EU AI Act compliance sounds daunting, but it follows a clear sequence: know your systems, classify them, then meet each tier's obligations. This guide walks the process and gives you a checklist. Part of our guide to the EU AI Act.
Compliance begins with visibility. You cannot classify or govern AI systems you haven't listed — so the first step is always an inventory of every AI system your organisation builds, buys or embeds, and which of them are placed on the market or used in the EU. Everything else follows from that list and each system's risk tier.
Step 2 in detail: EU AI Act risk categories.
If you provide or build on a general-purpose AI (foundation) model, separate GPAI obligations have applied since August 2025 — technical documentation, training-data transparency, and, for models with systemic risk, extra evaluation and mitigation. Factor these in alongside your system-level classification.
Your obligations depend on your role. Providers (who develop and place a system on the market) carry the heaviest high-risk duties; deployers (who use it) must follow the instructions for use, maintain human oversight, monitor the system and, in some cases, run a fundamental-rights impact assessment. Many organisations are both, for different systems.
Most of the Act's high-risk requirements — inventory, risk and impact assessment, data governance, human oversight, monitoring — are exactly what an ISO/IEC 42001 management system delivers. Building on ISO 42001 turns EU AI Act compliance from a standalone scramble into a mapping exercise. See ISO 42001 certification.
AramGRC runs EU AI Act conformity audits — classifying your systems, producing Annex IV technical documentation, and giving you a staged roadmap to each deadline. See EU AI Act conformity assessment.
Inventory your AI systems, identify which reach the EU, classify each by risk tier, and meet that tier's obligations — for high-risk systems the full risk-management, documentation, human-oversight and conformity-assessment programme.
Yes — the core steps are inventory, risk classification, exiting prohibited practices, transparency for limited-risk AI, and the full risk-management, documentation, oversight and conformity-assessment programme for high-risk systems.
The process by which a provider demonstrates a high-risk AI system meets the Act's requirements — by self-assessment or, for certain systems, through a notified body — before CE marking.
Yes — deployers must use high-risk systems per the instructions, maintain human oversight, monitor them, and in some cases carry out a fundamental-rights impact assessment.
What the EU AI Act is, the risk categories, obligations, timeline and penalties.
A step-by-step guide and checklist to comply with the EU AI Act.
You're here
The four risk tiers, prohibited practices and high-risk AI systems.
What providers and deployers of high-risk AI must do.
The phased dates — and what the 2026 Digital Omnibus changed.
Fines up to €35M or 7% of global turnover — the full structure.
AI compliance across the EU AI Act, ISO 42001, NIST AI RMF and India's DPDP.