EU AI Act compliance checker

What the EU AI Act compliance checker tells you

The EU AI Act compliance checker sorts the AI your company uses or sells into the four classes of the AI Act (prohibited, high risk, transparency and minimal risk) and lists the duties of each class you touch, with the day each one applies. Ten yes-or-no questions, plus your size and turnover if you want the ceiling of a fine. Nothing you enter leaves your browser.

The AI Act is the European Union's law on artificial intelligence, Regulation (EU) 2024/1689. It does not stop at the EU border. Under Article 2 it covers:

• providers that place an AI system on the EU market, wherever they are based;
• deployers, the law's word for companies that use AI in their business, when they are established in the EU;
• providers and deployers outside the EU when the output of their system is used in the EU.

So a Dutch agency or a German manufacturer using ChatGPT at work is a deployer in scope. A London or Zurich software company selling a chatbot to customers in Belgium is a provider in scope for those customers. A UK firm using AI only for its own UK work is not. A provider outside the EU that sells high-risk AI into the Union also appoints an authorised representative inside it (Article 22).

The AI Omnibus moved the dates

In July 2026 the EU adopted the AI Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026. It kept the early rules and postponed the heavy ones. The full story is in our news piece on the high-risk delay.

• Since 2 February 2025: the prohibited practices, and AI literacy for everyone who provides or uses AI.
• Since 2 August 2026: transparency. A chatbot says it is an AI, and realistic AI images, video and voices carry a notice. Read what the transparency duties mean for a chatbot.
• From 2 December 2026: a new prohibition on AI that makes non-consensual sexual images, and the end of the grace period for machine-readable marking by tools already on the market (the labelling deadline).
• From 2 December 2027: high-risk AI in Annex III, such as CV screening, rating employees and credit scoring. Before the Omnibus this was 2 August 2026.
• From 2 August 2028: high-risk AI inside regulated products such as machinery, toys and lifts.

How the checker reaches your class

It walks five questions in order. Do you use AI at work: then AI literacy applies (Article 4). Does anything you run fall under Article 5, such as inferring the emotions of staff: then prohibited, whatever else you answer. Does AI decide or advise on people in an Annex III area: then high risk. Does your AI talk to people or make content that looks real: then transparency (Article 50). And do you sell the AI under your own name: then you carry the provider's duties.

A worked example. A Dutch online shop with 20 staff and EUR 8 million turnover runs a support chatbot. Result: transparency, with two duties in force today, AI literacy and the chatbot notice. A breach of Article 50 is fined up to EUR 15 million or 3 percent of worldwide annual turnover. A large company risks the higher of the two, an SME the lower: 3 percent of 8 million is EUR 240,000, so that is this shop's ceiling. A group with EUR 600 million turnover faces 3 percent, EUR 18 million, because it is higher than the fixed amount.

An SME pays at most the lower of the amount and the percentage. Since the Omnibus a small mid-cap, a company just above the SME line, gets the same cap, except for a prohibited practice. Wrong or incomplete information to an authority is a separate fine of up to EUR 7.5 million or 1 percent.

Provider or deployer: which side you are on

You can change sides without noticing. Put your own name on a high-risk system, modify it substantially, or change its purpose so that it falls under Annex III, and Article 25 makes you the provider. That includes a general tool such as ChatGPT that you set up to screen applicants.

AI literacy, without a certificate

Since 2 February 2025 every company that provides or uses AI takes measures so that the people working with it know enough to do so sensibly. The AI Omnibus kept that duty but now states that no specific level of literacy per person has to be guaranteed. The European Commission asks for no certificate, no exam and no fixed training, and no test of what your staff know. Supervision and enforcement run since 2 August 2026 through the national market surveillance authority of each member state, and any sanction has to be proportionate. Article 99 sets no fine for it: each member state does.

For a small team, a page of written rules and an hour of explanation with examples from your own work usually does it: which tools are allowed, which data never goes in, who checks the output. Keep a note of who attended. Whether that page has to exist on paper is answered in do I need an AI policy.

Four companies run through the checker

A Dutch marketing agency with eight people writes copy with ChatGPT and Claude. Result: minimal, one duty, AI literacy, already in force. Time: an hour for the rules. The risk next to it is client data in a free account, which is a GDPR question rather than an AI Act one; ChatGPT vs Claude and ChatGPT pricing show which plans keep your data out of training.

A German manufacturer with 180 staff uses an HR suite that scores applicants. Result: high risk, with the heavy duties from 2 December 2027. Today only AI literacy applies. By December 2027: follow the vendor's instructions, have a trained person who reviews and can overrule the scores, keep the logs for six months, inform the works council and the employees before use, and tell applicants that AI takes part. Article 6(3) keeps a tool that only does a narrow procedural task, such as sorting CVs by date received, out of high risk; a tool that profiles candidates stays in. The checker cannot see that difference and takes the careful side.

A UK software company sells a support chatbot to customers across the EU. Result: transparency, as provider. You build in the notice and make sure the text, audio or images your product generates are marked as AI in a machine-readable way. A product already on the market before 2 August 2026 has until 2 December 2026 for that marking. Sell the same bot to a recruiter for screening, and you sell a high-risk system, with an EU representative to appoint.

A Belgian online shop with a chatbot and AI mood images. Result: transparency. The bot says in its first message that it is an AI; images of people, places or events made with AI that look real carry a notice. Cost: a sentence and a label, no money.

What the checker does not see

• The derogations of Article 6(3) that keep an Annex III system out of high risk, such as a preparatory or purely procedural task. They never apply to profiling.
• Areas a small company rarely touches: biometrics, critical infrastructure, public benefits, law enforcement, migration and justice.
• The duties of companies that train a general-purpose model themselves. Those apply since 2 August 2025 to the makers of models such as GPT, Claude and Gemini, not to the companies that use them.
• The GDPR. Personal data in an AI tool needs a legal basis, a processing agreement and a line in your privacy policy, apart from the AI Act.
• If you sell software, the new product liability rules for software apply as well.

The checker follows the AI Act as the AI Omnibus amended it; it gives your class and duties, not advice on your case. For a product launch in the EU or an HR system that decides about people, have a lawyer in the country you sell to review the result.