EU AI Act Compliance Checklist for 2026: A Practical Guide for Businesses

The EU AI Act applies to organisations that build, sell or use AI systems in the EU market, including many companies outside Europe that serve EU customers. Obligations phase in over several years, so starting early is far cheaper than rushing later. This checklist is a practical starting point, not legal advice.

STEP 01Build an AI inventory

• List every AI system in use: internal models, SaaS tools (ChatGPT, Copilot, Gemini) and AI features inside vendor products.
• Record owner, purpose, data used, users affected and whether you are the provider or deployer.
• Include shadow AI: tools staff use without approval.

STEP 02Classify risk

STEP 03Put governance in place

1. 1Assign an accountable AI owner and a cross functional review group.
2. 2Publish an acceptable use policy for generative AI.
3. 3Adopt an AI management system; ISO/IEC 42001 gives a certifiable structure.

STEP 04Technical and security controls

• Data governance: quality, provenance and bias checks for training and input data.
• Logging and traceability of AI decisions, retained for audit.
• Security testing of LLM apps: prompt injection, data leakage and jailbreak testing (OWASP Top 10 for LLM Applications).
• Human oversight: clear points where a person can review or override outputs.

STEP 05Documentation and evidence

• Technical documentation and risk assessments for each high risk system.
• Transparency notices for users interacting with AI.
• Incident reporting procedure for serious AI incidents.

We run AI governance gap assessments, LLM red teaming and shadow AI audits, mapped to the EU AI Act and ISO 42001, so you get a prioritised remediation plan instead of a pile of legal text.

More frequently asked questions

Does the EU AI Act apply outside the EU?

Yes, if your AI system is placed on the EU market or its output is used in the EU.

Where should we start?

Build an AI inventory, classify risk, then close gaps for high risk systems first.