Checklist · AI
EU AI Act Readiness Checklist
Opens with creditsA practical checklist for engineering and product teams whose AI systems reach people in the EU. It walks through whether the AI Act applies to you and in which role, the prohibited practices, high-risk classification, transparency duties, general-purpose AI model obligations, deployer and provider duties for high-risk systems, and the dates each part applies, with a severity and a verification step for every check.
Written by Tauseef Fayyaz7 chapters, 32 checksAbout 20 minReviewed 13 October 2026What you will learn
7 chapters · about 20 min
1Scope and your roleBefore any obligation, work out whether the Act reaches your systems and in what role. Providers and deployers carry very different duties, and one company can be both.5 checks · 3 min
- 1Keep an inventory of every AI system and model you build, buy or use
- 2Check whether the Act reaches you, including when only the output is used in the EU
- 3Record for each system whether you are the provider, the deployer or both
- 4Know the changes that turn a deployer or reseller into a provider
- 5Apply exclusions only where the text clearly covers you, and write down why
5 in this chapterOpen this chapter2Prohibited practicesArticle 5 bans a short list of practices outright. These apply already, and carry the highest fines, so screen every use case against them first.4 checks · 3 min
- 1Screen every AI use case against the Article 5 list and record the result
- 2Remove emotion inference from workplace and education features
- 3If you generate images, video or audio, block non-consensual intimate content and CSAM
- 4Review persuasion and personalisation features for manipulation risk
4 in this chapterOpen this chapter- High-risk classificationWhether a system is high-risk decides most of your workload. Classify each system against Article 6 and Annex III, and record the reasoning.4 checks · 2 minOpens with credits
- Transparency dutiesArticle 50 covers chatbots, synthetic content, deepfakes and some biometric uses, whatever their risk level. According to the Commission, these rules come into effect in August 2026.4 checks · 3 minOpens with credits
- General-purpose AI modelsMost app teams use general-purpose models rather than provide them, but both sides have work to do. These checks cover Article 53 duties and what to ask your model vendor for.4 checks · 2 minOpens with credits
- High-risk systems: provider and deployer dutiesIf a system is high-risk, these duties apply from 2 December 2027 for Annex III use cases and 2 August 2028 for Annex I products. They take time to build, so plan them now.6 checks · 4 minOpens with credits
- AI literacy, governance and datesThe last checks keep the work going: staff literacy, ownership, a dated plan and a way to notice when the rules change.5 checks · 3 minOpens with credits
About this checklist
The EU AI Act (Regulation (EU) 2024/1689) is the first broad law on artificial intelligence, and it reaches well beyond companies based in Europe. If you place an AI system on the EU market, or the output of your system is used in the EU, parts of it can apply to you even if your team sits elsewhere. This EU AI Act readiness checklist turns the regulation into checks an engineering or product team can actually run: an inventory to build, a classification to record, a disclosure to ship, a log to keep.
The Act sorts AI by risk. A short list of practices is banned outright. Systems used in sensitive areas such as hiring, education and credit scoring are high-risk and carry strict duties. Chatbots and generators of synthetic content carry transparency duties. Most other AI, such as spam filters, has no specific obligations. Providers of general-purpose AI models have their own set of duties. Your work is mostly about knowing which of these buckets each of your systems falls into, and proving it.
Dates matter, and they have moved. According to the European Commission, the Act entered into force on 1 August 2024 and became applicable on 2 August 2026, with exceptions: prohibitions and AI literacy from 2 February 2025, general-purpose AI model rules from 2 August 2025, and, after the AI Omnibus amendment that entered into force on 27 July 2026, high-risk rules for Annex III use cases from 2 December 2027 and for Annex I products from 2 August 2028. Every date in this checklist is stated as the official Commission pages and the consolidated text on the AI Act Service Desk give it, as of October 2026.
This is general guidance written from the official text, not legal advice. The regulation has exceptions, delegated acts and guidelines that can change how a rule applies to your product, so confirm your classification and duties with qualified counsel before you rely on them. Each check has a severity (must, should or nice) and a concrete way to verify it.
Common questions
Does the EU AI Act apply to companies outside the EU?
It can. Article 2 applies the Act to providers placing AI systems or general-purpose models on the EU market wherever they are established, and to providers and deployers in third countries where the output of the AI system is used in the EU. If you have EU users or customers, assume it applies and check each system.
When do the EU AI Act high-risk rules apply?
According to the European Commission, after the AI Omnibus amendment the high-risk rules for Annex III use cases, such as employment, education and credit scoring, apply from 2 December 2027, and for AI in products covered by Annex I legislation from 2 August 2028. Check the Commission's AI Act page for any later changes.
Is a chatbot high-risk under the AI Act?
Not by itself. A general chatbot usually carries transparency duties under Article 50: people must be told they are interacting with an AI system unless it is obvious. It becomes high-risk if it is used for an Annex III purpose, such as screening job applicants or deciding eligibility for public benefits.
What is the difference between a provider and a deployer?
