Compliance Checklists by Risk Level

Disclose AI interaction to users Art. 50 Done looks like: Users are clearly informed when they interact with AI. Label AI-generated content Art. 50 Done looks like: AI-generated text/media is identifiable in user-facing contexts. Publish transparency notice Art. 50-52 Done looks like: Notices include what AI is used for and support contact info. Provide human support channel Art. 50 operationalization Done looks like: Users can escalate to a human when needed. Log transparency control checks Audit readiness Done looks like: You retain evidence that notices/labels are present and tested.

Implement risk management system Art. 9 Done looks like: A documented, iterative risk process exists with owners and thresholds. Apply data governance controls Art. 10 Done looks like: Data quality, representativeness, and bias checks are recorded. Maintain technical documentation Art. 11 Done looks like: Annex IV-aligned documentation is current and auditable. Enable record-keeping/logging Art. 12 Done looks like: Event logs exist for key system operations and decisions. Meet transparency obligations Art. 13 Done looks like: Required user/operator information is available and maintained. Establish human oversight Art. 14 Done looks like: Human intervention/override controls are defined and used. Validate robustness and accuracy Art. 15 Done looks like: Testing proves reliability and security under expected conditions. Operate quality management system Art. 17 Done looks like: QMS roles, procedures, and controls are implemented. Prepare conformity pathway Conformity requirements Done looks like: Assessment route and evidence package are prepared for review. Define post-market monitoring Lifecycle obligations Done looks like: Monitoring and corrective action loops are active.