EU AI Act Compliance Checklist for Generative AI

This article gives you a direct, actionable compliance checklist for companies deploying generative AI under the EU AI Act, covering the rules that apply now and in the coming years. You will learn which obligations hit your specific use case, what documentation and technical measures you need, and how to prepare without over‑engineering. The checklist below reflects the Act’s tiered, risk‑based approach—most generative AI deployments fall into “limited risk” or “transparency” obligations, but some become “high‑risk” depending on context.

Background: Why the EU AI Act Matters for Generative AI

The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive horizontal law for artificial intelligence. It applies to any organisation that places AI systems on the EU market or whose AI outputs are used in the EU—regardless of where the company is based. For generative AI, the Act introduces two distinct layers:

General‑purpose AI (GPAI) – models like large language models (LLMs) that can perform a wide range of tasks. Providers of GPAI have specific obligations, including technical documentation and copyright policies.
Specific use‑cases – when you deploy generative AI for a particular purpose (e.g., hiring, credit scoring, medical diagnosis), your system may be classified as high‑risk under Annex III, triggering far stricter duties.

The Act’s compliance deadlines are staggered: most provisions apply from 2 August 2026, but prohibitions on unacceptable‑risk systems applied from 2 February 2025, and GPAI obligations apply from 2 August 2025. If your generative AI is already in use, you should be working towards compliance now.

How the Risk‑Based Framework Classifies Generative AI

The first step in your checklist is to determine your risk tier. The Act defines four levels:

Unacceptable risk – AI systems that manipulate behaviour, exploit vulnerabilities, or enable social scoring. These are banned outright. Generative AI that, for example, generates deepfakes for political manipulation could fall here.
High risk – AI used in critical infrastructure, education, employment, essential services, law enforcement, migration, and justice. If your generative AI automates CV screening or grades exams, it is high‑risk.
Limited risk – AI that interacts with users, such as chatbots or deepfake generators. The main duty is transparency: users must know they are interacting with AI.
Minimal risk – most other generative AI tools (e.g., internal code assistants). No mandatory obligations, but you can adopt voluntary codes of conduct.

Note that the Act’s high‑risk list is not exhaustive—if your AI is a safety component of a product covered by EU harmonisation legislation (e.g., medical devices), it is automatically high‑risk.

The Core Compliance Checklist for Generative AI Deployers

For most companies using off‑the‑shelf generative AI (not building their own foundation model), the practical checklist is:

1. Determine your role – Are you a provider (you develop the model or system) or a deployer (you use it in your business)? Obligations differ. Deployers have fewer duties but still must follow user instructions and monitor for risks.
2. Conduct a risk assessment – Document the intended purpose, potential harms, and the risk tier. This is mandatory for high‑risk systems and good practice for all.
3. Ensure transparency – If your AI interacts with humans, inform them they are speaking to AI. If you generate deepfakes, disclose that the content is synthetic. This applies even to limited‑risk systems.
4. Implement data governance – Ensure your training data (if you train a model) respects copyright and privacy. For deployers, ensure you use the AI in line with data protection laws (GDPR).
5. Set up human oversight – For high‑risk systems, you must have human review of outputs, the ability to override decisions, and clear procedures for interpreting results.
6. Maintain technical documentation – For GPAI providers, you need a model card, training data summary, and evaluation results. Deployers should keep logs of system use and outputs for high‑risk contexts.
7. Register in the EU database – High‑risk AI systems must be registered in the EU’s public database before deployment.
8. Plan for post‑market monitoring – Continuously monitor for incidents and report serious incidents to authorities if you are a high‑risk provider.

Common Problems and Misconceptions

One frequent misunderstanding is that the AI Act applies only to tech companies. In reality, any business using generative AI in HR, customer service, or product development is affected. Another misconception is that open‑source models are exempt—they are not fully exempt; the Act has a limited exemption for open‑source GPAI models, but it does not cover high‑risk uses or models with systemic risk.

A practical challenge is the interplay with GDPR. The AI Act does not replace data protection law; you must comply with both. For example, if your generative AI processes personal data, you need a legal basis under GDPR, and you must conduct a Data Protection Impact Assessment (DPIA) if the processing is high‑risk.

