// ai act checklist

AI Act checklist
for AI teams.

Two questions and you have your list. Tick what you already have, the browser remembers it, and take it away as a PDF whenever you want.

// how to use it

Two questions and you have your list.

1. Does your team use third-party AI? APIs, ChatGPT, copilots, ours.

Yes No

If yes, blocks A, B and D are yours.

2. Do you also build a product or process with AI? Your own chatbot, scoring, agents.

Yes No

If that is also yes, block C is added.

Block E, the evidence folder, is for everyone. And block F is what you get to cross off your worries.

0 of 0 done

What you tick is saved in this browser only. Nothing is sent anywhere.

// block a · in force since february 2025

What you should already have.

An inventory of the AI you use. All of it: what you pay for, what is embedded in your own software, and what the team uses on its own, which is usually the biggest group. One sheet with five columns does it: tool, who uses it, what for, what data it touches, who the provider is. Why: it is the prerequisite for everything else and the first thing any review asks for. Effort: one meeting with your team leads.
Basic training for the people who use AI (art. 4, AI literacy). It does not require a degree: it requires whoever uses AI to understand what it does, its limits and its risks, in proportion to how they use it. Keep the evidence: attendance, materials, date. Why: it is the oldest obligation already in force and the cheapest to meet. Effort: one documented internal session per role.
An internal AI use policy. One page: which tools are allowed, what for, which data never goes into a prompt, and who to ask. Why: it organises what people actually do, and it is the second piece of evidence any client asks for. Effort: half a day with a template.

// block b · before 2 august 2026

Transparency (art. 50).

If a chatbot of yours talks to people: make it clear it is a machine. A clear notice at the start of the conversation is enough. It applies to web assistants, support bots and voicebots. Effort: one piece of copy and a deploy.
If you publish AI-generated content: label it as such. It applies to synthetic content that reaches third parties, deepfakes included. It does not apply to internal use or to content with substantial human editorial review. The machine-readable marking gets extra time, until 2 December 2026, for systems placed on the market before 2 August 2026. Effort: define the rule once and apply it in your publishing flow.
Review the notices with product and marketing in the same room. Art. 50 transparency is the obligation that cuts across departments, which is exactly why everyone misses it.

// block c · if you build with ai

Your own product or process.

Establish your role for each system. Do you only use it (deployer) or do you put it on the market under your own brand (possible provider of the system)? The answer changes your whole package of obligations. Quick rule: if your customer perceives the AI as yours, work on the provider hypothesis and verify.
Check Annex III and Annex I. A system is high risk by one of two routes: because its purpose fits one of the cases in Annex III (employment, credit, education, essential services...) or because it is a safety component of a product already regulated by the legislation in Annex I (medical devices, machinery, toys...). If your product lives in a sector with CE marking, the second route applies to you even if your use does not appear in Annex III. Those obligations moved to December 2027 (Annex III) and August 2028 (Annex I) under the Omnibus, but conforming design starts now. If neither route reaches you, you are almost certainly not high risk, and you can say so with confidence.
If you fine-tune an open model: document your modification compute. The Commission indicative rule is clear: you only become the provider of the model if your modification exceeds a third of the original training compute, which a normal fine-tune does not come close to. Keeping the compute figure is your evidence that you are far below it. Effort: writing down a number you already have.
Pin the versions of the models you use. With open weights you can pin the exact version, audit it and document the whole stack. That is the traceability advantage of open: use it and write it down.

// block d · your provider

The questions to ask.

Do you store prompts and responses? Yes or no. "Your data is safe" is not an answer.
If you do, for how long, what for, and can I turn it off?
Where is it physically processed and stored, and under which jurisdiction does the provider sit? An EU datacenter belonging to a company subject to the Cloud Act is not the same as a European provider.
Is my data used to train models? Where does the contract say so?
Do you have a DPA ready to sign, a list of sub-processors and architecture documentation on request?
What model documentation can you give me for my own traceability? Version, model card, changelog of model changes.
Does your analytics work without my content? The most revealing question: if they need your content to operate, their incentive is to retain it.

// block e · for everyone

The evidence folder.

Your first AI Act exam probably will not come from a regulator: it will come from a large client at a renewal, a tender or a due diligence. Keep a folder with this in it.

The AI inventory (block A).
The AI use policy and the training evidence.
The DPAs and your providers answers (block D).
For each system of your own: its role and risk sheet (block C) and the pinned model versions.
If you use a provider with compliance by architecture: their security documentation and data flows, requested and filed.

// block f · breathe

What you get to cross off your worries.

If you only use AI or deploy third-party systems: you do not need any mandatory certification. There is no mandatory certification to buy; be wary of anyone selling you an "AI Act seal". It changes if you are the provider of a high-risk system: there the regulation does require a quality management system and a conformity assessment, which for most Annex III cases is a self-assessment with CE marking, with biometrics as the exception that goes through a notified body; in Annex I the standards and bodies of each sector are what govern.
The high-risk obligations are postponed (Dec 2027 / Aug 2028). And they only apply if your use is in Annex III or your product is a safety component of a regulated product (Annex I). Most enterprise uses are in neither.
The general-purpose model obligations are not yours. They belong to whoever develops the model: OpenAI, Alibaba, Z.ai. Using models, open or closed, through an API or on your own infrastructure, does not transfer them to you.
GDPR is neither replaced nor duplicated. If you already comply, most of the data work is done. The AI Act adds the layer about using AI, it does not redo the data layer.
Nothing has to stop on 2 August. For the AI-user profile, what is required is light (blocks A and B) and takes days, not months.

0 of 0 done

Need open-model AI on European infrastructure?

That is what we run: open-weight models on EU GPUs, zero logs, European company. If you want to go through your specific case, write to us.

talk_to_us →

The full AI Act guide With articles, dates and sources. This checklist is the operational version.

This is general information, not legal advice. Sources: Regulation (EU) 2024/1689, Regulation (EU) 2026/1744 (Digital Omnibus on AI), the Commission GPAI guidelines (July 2025) and the AI Office FAQ.

helmcode.com · Printed on

// get started

START BURNING TOKENS

Skip the AI infra work. Deploy your first private inference endpoint today.

Flat rate. EU data. OpenAI API compatible.

book_a_call

AI Act checklistfor AI teams.