EU AI Act Compliance Checklist 2026: A 10-Step Playbook

The Alice Labs EU AI Act Readiness Assessment

In short

The Alice Labs EU AI Act Readiness Assessment is a proprietary 25-point checklist that scores an organisation's compliance posture across inventory, classification, documentation, governance, and monitoring — used in 12+ Nordic enterprise engagements in 2025-2026.

We built the Alice Labs EU AI Act Readiness Assessment after seeing the same gaps repeat across enterprise clients. It is a 25-point checklist organised into five domains, each scored on a 0-4 maturity scale.

The five domains map directly to the structure of Regulation (EU) 2024/1689:

• System inventory and classification (5 points). Every AI system identified, classified, and registered with a business owner.
• Technical documentation (5 points). Annex IV completeness, version control, and 10-year retention.
• Risk and rights assessment (5 points). FRIA quality, risk management system, bias testing.
• Governance and literacy (5 points). Article 4 training, governance committee, vendor controls.
• Monitoring and incident response (5 points). Logging, post-market monitoring, incident reporting workflows.

In Alice Labs' EU AI Act engagements with 12+ Nordic enterprises in 2025-2026, the most common gap is missing technical documentation for AI systems already in production. The second most common gap is an incomplete inventory — leadership consistently underestimates how many AI systems exist inside the organisation.

A baseline assessment typically takes 2-3 weeks. Closing the gaps takes 8-16 weeks depending on system count and risk profile.

Risk Classification Framework: Four Tiers Explained

In short

The EU AI Act classifies AI systems into four tiers: unacceptable risk (banned), high-risk (Annex III, full obligations), limited risk (transparency only), and minimal risk (no obligations). Most enterprise AI falls into limited or minimal risk.

Classification is the gate that determines every downstream obligation. Misclassification is the most expensive mistake an organisation can make under the AI Act.

Use the table below as a first-pass mapping. Edge cases — for example, a chatbot that screens job applicants — almost always require legal review before classification is finalised.

Source: Regulation (EU) 2024/1689

High-Risk Requirements Deep-Dive: Annex IV Documentation

In short

Annex IV requires nine documentation categories for every high-risk AI system: general description, system design, monitoring, performance metrics, risk management, lifecycle changes, standards applied, EU declaration of conformity, and post-market monitoring plan.

Annex IV is the heart of high-risk compliance. It is also where most enterprises are weakest. The documentation must be ready before a system is placed on the market and updated continuously for 10 years after the last unit is placed on the market.

The nine required sections are:

1. General description. Intended purpose, version, provider name, hardware on which it runs, user interface.
2. Detailed design. System architecture, key design choices, training methodology, datasets used, computational resources.
3. Monitoring, functioning, and control. Capabilities and limitations, foreseeable outputs, expected accuracy levels.
4. Performance metrics. Test datasets, validation results, accuracy, robustness, cybersecurity testing.
5. Risk management system. Identified risks, mitigation measures, residual risk acceptance criteria.
6. Lifecycle changes. Version control, change log with dates, rationale for each change.
7. Harmonised standards applied. CEN-CENELEC, ISO, or IEC standards used to demonstrate conformity.
8. EU declaration of conformity. Issued by the provider, signed, retained for 10 years.
9. Post-market monitoring plan. Data collection, analysis cadence, escalation procedures.

Treat Annex IV as a living artefact, not a one-time deliverable. Build it into the system's CI/CD pipeline so it never goes stale.

GPAI Obligations: A Separate Track

In short

General-Purpose AI (GPAI) models — foundation models like GPT-4, Claude, and Gemini — follow a separate obligation track under Articles 51-55: documentation, copyright compliance, training-data summaries, and codes of practice. A 10^25 FLOPs training-compute threshold triggers systemic-risk obligations.

GPAI obligations apply from 2 August 2025 and target the model providers themselves — OpenAI, Anthropic, Google DeepMind, Meta, Mistral, and others. If you build on top of these models, the primary GPAI obligations sit with the provider, not you.

All GPAI providers must:

• Maintain technical documentation covering training, evaluation, and intended use.
• Comply with EU copyright law, including respecting Text and Data Mining (TDM) opt-outs.
• Publish a sufficiently detailed summary of the content used for training the model.
• Cooperate with the AI Office and provide information to downstream providers.

Models trained with more than 10^25 FLOPs of compute are presumed to pose systemic risk and trigger additional obligations: model evaluations, adversarial testing, serious-incident reporting, and cybersecurity protections.

If you are a deployer building on GPAI, your obligations primarily track with the use case — high-risk if Annex III applies, limited risk for chatbots and content generation. The model provider's documentation flows down to support your own.

Penalties and Timeline: What's at Stake and When

In short

EU AI Act penalties scale by violation: up to €35M or 7% of global turnover for prohibited practices, up to €15M or 3% for other infringements, and up to €7.5M or 1% for incorrect information. The timeline runs from 1 August 2024 entry into force to 2 August 2027 full enforcement.

The penalty structure is more aggressive than GDPR's 4% cap. For prohibited AI practices, the AI Act allows up to 7% of global annual turnover — and supervisory authorities have signalled they will use it.

The three penalty tiers are:

• €35M or 7% of global turnover for violating prohibited AI practices under Article 5 (whichever is higher).
• €15M or 3% of global turnover for other violations of obligations on providers and deployers.
• €7.5M or 1% of global turnover for supplying incorrect, incomplete, or misleading information to authorities.

The applicability timeline is staggered:

1. 1 August 2024. Regulation enters into force.
2. 2 February 2025. Prohibited practices ban and Article 4 AI literacy obligations apply.
3. 2 August 2025. GPAI obligations and governance provisions apply.
4. 2 August 2026. High-risk system obligations (Annex III) apply — the main enforcement milestone.
5. 2 August 2027. Full enforcement, including high-risk systems under Annex I (product safety).

If your roadmap doesn't have a delivery line for 2 August 2026, now is the time to add one.