Preparing for an EU AI Act review starts with the system’s intended purpose and your organization’s role. A product name, risk score, or monitoring dashboard cannot determine all applicable requirements.
Document the system before mapping controls
- Record the intended users, affected people, decisions, and permitted actions.
- Identify the model, tools, retrieval sources, data flows, and deployment owner.
- Document changes to the model or application that may alter the assessment.
- Ask the responsible reviewer to map the current legal provisions and applicable dates to the specific system.
Collect operational evidence
Keep model and prompt versions, evaluation records, access decisions, incident handling, and meaningful human review outcomes where appropriate. Decide which evidence is needed and protect it according to the data it contains.
Example: an internal assistant becomes a decision tool
An assistant that summarizes documents may later be connected to a tool that changes an employment record. Treat that as a new use and action boundary to review, rather than assuming the earlier deployment assessment still covers it.
Check current primary material
Use the European Commission source for the regulatory framework and current supporting materials. This checklist deliberately supplies no universal implementation deadline, risk classification, or compliance conclusion. A generated report supports review; it does not replace it.
References and further reading
Maintained by DriftRail. AI assisted the October 2026 content and template revision. Examples are illustrative; they are not measured product benchmarks. Suggest a correction.