Implementation Kit
EU AI Act Compliance Checklist and Documentation Templates
The working set for EU AI Act compliance: a risk-tier classification worksheet against Annex III, an Annex IV technical documentation template, a conformity self-assessment checklist, and an EU database registration checklist.
Who this is for: The compliance owner taking a system through EU AI Act classification and the high-risk obligations.
1. EU AI Act risk tier classification worksheet
SpreadsheetWalks a system to a tier: prohibited, high-risk, limited-risk, or minimal.
Template
| Question | Answer | Result |
|---|---|---|
| Does the system perform an Article 5 prohibited practice (social scoring, manipulative techniques, untargeted facial scraping, most real-time remote biometric ID)? | Y / N | Y: Prohibited, stop |
| Is it a safety component of a product covered by Annex I legislation, requiring third-party conformity assessment? | Y / N | Y: High-risk (Annex I route) |
| Does it fall in an Annex III use case (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice)? | Y / N | Y: High-risk unless an Article 6(3) derogation applies |
| If Annex III: does it only perform a narrow procedural task, improve a prior human activity, detect patterns without replacing human judgement, or do prep work? | Y / N | Y: may not be high-risk; document the Article 6(3) assessment |
| Does it interact with people, generate synthetic media, or is it an emotion-recognition system? | Y / N | Y: transparency obligations (Article 50) at minimum |
| Resulting tier and obligations set: |
Worked example
| Question | Answer | Result |
|---|---|---|
| Article 5 prohibited practice? | N | continue |
| Annex I safety component? | N | continue |
| Annex III use case? | Y | employment: screening and filtering applications |
| Article 6(3) narrow-task derogation applies? | N | ranking materially influences the hiring funnel |
| Interacts with people / synthetic media / emotion recognition? | N | - |
| Tier | High-risk (Annex III, employment) | full Chapter III obligations + FRIA + registration |
Acceptance criteria
- ✓The Article 5 check is done first and routes prohibited systems to a stop.
- ✓Any Article 6(3) derogation claim is documented with reasoning, not asserted.
- ✓The worksheet output names the exact obligations set the tier triggers.
2. Annex IV technical documentation template
DocumentThe structure of the technical documentation a high-risk system must maintain.
Template
Maintained current for the life of the system. Sections track Annex IV.
- General description: intended purpose, provider, versions, how it interacts with hardware/software, deployment forms
- Detailed description: development process, design specifications, system architecture, data requirements, human oversight measures, pre-determined changes
- Monitoring, functioning, control: capabilities and limitations, accuracy metrics, foreseeable unintended outcomes, input data specifications
- Risk management system: the Article 9 risk management process and its outputs
- Lifecycle changes: log of changes made through the system's life
- Standards applied: harmonised standards or other solutions used to meet requirements
- EU declaration of conformity
- Post-market monitoring plan: per Article 72
Worked example
Section 3 excerpt, Resume Screener:
- Capabilities: ranks applicants 1-5 against a role's structured requirements.
- Limitations: does not assess portfolio content, video, or references; degrades when a role's requirement mix changes materially.
- Accuracy: ranking accuracy 0.81 on the 2026-08 holdout; adverse-impact ratio lowest 0.88.
- Foreseeable unintended outcomes: demographic disparity from historical data skew (mitigated, monitored monthly); over-reliance by recruiters (mitigated by oversight design and override monitoring).
- Input data specifications: structured fields parsed from the application; free-text CV parsed then discarded for inference.
Acceptance criteria
- ✓All eight Annex IV areas are present, even if a section is short.
- ✓Accuracy, robustness, and known limitations are stated with figures and dates.
- ✓The documentation is updated on every change that the versioning policy records.
3. Conformity assessment checklist
SpreadsheetThe self-assessment most Annex III systems run (internal control, Annex VI) before the declaration of conformity.
Template
| Requirement (Chapter III, Section 2) | Article | In place? | Evidence |
|---|---|---|---|
| Risk management system, run across the lifecycle | 9 | Y / N | |
| Data governance: relevant, representative, error-checked training/validation/test data | 10 | Y / N | |
| Technical documentation (Annex IV) | 11 | Y / N | |
| Automatic logging of events over the system's lifetime | 12 | Y / N | |
| Transparency and information to deployers (instructions for use) | 13 | Y / N | |
| Human oversight measures designed in | 14 | Y / N | |
| Accuracy, robustness, and cybersecurity appropriate to the purpose | 15 | Y / N | |
| Fundamental Rights Impact Assessment (deployers of certain systems) | 27 | Y / N | |
| Quality management system (providers) | 17 | Y / N |
Worked example
| Requirement | Article | In place? | Evidence |
|---|---|---|---|
| Risk management system | 9 | Y | risk assessment + multi-framework register rows |
| Data governance | 10 | Y | training data provenance + bias evals |
| Technical documentation | 11 | Partial | Annex IV doc drafted; sections 6 and 7 outstanding |
| Event logging | 12 | Y | decision log schema in production |
| Instructions for use | 13 | Y | deployer guide v2 |
| Human oversight | 14 | Partial | design gap: no low-score review step |
| Accuracy, robustness, security | 15 | Y | eval + adversarial test reports |
| FRIA | 27 | N | scheduled 2026-10-31 |
| Quality management system | 17 | Y | ISO 42001-aligned QMS |
Acceptance criteria
- ✓Every Chapter III Section 2 requirement is assessed with linked evidence.
- ✓Partial or missing items have an owner and a date, and the declaration of conformity is not signed while any are open.
- ✓The fundamental rights impact assessment (FRIA) is completed where the deployer obligation applies.
4. EU database registration checklist
SpreadsheetThe steps to register a high-risk system (and, for deployers that are public bodies, their use) in the EU database.
Template
| Step | Owner | Done | Note |
|---|---|---|---|
| Confirm the system is in an Annex III category requiring registration | Compliance | Y / N | |
| Gather the required registration data (provider, system, intended purpose, status, member states, docs) | Compliance | Y / N | |
| Register before placing on the market or putting into service | Provider | Y / N | date |
| Public-body deployer: register the use of the system | Deployer | Y / N | if applicable |
| Keep the registration entry updated on material change or withdrawal | Compliance | Y / N |
Worked example
| Step | Owner | Done | Note |
|---|---|---|---|
| Annex III category confirmed | Compliance | Y | employment |
| Registration data gathered | Compliance | Y | pack assembled from Annex IV doc |
| Registered before service | Provider | N | target: before the 2027-12-02 applicability date |
| Public-body deployer use | Deployer | N/A | no public-body deployers |
| Keep entry updated | Compliance | Y | tied to the change process |
Acceptance criteria
- ✓Registration happens before the system is placed on the market or put into service.
- ✓The registration data set is assembled from the Annex IV documentation, not re-created.
- ✓A process keeps the entry current on material changes.
Governance controls this kit produces evidence for
Completing the artifacts above gives you a head start on the evidence requirements for these controls.
The whole kit is the EU AI Act conformity assessment and FRIA process.
The risk-tier worksheet is a documented, EU-AI-Act-specific risk classification.
The Article 12 logging requirement maps to the high-risk audit trail control.
Where the system generates synthetic media, the transparency step feeds content labelling compliance.
The conformity checklist gates a system before it is placed on the market, part of staged release.
This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.
Decide what to implement next
Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.
Start the AI governance assessment →