EU AI Act Readiness Check
Which duties apply to your AI?
20 questions, 5 categories, 3 minutes. Find out whether you are a provider or a deployer, which risk class applies, and what has to be done from August 2026.
Which AI Act duties actually apply to you?
The EU AI Act (Regulation (EU) 2024/1689) is the world's first comprehensive law on artificial intelligence. It came into force on 1 August 2024 and becomes applicable in stages . Two questions decide which duties apply to you: in which role are you — and into which risk class does your AI system fall? That is exactly what the check above sorts out.
Your role determines your duties
Most companies underestimate this point. The AI Act distinguishes, above all:
- Provider — you develop an AI system, or have it developed, and place it on the market under your own name. This is where the bulk of the duties sit.
- Deployer — you put an AI system to use on your own responsibility. Considerably fewer duties, but by no means none.
- Importers and distributors — you bring AI into the EU from a third country, or distribute it.
Careful — roles can change: If you substantially modify a bought-in AI system, offer it under your own name or change its intended purpose, you can turn from deployer into a provider — with all the duties that brings. It happens faster than you would think, for instance when you fine-tune a model for a product of your own.
The four risk classes
| Class | Examples | Consequence |
|---|---|---|
| Unacceptable | Social scoring, manipulative systems, emotion recognition in the workplace | prohibited |
| High risk | AI in recruitment, creditworthiness, critical infrastructure, education; AI as a safety component in products | extensive duties |
| Limited risk | Chatbots, AI-generated content, deepfakes | transparency duties |
| Minimal risk | Spam filters, AI inside standard software | no particular duties |
For high-risk systems the AI Act requires, among other things, a risk management system, data governance, technical documentation, logging, human oversight, accuracy and cybersecurity — plus conformity assessment and registration.
The timetable
- Since 2 February 2025 — the prohibited practices apply, as does the duty to ensure AI literacy for everyone who uses AI.
- Since 2 August 2025 — duties for general-purpose AI models (GPAI), the governance structures and the penalty regime.
- From 2 August 2026 — the bulk of it, in particular high-risk systems under Annex III and the transparency duties.
- From 2 August 2027 — high-risk AI as a safety component of regulated products.
The AI literacy duty already applies and is often overlooked: you have to ensure your staff have sufficient AI literacy — whatever the risk class.
How to read your result
- Prohibited practice — act immediately; the use has to stop.
- High risk — plan in earnest. A complete management system, including conformity assessment, has to be in place by 2026.
- transparency duties — manageable: label AI interaction and AI-generated content.
- Minimal risk — barely any duties, but the AI literacy duty still applies.
The check is a first classification and is no substitute for legal advice. The classification in any individual case depends on the specific intended purpose.
The pragmatic route
The AI Act does not require a certified management system — but that is the cleanest way to satisfy it. ISO 42001 is the fitting standard for an AI management system and covers many of the requirements in a structured way. If you already run ISO 27001 you can build on it: risk management, document control and training are already there.
Common questions about the EU AI Act
Does the AI Act apply to us if we only buy AI in?
Yes — then you are a deployer. Your duties are lighter than a provider's, but depending on the risk class they cover human oversight, use in accordance with the intended purpose, transparency towards the people affected — and in every case the AI literacy of your staff.
What does the AI literacy duty mean in practice?
You have to ensure that people operating or using AI on your behalf have sufficient AI literacy — appropriate to their role, their background and the context of use. In practice: run training, and record it.
Is ChatGPT in the company a high-risk system?
As a rule, no. A general assistant for working with text usually falls under minimal or limited risk. What decides it is the purpose of use: put the same tool to work screening job applicants and it can become a high-risk use case.
How large are the fines?
Graded by the breach: up to €35 million or 7 % of worldwide annual turnover for prohibited practices, up to €15 million or 3 % for most other breaches of duty, and up to €7.5 million or 1 % for supplying incorrect information to authorities.
Do we need an AI register?
What is prescribed is registration in the EU database for high-risk systems. Quite apart from that, an internal inventory of every AI system in use is practically indispensable — without an overview you can neither determine risk classes nor meet your duties.
What is the difference from ISO 42001?
The AI Act is binding law with fines attached. ISO 42001 is a voluntary, certifiable standard for an AI management system. It does not satisfy the AI Act automatically, but it is a very good framework for meeting its requirements demonstrably.