Finally, many companies assume that using a third‑party API (like a commercial LLM) shifts all liability to the provider. While the provider has duties, deployers still have obligations—especially transparency and human oversight. You cannot outsource compliance entirely.

How to Choose Between Compliance Approaches

Your approach depends on your risk tier and resources. For minimal‑risk internal tools, a lightweight policy—like a usage guideline and staff training—may suffice. For limited‑risk customer‑facing chatbots, you need clear disclosure and a way for users to flag issues. For high‑risk systems, you must invest in robust processes: detailed documentation, regular audits, and a governance framework.

If you are building on a foundation model, choose providers that already comply with GPAI obligations (e.g., they publish model cards and copyright policies). This reduces your burden. Also consider whether you can avoid high‑risk classification by redesigning the system—for example, not using AI to make final hiring decisions but only to shortlist candidates, with a human always making the final call.

Costs and Practical Implementation

Compliance costs vary widely. A minimal‑risk deployment may only require a few hours of legal review and drafting a disclosure notice. High‑risk systems can cost tens of thousands of euros per year for documentation, audits, and external counsel. The Act also allows for fines up to 7% of global annual turnover for prohibited practices, or 3% for other violations—so non‑compliance is not cheap.

To keep costs manageable, start with a gap analysis. Map your current AI systems to the Act’s categories and prioritise the highest‑risk ones. Use existing frameworks like the NIST AI Risk Management Framework or ISO/IEC 42001 to structure your governance. Many companies find that integrating AI compliance into their existing GDPR compliance programme is efficient, since the two laws share concepts like risk assessment and documentation.

Safety and Human Oversight Best Practices

Even if your generative AI is minimal‑risk, adopting safety best practices reduces liability and builds trust. Key measures include:

Output filtering – Use filters to block harmful, biased, or illegal content.
Human review for consequential decisions – Never let AI make final decisions on employment, credit, or healthcare without a human in the loop.
Testing and validation – Regularly test your AI against benchmarks for bias, accuracy, and robustness.
Incident response plan – Have a clear procedure for when the AI causes harm or produces a dangerous output.
Staff training – Ensure employees understand the AI’s limitations and how to override it.

Remember, the EU AI Act is not static—the European Commission will issue implementing acts and guidance. Stay informed through official channels and industry bodies.

Alternatives to Full Compliance for Low‑Risk Use

If you are a small business using generative AI for internal drafting or idea generation, you may not need a full compliance programme. The Act’s obligations are proportionate to risk. For minimal‑risk uses, you can simply adopt a voluntary code of conduct, ensure you use reputable AI tools, and maintain basic documentation. However, if you scale up or move into higher‑risk areas, you must escalate your compliance efforts.

Another alternative is to outsource the entire AI function to a vendor that already complies with the Act. For example, using a major cloud provider’s AI services with built‑in transparency and safety features can shift much of the burden. But always verify that the vendor’s compliance covers your specific use case.

Frequently Asked Questions

Does the EU AI Act apply to my company if we are based outside the EU?

Yes, if your AI system is placed on the EU market or its outputs are used in the EU. Even if you are a US‑based company, you must comply when serving EU customers or employees.

What is the deadline for compliance?

Most obligations apply from 2 August 2026. Prohibitions on unacceptable‑risk AI applied from 2 February 2025, and general‑purpose AI rules from 2 August 2025. If you are a high‑risk provider, you should already be preparing.

Are open‑source generative AI models exempt from the Act?

Not fully. There is a limited exemption for open‑source GPAI models, but it does not apply to high‑risk uses or models with systemic risk (e.g., very large models). Even open‑source models must comply with copyright requirements.

What happens if we don’t comply?

Fines can reach up to 7% of global annual turnover for prohibited practices, 3% for other violations, or €15 million, whichever is higher. Smaller companies may face lower fines, but reputational damage can be severe.

Do we need to register our AI system with the EU?

Only high‑risk AI systems must be registered in the EU database. Limited‑risk systems do not need registration, but you must still provide transparency to users.

How does the AI Act interact with GDPR?

They are separate laws. The AI Act does not override GDPR. You must comply with both, and the AI Act even requires you to process personal data in line with GDPR. A DPIA may be needed for high‑risk AI processing.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.

More cards in this drawer

The whole Numbers and Powers drawer →