EU AI Act Compliance Checker
Quick Answer:
The EU AI Act (Regulation 2024/1689) applies to any AI system used in the EU — regardless of where the provider is based. Risk levels run from prohibited (banned since February 2025) through high-risk, transparency-obligating, and minimal. The chatbot transparency deadline is August 2, 2026. High-risk obligations under Annex III were deferred by the Digital Omnibus to December 2, 2027. Use the checker below to get your indicative risk classification and readiness score in under two minutes.
Is Your AI System in Scope for the EU AI Act?
Most companies already know the EU AI Act exists. Far fewer have worked out whether their specific systems are actually covered — and the extraterritoriality clause is the one that surprises people most.
Article 2 of the regulation is explicit: the Act applies to providers who place AI systems on the EU market or put them into service in the EU, and to deployers who use AI systems within the EU. A company headquartered in San Francisco whose AI processes job applications for EU-based candidates is in scope. A Singapore fintech whose credit-scoring model is used by a French subsidiary is in scope. Physical presence in the EU is not the threshold. Output being used in the EU is.
The three questions that determine scope:
- Where does the AI system operate or produce output? If any of that output affects people in the EU, the Act likely applies.
- What role does your organization play? Providers (who build and place systems on the market), deployers (who use systems in a professional context), importers, and distributors each carry different obligations under Chapter III.
- Is the system explicitly excluded? Military and national-security AI, purely personal non-professional use, and open-source research with no commercial application fall outside the Act’s scope.
Who the EU AI Act Actually Covers
The Act draws a sharp line between providers — companies that develop and make an AI system available, whether commercially or for free — and deployers, who integrate or use those systems in their operations. That distinction shapes almost every obligation.
A company buying a vendor’s AI recruitment tool and using it to screen CVs is a deployer. The vendor who built and sold that tool is the provider. Both are regulated, but differently: the provider carries the documentation, conformity assessment, and registration burdens; the deployer carries transparency notices to applicants, human oversight duties, and the obligation to verify that the provider delivered what the Act requires.
Importers and distributors sit in between — they carry lighter obligations but can inherit provider-level duties if they modify the system significantly.
EU AI Act Risk Levels Explained
The regulation organizes AI systems into four tiers. The checker above maps your specific use cases to these tiers automatically. Here is what each level means in practice.
Prohibited AI Practices (Art. 5) — Banned Since February 2025
Twelve categories of AI use are banned outright. They have been prohibited since February 2, 2025 — the first milestone in the Act’s rollout. No compliance window, no transition period: if your system falls here, it was already illegal eighteen months ago.
The banned categories include social scoring systems operated by public authorities, AI that exploits vulnerable groups through subliminal manipulation, real-time remote biometric identification in public spaces (with narrow law-enforcement exceptions), retrospective biometric identification except for specifically approved cases, and AI that infers political opinions, sexual orientation, or religion from biometric data.
The penalty ceiling for prohibited practices is the highest in the Act: up to €35 million or 7% of global annual turnover, whichever is higher. For a company with €500 million in global revenue, that ceiling sits at €35 million. For a company doing €10 billion, it reaches €700 million.
High-Risk AI Systems (Annex III) — Obligations from December 2027
The Act defines high-risk AI across eight domains in Annex III: biometric identification and categorization, management of critical infrastructure, education and vocational training, employment and worker management, access to essential services (credit, insurance, benefits), law enforcement, migration and border management, and administration of justice.
An AI tool that screens job applications, scores creditworthiness, manages student admissions, or determines eligibility for public benefits sits in this category. The obligations for these systems are extensive: mandatory risk management systems, technical documentation under Annex IV, data governance practices, transparency and logging, human oversight mechanisms, accuracy and robustness requirements, and — for most systems — EU database registration.
The Digital Omnibus amendments, agreed by Parliament on June 16, 2026 and by Council on June 29, 2026, deferred the full application of Annex III obligations from the original August 2026 date to December 2, 2027. This is important: the deferral is real, but 17 months is not a long runway if building compliance takes 12–18 months, which it typically does for high-risk systems that require conformity assessment.