The provider develops an AI system or model, or has it developed, and puts it on the market or into service under its own name. The deployer uses an AI system under its authority in a professional context. A company that builds an AI product on a vendor model and sells it is the provider of that product, and the deployer when it uses the product itself.
Do I need to watermark AI-generated content?
If you provide a system that generates synthetic audio, images, video or text, Article 50(2) requires outputs to be marked in a machine-readable format and detectable as AI-generated, as far as technically feasible. Systems already on the market before 2 August 2026 have until 2 December 2026. Deployers separately must label deepfakes.
Is this checklist legal advice?
No. It is general guidance written from the official text on EUR-Lex and the European Commission's AI Act pages as of October 2026. The Act has exceptions, guidelines and amendments that can change how it applies to a specific product, so confirm your classification and duties with qualified counsel.
Sources (8)
Checked against these, last on 13 October 2026.
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), EUR-Lexeur-lex.europa.eu/eli/reg/2024/1689/oj/eng
- AI Act: regulatory framework on AI, European Commissiondigital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
- AI Act Service Desk, European Commissionai-act-service-desk.ec.europa.eu/en
- Article 113: Entry into force and application, AI Act Service Desk, European Commissionai-act-service-desk.ec.europa.eu/en/ai-act/article-113
- Article 50: Transparency obligations for providers and deployers of certain AI systems, AI Act Service Desk, European Commissionai-act-service-desk.ec.europa.eu/en/ai-act/article-50
- Article 26: Obligations of deployers of high-risk AI systems, AI Act Service Desk, European Commissionai-act-service-desk.ec.europa.eu/en/ai-act/article-26
- Commission publishes the Guidelines on prohibited artificial intelligence (AI) practices, as defined by the AI Act, European Commissiondigital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act
- The General-Purpose AI Code of Practice, European Commissiondigital-strategy.ec.europa.eu/en/policies/contents-code-gpai
Related on Sefism
Picked from the other libraries by shared topics.
Roadmaps
See allCheat sheets
See allBest practices
See all- Best Practices for Building LLM AppsHow to build LLM apps and agents that hold up in production: prompts, evals, prompt injection, tool permissions, cost, logging and privacy.
- Prompt Engineering Best PracticesHow to write prompts that work the same way on the hundredth input as on the first: clear instructions, structure, examples, reasoning, output control and testing.
- Best Practices for AI Coding AssistantsHow to get reliable code from AI coding assistants and agents: instruction files, task prompts, verification, review, security, dependencies and session hygiene.
Checklists
See all- RAG Production ChecklistA RAG production checklist: chunking, embeddings, hybrid search, reranking, per-user permissions, citations, evals, re-indexing and cost, with how to verify each check.
- LLM Evaluation ChecklistAn LLM evaluation checklist: success criteria, eval datasets, code and model graders, judge calibration, agent evals, safety tests and production monitoring, with how to verify each check.
- AI Feature Launch ChecklistAn AI feature launch checklist: use case fit, evals, UX for errors, disclosure, human override, abuse filters, rate limits, cost caps, prompt privacy, monitoring and rollback.
Project structures
See all- GenAI RAG app (FastAPI) project structureFor developers turning a "chat with your documents" demo into an app people can rely on. A FastAPI backend where every layer has a home: ingestion workers, retrieval, prompts as versioned files, model clients with fallbacks and cost caps, guards, evals that gate CI, and tracing, so a wrong answer can be traced to the step that caused it.
- AI agent with an MCP server project structureFor developers who want to give AI assistants safe access to their own data or API. A TypeScript MCP server built on the official SDK, organised by feature (tasks, projects) with each feature owning its tools, resources and prompts, served over stdio for local hosts and Streamable HTTP with OAuth for remote ones, plus a small agent and the evals that prove a model can use it.
- Machine learning project project structureFor students and analysts whose model works in a notebook and now needs to be reproducible, reviewable, served and watched. It starts from the Cookiecutter Data Science v2 layout (immutable raw data, numbered notebooks, a real Python package) and grows into versioned data with DVC, typed parameters, data validation with pandera, experiment tracking and a model registry with MLflow, a FastAPI prediction service, drift monitoring and, for a team, scheduled retraining, model cards, fairness checks and shadow deployment.
Career questions
See all- Which AI tools do employers expect junior developers to know in 2026?Employers rarely require a specific brand. They expect you to use an AI coding assistant well (in the editor and in the terminal), to review and test what it produces, to call an LLM API in a small feature, and to explain when you would not use AI. Pick one assistant, learn it properly, and show judgement in your projects.
- How do I use AI to become a better engineer instead of becoming dependent on it?Decide the job AI does before you open it. Use it as a tutor, reviewer and sparring partner that explains and challenges, not a vending machine that hands you finished code. Attempt first, ask second, and always be able to explain and defend what you ship.
- How do I start learning AI agents as a software engineer?Start with one LLM API and plain code: a loop that calls the model, lets it pick a tool, runs the tool and feeds the result back. Build one small agent that does a real task end to end, add evaluation and guardrails, and only then reach for a framework. Agents are software engineering first.
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com