> EU AI Act checklist: review AI inventory, roles, risk classes, prohibited practices, AI literacy and deployer obligations – free online and as a PDF. Source: [https://docxpert.io/en/checklists/eu-ai-act](https://docxpert.io/en/checklists/eu-ai-act) # EU AI Act Checklist for Companies Save as PDF Print-ready version with tick boxes. [Get the PDF](https://docxpert.io/en/checklists/eu-ai-act#download) ## What already applies The AI Act entered into force on 1 August 2024 and applies in stages. Since **2 February 2025**, the bans on certain AI practices (Art. 5) and the **AI literacy** obligation (Art. 4) apply: providers and deployers must ensure that their staff have a sufficient level of AI knowledge. Since 2 August 2025, obligations for general-purpose AI models apply. High-risk timeline in flux At the end of 2025 the European Commission proposed postponing part of the high-risk obligations. Check the current status of the legislative process before planning. The basics – inventory, classification, AI literacy – pay off either way. Detailed explanations are in our guide to [EU AI Act obligations for companies](https://docxpert.io/en/guides/eu-ai-act-ai-inventory). ## AI Act checklist ### AI inventory - All AI systems in use or under development are recorded, including AI embedded in purchased software. - For each system, purpose, business area, owners and provider are documented. - The data used (especially personal data) is described for each system. - New AI systems go through a review before use (approval process). ### Role and classification - Your role per system is determined: provider, deployer, importer or distributor. - Each system is assigned a risk class: unacceptable, high, limited (transparency) or minimal. - The classification is justified, especially for Annex III use cases (e.g. employment, education, creditworthiness). - It has been checked that no prohibited practices under Art. 5 apply (e.g. emotion recognition in the workplace, social scoring). ### AI literacy (Art. 4) - Competence needs are described for roles that use or steer AI. - Training on how the AI in use works, its limits and risks has taken place. - Attendance and training content are documented as evidence. - An internal AI policy defines permitted use, data and review duties. ### Transparency (Art. 50) - People are informed when they interact with an AI system such as a chatbot. - Artificially generated or manipulated content (text, image, audio, video) is labelled where required. ### Deployer obligations for high-risk AI (Art. 26) - The system is used in accordance with the provider's instructions for use. - Human oversight is defined: who oversees it, with what competence and authority? - Input data, as far as you control it, is relevant and representative. - Operation is monitored; risks and serious incidents are reported to the provider. - Automatically generated logs are kept for at least six months. - Workers and their representatives are informed before use in the workplace. - Where required, a fundamental rights impact assessment (Art. 27) has been carried out. ### Governance - A function responsible for AI governance is appointed. - The AI inventory is reviewed regularly and updated when things change. - Dependencies on data protection (GDPR) and information security are considered. ## Keeping evidence structured The [AI register](https://docxpert.io/en/features/ai-register) in docxpert records systems with role, risk tier and operating status and links them to the requirements of the EU AI Act and [ISO 42001](https://docxpert.io/en/standards/iso-42001). You evidence AI literacy with [training records](https://docxpert.io/en/features/training-certification). ## Download the checklist as PDF Print-ready with tick boxes – ideal for your next audit or team meeting. Free; we also email you the link. ## Frequently asked questions Is an AI inventory mandatory? The regulation does not explicitly require an inventory. But without one you can determine neither your role nor the risk class – so it is the practical first step. Does the AI Act apply to using ChatGPT in the company? Yes, as a deployer you have at least the AI literacy obligation. Depending on the use case, transparency obligations may apply, for example in customer communication. What penalties apply? For prohibited practices up to EUR 35 million or 7% of worldwide annual turnover; for other infringements up to EUR 15 million or 3%. ## Read next [EU AI Act obligationsRoles, risk classes, AI literacy and the AI inventory – what companies should do now.Learn more](https://docxpert.io/en/guides/eu-ai-act-ai-inventory) [AI registerRecord every AI system with role, risk class and requirements – the basis for the EU AI Act and ISO 42001.Learn more](https://docxpert.io/en/features/ai-register) [ISO 42001AI management system with AI register, impact assessment, policies and competence records.Learn more](https://docxpert.io/en/standards/iso-42001) [NIS2 checklistScope, registration, risk measures, reporting channels and management training.Learn more](https://docxpert.io/en/checklists/nis2) ## Try docxpert free for 14 days Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards. [Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)