EU AI Act Compliance Checklist for SMEs

List every AI-powered tool your company uses — internal and external. Include SaaS products (CRM, hiring platforms, analytics, chatbots, customer support tools, marketing automation, AI writing assistants). For each tool, note: what it does, what data it processes, who accesses it, and who made the purchase decision.

Apply the EU AI Act's risk tiers to your inventory. Systems that manipulate human behavior, exploit vulnerabilities, or score social behavior are unacceptable risk and must be removed. Systems in healthcare, education, employment, law enforcement, or border control are high-risk and face strict obligations. General-purpose AI and chatbots are limited risk — transparency obligations only.

If you have high-risk AI systems, you must: establish a risk management system, use high-quality training data, maintain technical documentation (see Step 4), implement human oversight measures, ensure accuracy and robustness, log system activity. High-risk systems also require a conformity assessment before deployment — get this from an accredited body or use the self-assessment route if your sector allows it.

Article 11 requires a technical file for every high-risk system covering: description and intended purpose, system architecture, training data methodology, testing procedures and results, risk mitigations in place, human oversight protocols. Annex IV provides the exact structure — use it as your template. Documentation must be kept up to date as your systems evolve.

Identify your providers (build/sell AI systems), deployers (use AI in business operations), and importers/distributors as applicable. Providers have the most obligations. Deployers must: use high-risk systems according to provider instructions, monitor outputs, maintain records of use, designate a person responsible for oversight. Assign named owners for each role — these are your accountability points.

Article 4 requires that personnel using high-risk AI systems have sufficient training in: how the system works, what it can and cannot do, the risks it presents, how to interpret outputs correctly, when to escalate or override automated decisions. Document who has been trained and when. This isn't optional — regulators will ask for training records during an audit.

Deployers of high-risk systems must: log system usage to the extent relevant to risk, monitor for failures and biases post-deployment, report serious incidents to the system provider and national authority within 72 hours (within 24 hours for incidents posing immediate harm). Keep a log of what you monitored, what you found, and what you did about it. Post-market data feeds back into Step 1 — update your inventory when your stack changes.