According to Axis Intelligence Research’s analysis of the Digital Omnibus amendments, high-risk AI embedded in regulated products under Annex I — medical devices, machinery, aviation components — carries an even later deadline of August 2, 2028.
Transparency Obligations (Art. 50) — August 2, 2026
This tier is the one with the nearest deadline. Article 50 requires that anyone deploying an AI system that directly interacts with natural persons — a chatbot, an AI assistant, a voice agent — must ensure those people know they are interacting with AI. The obligation applies from August 2, 2026: 28 days from the date this checker was last updated.
AI-generated content — synthetic images, audio, video, and text — must be labeled as machine-generated from December 2, 2026. This catches a wide range of marketing, media, and customer-communication workflows that many companies have not yet audited.
The transparency tier is the most immediate practical risk for companies that have deployed customer-facing AI. The readiness action is simple in principle — a disclosure — but the implementation requires auditing every user-facing AI touchpoint and confirming that disclosures are visible, accurate, and logged.
Minimal / Limited Risk — General-Purpose Obligations Only
AI systems that do not fall into any of the above categories carry minimal specific obligations. Article 4 requires AI literacy across the organization for anyone deploying AI in a professional context — that obligation applies already. Voluntary codes of conduct and adherence to the EU’s published guidelines are encouraged but not mandatory.
EU AI Act Compliance Timeline (Post-Digital Omnibus)
The timeline below reflects the amended schedule after the Digital Omnibus was adopted in June 2026. Companies working from older compliance trackers that still show August 2026 for Annex III are operating on superseded information.
| Date | Milestone | Status |
|---|---|---|
| August 2, 2024 | Regulation enters into force | ✅ In force |
| February 2, 2025 | Prohibited practices (Art. 5) + AI literacy (Art. 4) | ✅ Applied |
| August 2, 2025 | GPAI model obligations (Chapter V) + governance and penalties | ✅ Applied |
| August 2, 2026 | Chatbot / interaction transparency (Art. 50) | ⏱ 28 days |
| December 2, 2026 | AI-generated content labeling | Upcoming |
| December 2, 2027 | High-risk obligations — Annex III stand-alone systems | Upcoming |
| August 2, 2028 | High-risk AI in regulated products — Annex I | Upcoming |
Source: Regulation (EU) 2024/1689; Digital Omnibus amendments agreed June 16–29, 2026. Timeline compiled by Axis Intelligence Research.
GPAI Model Obligations — What General-Purpose AI Providers Must Do Now
General-purpose AI models — large language models, multimodal models, foundation models made available to third parties — have been regulated under Chapter V since August 2, 2025. This is not an upcoming deadline. It is already past.
Providers of GPAI models must maintain technical documentation, provide downstream users with information sufficient to integrate the model responsibly, establish a copyright compliance policy, and publish a summary of the training data used. Models assessed as posing systemic risk — currently defined in terms of compute thresholds — face additional requirements: adversarial testing, incident reporting to the European AI Office, and cybersecurity measures.
According to Axis Intelligence Research’s review of Chapter V obligations, the GPAI tier catches more companies than anticipated. Any organization that fine-tunes a foundation model and makes the result available to other organizations — including enterprise clients — may be operating as a GPAI provider, not merely a deployer. The distinction matters: providers carry documentation and registration duties that deployers do not.
What the EU AI Act Compliance Checker Measures
The checker above produces two outputs: a risk classification and a readiness score.
The risk classification maps your selected use cases to the Act’s hierarchy — following the same logic the regulation does, moving from prohibited (Art. 5) through high-risk (Annex III) to transparency (Art. 50) to minimal. If multiple categories apply, the highest level determines the classification.
The readiness score measures how much of the compliance groundwork relevant to your risk level is already in place. Ten readiness checkpoints are assessed. The relevant subset is filtered by your risk classification — a minimal-risk organization is not scored against high-risk documentation requirements. A score above 80 indicates solid preparation. Between 50 and 79, significant gaps remain. Below 50, the organization is materially exposed if enforcement begins.
