpose AI models and, after the Omnibus, has wider powers over AI systems built on those models by the same provider. Expect questions from customers before you hear from regulators.
Conclusion: Your EU AI Act Compliance Checklist Starts Today
The EU AI Act did not disappear. Some dates moved, and some did not. The smart plan is to act on what is due now, prepare for what comes in 2027 and 2028, and avoid both panic and delay.
Begin with the inventory, roles and risk tiers. Add transparency notices and AI literacy. Document as you build, and review each quarter. That is the practical path to EU AI Act compliance, and it also gives you something enterprise buyers increasingly ask to see.
Need a partner for the engineering side? Contact our team and we will help you plan, build and test.
Not legal advice. This guide explains the law in plain words so your team can plan. Confirm your own classification with qualified EU counsel.