# EU AI Act Compliance Kit The working set for EU AI Act compliance: a risk-tier classification worksheet against Annex III, an Annex IV technical documentation template, a conformity self-assessment checklist, and an EU database registration checklist. **Who this is for:** The compliance owner taking a system through EU AI Act classification and the high-risk obligations. Source playbook: https://aigovernance.com/playbook/how-to-comply-with-eu-ai-act --- ## EU AI Act risk tier classification worksheet _Walks a system to a tier: prohibited, high-risk, limited-risk, or minimal._ ### Template | Question | Answer | Result | |---|---|---| | Does the system perform an Article 5 prohibited practice (social scoring, manipulative techniques, untargeted facial scraping, most real-time remote biometric ID)? | Y / N | Y: Prohibited, stop | | Is it a safety component of a product covered by Annex I legislation, requiring third-party conformity assessment? | Y / N | Y: High-risk (Annex I route) | | Does it fall in an Annex III use case (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice)? | Y / N | Y: High-risk unless an Article 6(3) derogation applies | | If Annex III: does it only perform a narrow procedural task, improve a prior human activity, detect patterns without replacing human judgement, or do prep work? | Y / N | Y: may not be high-risk; document the Article 6(3) assessment | | Does it interact with people, generate synthetic media, or is it an emotion-recognition system? | Y / N | Y: transparency obligations (Article 50) at minimum | | **Resulting tier and obligations set:** | | | ### Worked example | Question | Answer | Result | |---|---|---| | Article 5 prohibited practice? | N | continue | | Annex I safety component? | N | continue | | Annex III use case? | Y | employment: screening and filtering applications | | Article 6(3) narrow-task derogation applies? | N | ranking materially influences the hiring funnel | | Interacts with people / synthetic media / emotion recognition? | N | - | | **Tier** | High-risk (Annex III, employment) | full Chapter III obligations + FRIA + registration | ### Acceptance criteria - The Article 5 check is done first and routes prohibited systems to a stop. - Any Article 6(3) derogation claim is documented with reasoning, not asserted. - The worksheet output names the exact obligations set the tier triggers. --- ## Annex IV technical documentation template _The structure of the technical documentation a high-risk system must maintain._ ### Template > Maintained current for the life of the system. Sections track Annex IV. 1. **General description:** intended purpose, provider, versions, how it interacts with hardware/software, deployment forms 2. **Detailed description:** development process, design specifications, system architecture, data requirements, human oversight measures, pre-determined changes 3. **Monitoring, functioning, control:** capabilities and limitations, accuracy metrics, foreseeable unintended outcomes, input data specifications 4. **Risk management system:** the Article 9 risk management process and its outputs 5. **Lifecycle changes:** log of changes made through the system's life 6. **Standards applied:** harmonised standards or other solutions used to meet requirements 7. **EU declaration of conformity** 8. **Post-market monitoring plan:** per Article 72 ### Worked example **Section 3 excerpt, Resume Screener:** - Capabilities: ranks applicants 1-5 against a role's structured requirements. - Limitations: does not assess portfolio content, video, or references; degrades when a role's requirement mix changes materially. - Accuracy: ranking accuracy 0.81 on the 2026-08 holdout; adverse-impact ratio lowest 0.88. - Foreseeable unintended outcomes: demographic disparity from historical data skew (mitigated, monitored monthly); over-reliance by recruiters (mitigated by oversight design and override monitoring). - Input data specifications: structured fields parsed from the application; free-text CV parsed then discarded for inference. ### Acceptance criteria - All eight Annex IV areas are present, even if a section is short. - Accuracy, robustness, and known limitations are stated with figures and dates. - The documentation is updated on every change that the versioning policy records. --- ## Conformity assessment checklist _The self-assessment most Annex III systems run (internal control, Annex VI) before the declaration of conformity._ ### Template | Requirement (Chapter III, Section 2) | Article | In place? | Evidence | |---|---|---|---| | Risk management system, run across the lifecycle | 9 | Y / N | | | Data governance: relevant, representative, error-checked training/validation/test data | 10 | Y / N | | | Technical documentation (Annex IV) | 11 | Y / N | | | Automatic logging of events over the system's lifetime | 12 | Y / N | | | Transparency and information to deployers (instructions for use) | 13 | Y / N | | | Human oversight measures designed in | 14 | Y / N | | | Accuracy, robustness, and cybersecurity appropriate to the purpose | 15 | Y / N | | | Fundamental Rights Impact Assessment (deployers of certain systems) | 27 | Y / N | | | Quality management system (providers) | 17 | Y / N | | ### Worked example | Requirement | Article | In place? | Evidence | |---|---|---|---| | Risk management system | 9 | Y | risk assessment + multi-framework register rows | | Data governance | 10 | Y | training data provenance + bias evals | | Technical documentation | 11 | Partial | Annex IV doc drafted; sections 6 and 7 outstanding | | Event logging | 12 | Y | decision log schema in production | | Instructions for use | 13 | Y | deployer guide v2 | | Human oversight | 14 | Partial | design gap: no low-score review step | | Accuracy, robustness, security | 15 | Y | eval + adversarial test reports | | FRIA | 27 | N | scheduled 2026-10-31 | | Quality management system | 17 | Y | ISO 42001-aligned QMS | ### Acceptance criteria - Every Chapter III Section 2 requirement is assessed with linked evidence. - Partial or missing items have an owner and a date, and the declaration of conformity is not signed while any are open. - The FRIA is completed where the deployer obligation applies. --- ## EU database registration checklist _The steps to register a high-risk system (and, for deployers that are public bodies, their use) in the EU database._ ### Template | Step | Owner | Done | Note | |---|---|---|---| | Confirm the system is in an Annex III category requiring registration | Compliance | Y / N | | | Gather the required registration data (provider, system, intended purpose, status, member states, docs) | Compliance | Y / N | | | Register before placing on the market or putting into service | Provider | Y / N | date | | Public-body deployer: register the use of the system | Deployer | Y / N | if applicable | | Keep the registration entry updated on material change or withdrawal | Compliance | Y / N | | ### Worked example | Step | Owner | Done | Note | |---|---|---|---| | Annex III category confirmed | Compliance | Y | employment | | Registration data gathered | Compliance | Y | pack assembled from Annex IV doc | | Registered before service | Provider | N | target: before the 2027-12-02 applicability date | | Public-body deployer use | Deployer | N/A | no public-body deployers | | Keep entry updated | Compliance | Y | tied to the change process | ### Acceptance criteria - Registration happens before the system is placed on the market or put into service. - The registration data set is assembled from the Annex IV documentation, not re-created. - A process keeps the entry current on material changes. --- ## Governance controls this kit produces evidence for - **CMP-007**: The whole kit is the EU AI Act conformity assessment and FRIA process. - **HOC-001**: The risk-tier worksheet is a documented, EU-AI-Act-specific risk classification. - **ALC-002**: The Article 12 logging requirement maps to the high-risk audit trail control. - **CMP-006**: Where the system generates synthetic media, the transparency step feeds content labelling compliance. - **MGV-001**: The conformity checklist gates a system before it is placed on the market, part of staged release.