Purpose of the checklist

EU AI Act checklist, compliance in seven steps.

This checklist brings structure to a topic that overwhelms many. It walks through the key requirements of the EU AI Act in seven steps, from taking inventory of your AI systems to ongoing documentation. You can use it as a self-check to review your status and spot the most urgent gaps. It does not replace legal advice but gives you a clear, actionable starting point. It deliberately names no prices.

If this sounds like your company, book a strategy call via our booking calendar, or send a quick note to info@ki-beratung.co.

Interactive tool

EU AI Act checklist

The checklist walks through the key requirements of the EU AI Act in seven steps, from taking inventory of your AI systems to ongoing documentation.

Step 1, create an AI inventory
Step 2, determine the risk class per system
Step 3, derive duties per risk class
Step 4, ensure AI literacy under Art. 4
Step 5, interlock GDPR and data protection
Step 6, transparency and labeling
Step 7, documentation and review

Your result

0 of 21 items fulfilled

0 %

  • Step 1, create an AI inventory0 / 3
  • Step 2, determine the risk class per system0 / 3
  • Step 3, derive duties per risk class0 / 3
  • Step 4, ensure AI literacy under Art. 40 / 3
  • Step 5, interlock GDPR and data protection0 / 3
  • Step 6, transparency and labeling0 / 3
  • Step 7, documentation and review0 / 3
  • Start with steps 1 and 2, because without an inventory and risk classification the remaining steps cannot be handled cleanly.

Open points, next steps

  • Step 1, create an AI inventory: List all deployed and planned AI systems, including purchased tools with AI features.
  • Step 1, create an AI inventory: Record per system what it is used for, which data flows in and who is responsible.
  • Step 1, create an AI inventory: Also capture hidden AI, such as features inside existing software.
  • Step 2, determine the risk class per system: Check whether a prohibited practice is involved (then stop immediately).
  • Step 2, determine the risk class per system: Check whether a high-risk area is affected (e.g. recruitment, creditworthiness, critical infrastructure).

EU AI Act explainedEU AI Act consultingAI readiness check

Assess AI potential

The checklist does not replace legal advice. Progress is calculated in your browser only, nothing is transmitted.

How the tool calculates
  • Go through the seven steps in order and tick off what is already fulfilled. Every open point is a concrete next step.
  • Progress is the share of ticked points among all points.

The checklist in seven steps

Step 1, create an AI inventory:

  • List all deployed and planned AI systems, including purchased tools with AI features.
  • Record per system what it is used for, which data flows in and who is responsible.
  • Also capture hidden AI, such as features inside existing software.

Step 2, determine the risk class per system:

  • Check whether a prohibited practice is involved (then stop immediately).
  • Check whether a high-risk area is affected (e.g. recruitment, creditworthiness, critical infrastructure).
  • Classify systems with limited risk (e.g. chatbots) and minimal risk.

Step 3, derive duties per risk class:

  • For high-risk systems plan risk management, technical documentation and human oversight.
  • For limited-risk systems implement transparency duties (users recognize AI is involved).
  • For minimal risk review the voluntary recommendations.

Step 4, ensure AI literacy under Art. 4:

  • Identify roles that operate or use AI and define the required knowledge level per role.
  • Choose a suitable format for building competence (training, accompanied pilots, documentation).
  • Make it demonstrable how and when competence was delivered.

Step 5, interlock GDPR and data protection:

  • Check where personal data flows into AI processes and which legal basis applies.
  • Ensure data subject rights, deletion concepts and transparency toward users.
  • Where possible, keep processing in Germany and the EU.

Step 6, transparency and labeling:

  • Label AI-generated content and AI interactions where required.
  • Give clear notice to users when they are talking to an AI system.
  • Set an internal policy for handling AI outputs.

Step 7, documentation and review:

  • Document the results of steps 1 to 6 and record responsibilities.
  • Set fixed dates for updates, since systems and rules change.
  • For new AI initiatives, run the checklist again before they go live.
Two people in conversation with a notepad and laptop

How to use the checklist

Go through the seven steps in order and tick off what is already fulfilled. Every open point is a concrete next step. Start with steps 1 and 2, because without an inventory and risk classification the remaining steps cannot be handled cleanly. If you do not want to make the classification alone, the EU AI Act consulting on EU AI Act consulting that makes your AI practically prepared takes it on. The full explanation of the law is on The EU AI Act explained.

Ready for the next step? Book your slot via our booking calendar or write to info@ki-beratung.co.

Assess AI potential

Book a strategy call

Book your strategy call via the calendar: Book a strategy call. Alternatively, reach us by email at info@ki-beratung.co.

Or send an email to info@ki-beratung.co

FAQ

Is the checklist free?
Yes. The download and use are free and non-binding, and no prices are named deliberately. It is meant to give you a clear starting point. If you need support afterwards, we discuss it in the free strategy call.
Which companies is it meant for?
Mainly mid-market and SME that use or introduce AI and want a practical entry into EU AI Act alignment. The steps apply regardless of industry, but the concrete duties depend on the risk of each application.
How often should we run the checklist?
Once for the current inventory and then for every new AI initiative before it goes live. In addition, a fixed review date is advisable because systems, data and regulatory requirements change. That keeps compliance current rather than one-off.