Compliance Checklists by Risk Level

Screen all AI systems against Article 5 prohibitions Art. 5 Done looks like: Every AI system has been checked against the 8 prohibited categories. Verify no subliminal or manipulative AI techniques Art. 5(1)(a) Done looks like: No AI system uses deceptive techniques to distort behaviour causing significant harm. Confirm no exploitation of vulnerable groups Art. 5(1)(b) Done looks like: No AI targets vulnerabilities based on age, disability, or socioeconomic situation. Confirm no social scoring systems Art. 5(1)(c) Done looks like: No AI evaluates/classifies people based on social behaviour leading to detrimental treatment. Verify no workplace or education emotion recognition Art. 5(1)(f) Done looks like: No AI infers emotions in workplace or education settings (except medical/safety). Document prohibited practice screening results Art. 5 compliance Done looks like: Screening results are recorded with date, reviewer, and outcome per system.

Disclose AI interaction to users Art. 50 Done looks like: Users are clearly informed when they interact with AI. Label AI-generated content Art. 50 Done looks like: AI-generated text/media is identifiable in user-facing contexts. Publish transparency notice Art. 50 Done looks like: Notices include what AI is used for and support contact info. Provide human support channel Art. 50 operationalization Done looks like: Users can escalate to a human when needed. Log transparency control checks Audit readiness Done looks like: You retain evidence that notices/labels are present and tested.

Implement risk management system Art. 9 Done looks like: A documented, iterative risk process exists with owners and thresholds. Apply data governance controls Art. 10 Done looks like: Data quality, representativeness, and bias checks are recorded. Maintain technical documentation Art. 11 Done looks like: Annex IV-aligned documentation is current and auditable. Enable record-keeping/logging Art. 12 Done looks like: Event logs exist for key system operations and decisions. Meet transparency obligations Art. 13 Done looks like: Required user/operator information is available and maintained. Establish human oversight Art. 14 Done looks like: Human intervention/override controls are defined and used. Validate robustness and accuracy Art. 15 Done looks like: Testing proves reliability and security under expected conditions. Operate quality management system Art. 17 Done looks like: QMS roles, procedures, and controls are implemented. Complete Fundamental Rights Impact Assessment Art. 27 Done looks like: FRIA is documented before deploying any Annex III high-risk system. Prepare conformity pathway Art. 43, 47-49 Done looks like: Assessment route, EU declaration, CE marking, and EU database registration are prepared. Define post-market monitoring plan Art. 72 Done looks like: Monitoring plan is documented with KPIs, drift checks, and corrective action loops. Establish serious incident reporting process Art. 73 Done looks like: Process exists to report serious incidents to authorities within 15 days. Prepare for explanation requests Art. 86 Done looks like: Staff can provide clear explanations of AI's role in decisions with legal effects.