Implementation Kit
EU AI Act Compliance Kit
The working set for EU AI Act compliance: a risk-tier classification worksheet against Annex III, an Annex IV technical documentation template, a conformity self-assessment checklist, and an EU database registration checklist.
Who this is for: The compliance owner taking a system through EU AI Act classification and the high-risk obligations.
1. EU AI Act risk tier classification worksheet
SpreadsheetWalks a system to a tier: prohibited, high-risk, limited-risk, or minimal.
Template
| Question | Answer | Result |
|---|---|---|
| Does the system perform an Article 5 prohibited practice (social scoring, manipulative techniques, untargeted facial scraping, most real-time remote biometric ID)? | Y / N | Y: Prohibited, stop |
| Is it a safety component of a product covered by Annex I legislation, requiring third-party conformity assessment? | Y / N | Y: High-risk (Annex I route) |
| Does it fall in an Annex III use case (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice)? | Y / N | Y: High-risk unless an Article 6(3) derogation applies |
| If Annex III: does it only perform a narrow procedural task, improve a prior human activity, detect patterns without replacing human judgement, or do prep work? | Y / N | Y: may not be high-risk; document the Article 6(3) assessment |
| Does it interact with people, generate synthetic media, or is it an emotion-recognition system? | Y / N | Y: transparency obligations (Article 50) at minimum |
| Resulting tier and obligations set: |
Worked example
| Question | Answer | Result |
|---|---|---|
| Article 5 prohibited practice? | N | continue |
| Annex I safety component? | N | continue |
| Annex III use case? | Y | employment: screening and filtering applications |
| Article 6(3) narrow-task derogation applies? | N | ranking materially influences the hiring funnel |
| Interacts with people / synthetic media / emotion recognition? | N | - |
| Tier | High-risk (Annex III, employment) | full Chapter III obligations + FRIA + registration |
Acceptance criteria
- ✓The Article 5 check is done first and routes prohibited systems to a stop.
- ✓Any Article 6(3) derogation claim is documented with reasoning, not asserted.
- ✓The worksheet output names the exact obligations set the tier triggers.
2. Annex IV technical documentation template
DocumentThe structure of the technical documentation a high-risk system must maintain.
Template
Maintained current for the life of the system. Sections track Annex IV.
- General description: intended purpose, provider, versions, how it interacts with hardware/software, deployment forms
- Detailed description: development process, design specifications, system architecture, data requirements, human oversight measures, pre-determined changes
- Monitoring, functioning, control: capabilities and limitations, accuracy metrics, foreseeable unintended outcomes, input data specifications
- Risk management system: the Article 9 risk management process and its outputs
- Lifecycle changes: log of changes made through the system's life
- Standards applied: harmonised standards or other solutions used to meet requirements
- EU declaration of conformity
- Post-market monitoring plan: per Article 72
Worked example
Section 3 excerpt, Resume Screener:
- Capabilities: ranks applicants 1-5 against a role's structured requirements.
- Limitations: does not assess portfolio content, video, or references; degrades when a role's requirement mix changes materially.
- Accuracy: ranking accuracy 0.81 on the 2026-08 holdout; adverse-impact ratio lowest 0.88.
- Foreseeable unintended outcomes: demographic disparity from historical data skew (mitigated, monitored monthly); over-reliance by recruiters (mitigated by oversight design and override monitoring).
- Input data specifications: structured fields parsed from the application; free-text CV parsed then discarded for inference.
Acceptance criteria
- ✓All eight Annex IV areas are present, even if a section is short.
- ✓Accuracy, robustness, and known limitations are stated with figures and dates.
- ✓The documentation is updated on every change that the versioning policy records.
3. Conformity assessment checklist
SpreadsheetThe self-assessment most Annex III systems run (internal control, Annex VI) before the declaration of conformity.
Template
| Requirement (Chapter III, Section 2) | Article | In place? | Evidence |
|---|---|---|---|
| Risk management system, run across the lifecycle | 9 | Y / N | |
| Data governance: relevant, representative, error-checked training/validation/test data | 10 | Y / N | |
| Technical documentation (Annex IV) | 11 | Y / N | |
| Automatic logging of events over the system's lifetime | 12 | Y / N | |
| Transparency and information to deployers (instructions for use) | 13 | Y / N | |
| Human oversight measures designed in | 14 | Y / N | |
| Accuracy, robustness, and cybersecurity appropriate to the purpose | 15 | Y / N | |
| Fundamental Rights Impact Assessment (deployers of certain systems) | 27 | Y / N | |
| Quality management system (providers) | 17 | Y / N |
Worked example
| Requirement | Article | In place? | Evidence |
|---|---|---|---|
| Risk management system | 9 | Y | risk assessment + multi-framework register rows |
| Data governance | 10 | Y | training data provenance + bias evals |
| Technical documentation | 11 | Partial | Annex IV doc drafted; sections 6 and 7 outstanding |
| Event logging | 12 | Y | decision log schema in production |
| Instructions for use | 13 | Y | deployer guide v2 |
| Human oversight | 14 | Partial | design gap: no low-score review step |
| Accuracy, robustness, security | 15 | Y | eval + adversarial test reports |
| FRIA | 27 | N | scheduled 2026-10-31 |
| Quality management system | 17 | Y | ISO 42001-aligned QMS |
Acceptance criteria
- ✓Every Chapter III Section 2 requirement is assessed with linked evidence.
- ✓Partial or missing items have an owner and a date, and the declaration of conformity is not signed while any are open.
- ✓The FRIA is completed where the deployer obligation applies.
4. EU database registration checklist
SpreadsheetThe steps to register a high-risk system (and, for deployers that are public bodies, their use) in the EU database.
Template
| Step | Owner | Done | Note |
|---|---|---|---|
| Confirm the system is in an Annex III category requiring registration | Compliance | Y / N | |
| Gather the required registration data (provider, system, intended purpose, status, member states, docs) | Compliance | Y / N | |
| Register before placing on the market or putting into service | Provider | Y / N | date |
| Public-body deployer: register the use of the system | Deployer | Y / N | if applicable |
| Keep the registration entry updated on material change or withdrawal | Compliance | Y / N |
Worked example
| Step | Owner | Done | Note |
|---|---|---|---|
| Annex III category confirmed | Compliance | Y | employment |
| Registration data gathered | Compliance | Y | pack assembled from Annex IV doc |
| Registered before service | Provider | N | target: before the 2027-12-02 applicability date |
| Public-body deployer use | Deployer | N/A | no public-body deployers |
| Keep entry updated | Compliance | Y | tied to the change process |
Acceptance criteria
- ✓Registration happens before the system is placed on the market or put into service.
- ✓The registration data set is assembled from the Annex IV documentation, not re-created.
- ✓A process keeps the entry current on material changes.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The whole kit is the EU AI Act conformity assessment and FRIA process.
The risk-tier worksheet is a documented, EU-AI-Act-specific risk classification.
The Article 12 logging requirement maps to the high-risk audit trail control.
Where the system generates synthetic media, the transparency step feeds content labelling compliance.
The conformity checklist gates a system before it is placed on the market, part of staged release.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.