Methodology and Limitations
The classification logic follows Regulation (EU) 2024/1689 and the Digital Omnibus amendments agreed in June 2026. Prohibited-use triggers reference Art. 5 as in force since February 2025. High-risk triggers reference Annex III as amended. Transparency triggers reference Art. 50. GPAI obligations reference Chapter V.
The checker is indicative, not legal advice. EU AI Act compliance is complex and fact-specific — the same AI system can be classified differently depending on deployment context, the deployer’s sector, whether the system is embedded in a regulated product, and the specific obligations the national competent authority interprets. This tool surfaces the most likely classification based on the answers provided. A qualified legal advisor familiar with the regulation should confirm the classification for any consequential deployment.
This tool was built by Axis Intelligence Research and is updated to reflect regulatory changes. The last update was July 5, 2026, reflecting the Digital Omnibus amendments of June 2026.
EU AI Act Compliance Checklist — 10 Actions by Risk Level
The checklist below maps the ten compliance actions the checker tracks to the risk levels that require them. Actions marked “All” apply regardless of risk classification.
| Action | Minimal | Transparency | High-Risk | GPAI |
|---|---|---|---|---|
| AI system inventory | ✅ | ✅ | ✅ | ✅ |
| Risk level classification per system | ✅ | ✅ | ✅ | ✅ |
| AI literacy program (Art. 4) | ✅ | ✅ | ✅ | ✅ |
| Transparency notices to users | — | ✅ | ✅ | ✅ |
| Technical documentation (Annex IV) | — | — | ✅ | ✅ |
| Human oversight mechanisms | — | — | ✅ | — |
| Logging and audit trail | — | — | ✅ | ✅ |
| Data governance practices | — | — | ✅ | ✅ |
| Vendor / provider documentation | — | ✅ | ✅ | — |
| Legal review of use-case classification | — | ✅ | ✅ | ✅ |
For high-risk systems embedded in regulated products (Annex I), add: conformity assessment, EU database registration, CE marking. Deadline: August 2, 2028.
Who Enforces the EU AI Act — and How
Enforcement sits with national competent authorities in each EU member state, coordinated by the European AI Office established within the European Commission. For GPAI models, the AI Office has direct supervisory authority — member-state regulators handle most other cases.
The Act’s penalty regime (Art. 99) is graduated. Prohibited-practice violations carry the highest ceiling: €35 million or 7% of global annual turnover. Violations of most other obligations — including high-risk documentation and transparency requirements — face a ceiling of €15 million or 3% of global annual turnover. Supplying incorrect, incomplete, or misleading information to authorities brings a ceiling of €7.5 million or 1%. For SMEs, the lower of the two figures (absolute or percentage) applies, which in practice limits exposure considerably for smaller companies.
Enforcement has begun. The AI Office issued its first formal notices to GPAI providers in late 2025. Member-state authorities are establishing their supervisory functions ahead of the high-risk deadline in December 2027. The compliance window is real — and shorter than it looks, given implementation timelines.
How to Use This EU AI Act Compliance Checker
Step 1 — Territorial scope. Select where your organization operates or serves users. If you have any EU users, customers, or business entities, the Act likely applies.
Step 2 — Your role. Choose provider, deployer, or both. Most enterprise technology teams are deployers of third-party AI and providers of custom-built or fine-tuned models simultaneously.
Step 3 — System characteristics. Check every category that applies to your AI systems. Be inclusive: a recruitment tool that also integrates a chatbot interface triggers both Annex III and Art. 50.
Step 4 — Readiness. Mark the compliance steps your organization has already completed. Be honest — the score reflects your actual exposure, not your ambitions.
Step 5 — Read the result. The classification and readiness score appear immediately. The next-steps section maps to your specific result. Use the “Copy link” button to share the result with your legal or compliance team.
Frequently Asked Questions
Does the EU AI Act apply to non-EU companies?
Yes. Article 2 covers providers that place AI systems on the EU market or put them into service in the EU, regardless of where the provider is incorporated. A US company whose AI system processes the data of EU residents, or whose output affects people in the EU, is in scope.
What changed with the Digital Omnibus in June 2026?
