Toolkit
EU AI Act readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any organisation that develops, deploys, imports or distributes AI systems or general-purpose AI models used in the EU, or whose AI output is used there — wherever the organisation is based.
Scope
- Applies by role: provider, deployer, importer/distributor, authorised representative or product manufacturer
- A small set of practices is banned outright; most obligations apply only to systems classed as high-risk
- High-risk obligations for most use cases now apply from 2 December 2027, moved back by the 2026 Digital Omnibus — but prohibitions, GPAI duties and transparency rules already apply
Key requirements
- Inventory every AI system and model in use, including ones embedded in bought-in products
- Classify each one: prohibited, high-risk (Annex I or III), subject to transparency duties, or minimal risk
- Determine your role for each system — provider, deployer, importer, and so on — since it can differ by system
- For high-risk systems: run a risk management system, govern training/validation data, keep technical documentation and logs, and design for human oversight
- Complete the relevant conformity assessment, affix CE marking and register in the EU database before placing a high-risk system on the market
- For deployers of high-risk systems: follow instructions, assign human oversight, monitor operation, and run a fundamental rights impact assessment where required
- Disclose AI interactions and label deepfakes or AI-generated content where the transparency duties apply
Evidence to gather
- AI system and model inventory, with role and risk classification for each
- Risk management file and data governance records
- Technical documentation and automatic logs
- EU declaration of conformity and database registration, where required
- Human oversight assignments and monitoring records
- Fundamental rights impact assessments, where required
Common gaps
- Assuming the 2027/2028 dates mean nothing is due yet — prohibitions, GPAI duties and transparency rules already apply
- Treating most AI as high-risk by default instead of classifying case by case
- Confusing EU AI Act compliance with GDPR compliance — both can apply to the same system, neither replaces the other
- No process yet for registering high-risk systems or completing a conformity assessment
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full EU AI Act guide, the official text, or a qualified adviser.