EU AI Act Checklist

The security landscape is challenging right now and, according to Vanta’s State of Trust Report, 55% of organisations say that security risks have never been higher. 
‍

The rapid adoption of AI technologies in the workplace has only added to this challenge, as organisations are required to deliver more oversight and governance as a result. But as AI adoption accelerates, governance and risk management typically stall, with only 2 in 5 (37%) organisations currently conducting, or in the process of conducting, regular AI risk assessments.
‍

This means that organisations are under growing pressure from increased AI regulation–chief among them, the European Union's Artificial Intelligence Act (AI Act).

‍

What is the EU AI Act?

The EU AI Act is a comprehensive, risk-based legal framework governing AI systems placed on the EU market, put into service, or used in the European Union—including systems from providers and deployers outside the EU when the system's output is used in the EU. It entered into force on August 1, 2024, and its requirements are being phased in through August 2, 2028.
‍

The Act is designed to create a consistent legal framework for AI across the EU while protecting fundamental rights, health, and safety. It prohibits certain AI practices deemed to pose unacceptable risk, establishes transparency requirements for particular AI systems and AI-generated content, regulates general-purpose AI models, and creates more extensive requirements for high-risk AI systems.
‍

In July 2026, the EU adopted the AI Omnibus, which amended parts of the Act. Among other changes, it extended the application dates for high-risk AI requirements, added prohibitions covering certain non-consensual intimate content and child sexual abuse material, expanded access to regulatory sandboxes, and simplified some obligations for small and mid-cap businesses.
‍

But what does this mean for your business?
‍

The AI Act may apply to organizations both inside and outside the EU. Its scope includes providers that place AI systems or general-purpose AI models on the EU market, deployers located in the EU, importers and distributors, and certain providers or deployers outside the EU when an AI system’s output is used in the EU. Whether your organization is covered—and which obligations apply—depends on your role, the AI system involved, and how and where that system is used.

The Act’s requirements are not limited to high-risk AI. Prohibitions on certain AI practices have applied since February 2, 2025, requirements for general-purpose AI models since August 2, 2025, and transparency requirements for certain AI systems since August 2, 2026. Requirements for high-risk systems listed in Annex III apply from December 2, 2027, while requirements for high-risk systems embedded in regulated products covered by Annex I apply from August 2, 2028.
‍

Organizations should therefore identify the AI systems they provide or use, determine their role under the Act, classify each system based on its intended purpose and use, and document which requirements apply. Changes to an AI system or the context in which it is used may also require its classification and obligations to be reassessed.
‍

The Act does not provide a blanket exemption based on company size, although some requirements and penalties are adjusted for smaller organizations. Obligations differ significantly among providers, deployers, importers, distributors, and other parties, so organizations should avoid treating compliance as a single, universal checklist.
‍

Violations can result in significant penalties. Non-compliance with prohibited AI practices can carry fines of up to €35 million or 7% of worldwide annual turnover, while different maximums apply to other violations. The precise penalty depends on the infringement and the organization involved, with lower applicable ceilings for SMEs.
‍

Beyond regulatory compliance, establishing strong AI governance can help organizations manage risk, build customer confidence, and demonstrate that they are adopting AI responsibly.

‍

How is the EU AI Act different from ISO 42001 certification?

The EU AI Act is a binding regulation for organizations and AI activities that fall within its scope. ISO/IEC 42001 is a voluntary international standard for establishing, implementing, maintaining, and continually improving an AI management system.
‍

The two frameworks overlap in areas such as governance, risk management, policies, accountability, competence, and ongoing improvement. Implementing ISO 42001 can therefore provide a useful operational foundation for preparing for the AI Act.
‍

However, ISO 42001 certification does not automatically establish compliance with the AI Act. Organizations must still determine their specific role and obligations under the Act and address applicable legal requirements that may not be fully covered by the standard.

‍

How to use this checklist

This checklist outlines practical steps that can help your organization prepare for applicable EU AI Act requirements. It focuses on obligations that apply to AI systems; if your organization develops or places general-purpose AI models on the EU market, you'll also need to address the separate provider obligations under Chapter V, including technical documentation, information for downstream providers, a copyright policy, a public summary of training content, and additional requirements for models with systemic risk. Because obligations depend on your role and the AI systems you provide or deploy, begin by establishing scope, building an inventory of AI systems, and classifying each system based on its intended purpose and use.
‍

Use the checklist to evaluate your current governance program, identify gaps, assign owners, and track the policies, controls, assessments, documentation, and evidence relevant to your organization. A trust management platform like Vanta can help automate and streamline key activities, reducing manual work and helping teams maintain visibility as AI systems and regulatory requirements evolve.
‍

This checklist is intended for informational purposes and does not constitute legal advice. Organizations should consult qualified legal counsel to determine how the EU AI Act applies to their specific circumstances.
‍

Let’s dive in. 

‍

{{eu-ai-act-2="/checklists"}}