The Digital Omnibus amendments — agreed by Parliament on June 16 and Council on June 29, 2026 — deferred the application of full high-risk obligations for stand-alone Annex III systems from August 2, 2026 to December 2, 2027, and for Annex I regulated-product systems to August 2, 2028. Chatbot transparency (Art. 50) was not deferred and remains August 2, 2026. GPAI obligations (Chapter V) were not deferred and remain in force since August 2, 2025.
What is the difference between a provider and a deployer under the EU AI Act?
A provider develops an AI system and places it on the market or puts it into service. A deployer uses that system in a professional context to serve end users. Most enterprises are both — building some AI systems internally and purchasing others from vendors. The Act assigns different obligations to each role; providers carry the heavier documentation and conformity burden.
My AI vendor says their system is compliant. Does that protect us as a deployer?
Partially. If the provider has delivered all required documentation, technical instructions, and conformity evidence, the deployer’s compliance burden is lighter. But deployers retain independent obligations: transparency notices to end users, human oversight, data quality checks, and monitoring. Vendor compliance does not remove deployer responsibility — it creates the foundation for it.
What is a GPAI model and how does it differ from a regular AI system?
A general-purpose AI model (GPAI) is trained on a broad range of data and can perform a wide range of tasks — large language models, multimodal models, and foundation models made available to others fall into this category. Unlike application-specific AI systems, GPAI models are regulated at the model level under Chapter V, regardless of how they are ultimately deployed. Any organization that makes a GPAI model available to third parties — including enterprise clients — is a GPAI provider.
When does the August 2, 2026 deadline actually apply?
August 2, 2026 is the application date for Art. 50 transparency obligations: any AI system that directly interacts with natural persons must inform those users that they are interacting with AI. If you have deployed a customer-facing chatbot, AI assistant, or voice agent without that disclosure, the deadline is 28 days away as of the date this checker was last updated.
Can I rely on this checker for legal compliance decisions?
No. The checker produces an indicative classification based on the answers provided. EU AI Act compliance is fact-specific, sector-specific, and subject to interpretation by national competent authorities. The result here is a starting point for a legal review, not a substitute for one.
What does the readiness score mean in practice?
The readiness score measures how many of the compliance actions relevant to your risk classification are already in place. A score of 80 or above suggests solid preparation. 50–79 means meaningful gaps remain. Below 50 indicates material exposure. The score is calibrated to the obligations that actually apply to your classification — a minimal-risk organization is not penalized for not having high-risk documentation in place.
Go Deeper — Axis Intelligence Research
The checker surfaces your risk level. These pages supply the data behind it.
- EU AI Act Statistics 2026 — the regulation in numbers: adoption timelines, enforcement activity, compliance costs by company size
- EU AI Act Compliance Cost Statistics — what readiness actually costs, by organization size and risk tier
- EU AI Act Fines Statistics — penalty ceiling analysis, early enforcement actions, and how regulators are sizing fines
- EU AI Act Compliance Statistics — readiness levels across EU industries, compliance gaps, and survey data
- EU AI Act News — Digital Omnibus updates, enforcement notices, national authority guidance, tracked as it lands
Embed This Checker
Use this tool in your compliance documentation, intranet, or client-facing resources. Attribution link required.
<iframe src="https://axis-intelligence.com/wp-content/uploads/tools/eu-ai-act-compliance-checker.html"
style="width:100%;height:3200px;border:0;" loading="lazy"
title="EU AI Act Compliance Checker | Axis Intelligence"></iframe>
<p style="font-size:12px;">EU AI Act Compliance Checker by <a href="https://axis-intelligence.com/eu-ai-act-compliance-checker/">Axis Intelligence</a> — indicative, not legal advice.</p>
Last updated: July 5, 2026. This page reflects the Digital Omnibus amendments adopted June 16–29, 2026. Review trigger: next update will be published when the European AI Office issues formal guidance on Art. 50 enforcement or when a member-state authority publishes its first Art. 50 enforcement decision — whichever comes first.
Not legal advice. Classification is indicative. Consult qualified legal counsel for compliance decisions.