EU AI Act checklist for SMEs: 12 points
28 October 2026 · Sources checked on 28 October 2026.
This list goes through what the EU AI Act (Regulation (EU) 2024/1689, in the current consolidated version after Regulation (EU) 2026/1744) asks of a company that uses third-party AI systems, the "deployer" of Article 3, point (4). Each point has its article and the date from which it applies under Article 113. Going through the list puts the work in order; it does not say whether a company meets the Regulation in a specific case, it does not interpret and it does not constitute legal advice.
The list
| No. | What to review | Article | Applies from |
|---|---|---|---|
| 1 | Which tools the company uses are AI systems | Article 3, point (1) | 2 February 2025 |
| 2 | Which role the company has with each system: deployer or provider | Article 3, points (3) and (4); Article 25 | 2 February 2025 (definitions); 2 December 2027 and 2 August 2028 (Article 25) |
| 3 | That no use falls within a prohibited practice | Article 5 | 2 February 2025; points (ba) and (bb), 2 December 2026 |
| 4 | Which AI literacy measures have been taken for those who operate the systems | Article 4 | 2 February 2025 |
| 5 | If emotion recognition or biometric categorisation is used, that exposed persons are informed | Article 50(3) and (5) | 2 August 2026 |
| 6 | If deep fakes are generated or manipulated, that this is disclosed | Article 50(4) and (5) | 2 August 2026 |
| 7 | If AI-generated text is published to inform the public on matters of public interest, that this is disclosed | Article 50(4), second subparagraph | 2 August 2026 |
| 8 | Which systems may be high-risk: Annex III, the Article 6(3) derogation and profiling | Article 6 and Annex III | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| 9 | For high-risk systems, use in accordance with the instructions and human oversight | Article 26(1) and (2) | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| 10 | For high-risk systems, input data, monitoring of operation and keeping of logs | Article 26(4), (5) and (6) | 2 December 2027 (Annex III) and 2 August 2028 (Annex I) |
| 11 | For high-risk systems, informing workers and the persons about whom decisions are made | Article 26(7) and (11) | 2 December 2027 (Annex III; Article 26(7) also from 2 August 2028 for Annex I) |
| 12 | If the company is among those required, the fundamental rights impact assessment | Article 27 | 2 December 2027 |
Point by point
- **AI systems.** Article 3, point (1), defines an AI system by the fact that it infers, from the input it receives, how to generate outputs (predictions, content, recommendations or decisions). Those built into another product count too. The provider's documentation is the first source.
- **Role.** Whoever uses a system under its authority, outside a personal non-professional activity, is a deployer (Article 3, point (4)); whoever develops it or has it developed and places it on the market or puts it into service under its own name or trademark, including for own use, is a provider (Article 3, point (3)). Article 25(1) adds three cases in which a user becomes the provider of a high-risk system: putting its name or trademark on it, making a substantial modification to it or changing its intended purpose so that it becomes high-risk.
- **Prohibited practices.** Article 5(1) lists ten points: manipulation, exploitation of vulnerabilities, non-consensual intimate imagery and child sexual abuse material (the two added by Regulation (EU) 2026/1744), social scoring, crime prediction based on profiling, facial recognition databases built by untargeted scraping, emotions at work and in education, biometric categorisation by sensitive attributes and "real-time" remote biometric identification in publicly accessible spaces for law enforcement purposes.
- **AI literacy.** Since Regulation (EU) 2026/1744, Article 4(1) requires taking measures to support the AI literacy of staff and of those operating the systems on the company's behalf, according to their experience and the context of use, without requiring any specific level of any individual.
- **Emotions and biometrics.** Article 50(3) requires informing the persons exposed to the system of its operation, and Article 50(5) doing so in a clear and distinguishable manner at the latest at the time of the first interaction or exposure.
- **Deep fakes.** Article 50(4) requires disclosing that image, audio or video content constituting a deep fake has been artificially generated or manipulated; in an evidently artistic, creative, satirical or fictional work, it is enough to do so in a manner that does not hamper the display or enjoyment of the work.
- **Text on matters of public interest.** The second subparagraph of Article 50(4) requires disclosing that text published to inform the public on matters of public interest has been artificially generated or manipulated, unless it has undergone human review or editorial control and a natural or legal person holds editorial responsibility.
- **High risk.** The systems in the eight Annex III areas (among them employment, the creditworthiness of natural persons and life and health insurance) and the safety components of Annex I products are high-risk. Article 6(3) leaves out the Annex III systems that do not pose a significant risk, under four conditions, except those that perform profiling of natural persons, which are always high-risk.
- **Instructions and oversight.** Article 26(1) requires taking appropriate technical and organisational measures to use high-risk systems in accordance with their instructions for use, and Article 26(2) assigning human oversight to people with the necessary competence, training and authority, as well as the necessary support.
- **Data, monitoring and logs.** Article 26(4) requires the input data the company controls to be relevant and sufficiently representative; Article 26(5), monitoring the operation and, where there is reason to consider it presents a risk, informing the provider or distributor and the authority and suspending its use; Article 26(6), keeping the logs the system generates that are under the company's control for at least six months.
- **Information.** Article 26(7) requires the employer to inform workers' representatives and the affected workers before using a high-risk system at the workplace; Article 26(11), informing the natural persons about whom an Annex III system makes decisions or assists in making them.
- **Impact assessment.** Article 27 requires it before deploying an Article 6(2) system (except point 2 of Annex III) from bodies governed by public law, private entities providing public services and deployers of systems under point 5, points (b) and (c), of Annex III (creditworthiness and life and health insurance).
The table and the summaries are just that, summaries; the text that counts is the official one, linked below.
How to keep the list
Each point is reviewed system by system, recorded with its date and backed by the evidence (the contract, the provider's instructions, the published notice, the training attendance sheet). And it is gone through again when a new tool arrives, when the use of one changes and before each date in the table.
The AI Inventory template has the list set up: the systems in "AI systems", with the Article 5, Article 6 and Article 50 review checkboxes and the "Indicative level" and "Applicable obligations (indicative)" that come out of them; the reference databases "Prohibited practices (Art. 5)", "Deployer obligations" and "Classification (Art. 6 and Annex III)", each row with its date, its EUR-Lex link and the date it was checked; training in "AI literacy (Art. 4)" and evidence in "Evidence": AI Inventory.
Sources (opened on 28 October 2026)
- Regulation (EU) 2024/1689, consolidated text as of 27 July 2026, the current consolidated version given by EUR-Lex (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02024R1689-20260727 — Articles 3, 4, 5, 6, 25, 26, 27, 50 and 113 and Annexes I and III.
- Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 (OJ L of 24 July 2026): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744
Document organisation tool based on official texts; it does not constitute legal advice.