Short answer. Since 2 August 2026, businesses placing AI products on the EU market or using AI in human-facing processes need to review the complete use case, not just the underlying model. A practical baseline is to maintain an AI inventory, identify the business's role for each system, classify risk, implement applicable notices and retain evidence of control. Not every AI product is high-risk: duties depend on intended purpose, the operator's role and actual use.
This checklist is designed for SaaS companies, marketplaces, clinics, employers, fintech projects and international B2B teams. It supports product and technical planning but does not replace a legal assessment of a particular system.
What changed by October 2026
The AI Act applies in stages. Prohibited practices and AI-literacy duties have applied since February 2025. General-purpose AI rules started applying in August 2025. On 2 August 2026, the Commission and national authorities gained enforcement powers for applicable provisions, and transparency duties for certain AI systems started to apply.
The current high-risk timeline is different: requirements for Annex III use cases are due to apply from 2 December 2027, while rules for AI embedded in Annex I regulated products are due from 2 August 2028. An old slide deck or article should therefore not be treated as the sole source for a launch plan.
Step 1: identify the company's role
| Role | Typical situation | First question |
|---|---|---|
| Provider | The company develops an AI system or markets it under its own name | Which product, technical and documentation duties apply? |
| Deployer | The company uses another provider's AI in a workflow or product | Is the use consistent with its intended purpose and what must people be told? |
| Importer or distributor | The company brings an AI system to the EU market | Does the provider have the necessary documentation and EU representation? |
| Role requiring review | White-labelling, fine-tuning, substantial modification or a new purpose | Has the company effectively become the provider? |
A group may be a provider of its own AI module and a deployer of a third-party model at the same time. Classify each use case rather than labelling the whole company once.
Step 2: build an AI inventory
Use one register across product, legal, security and marketing. Record the process owner, intended purpose, users, model and supplier, data categories, launch countries, impact on people and the availability of human review.
- support chatbots and sales assistants;
- text, image, video or voice generation;
- scoring, anti-fraud and document checks;
- candidate screening and employee assessment;
- medical, biometric or emotion-related analysis;
- recommendations, personalisation and automated decisions.
Without an inventory, teams often review the visible chatbot but miss AI embedded in CRM, HR systems, advertising tools and third-party APIs.
Step 3: screen for prohibitions, transparency and high-risk indicators
Run the review in this order: prohibited practice, high-risk indicators, specific transparency rules, then obligations under other laws such as the GDPR, consumer protection, copyright and sector regulation.
An interactive AI system may need to tell a person clearly that they are dealing with AI. Synthetic or manipulated content may need machine-readable marks and visible labelling. Deepfakes and certain public-interest content have specific requirements. The exact implementation depends on role and context.
Step 4: make compliance part of the product
- Notice. Present it before or at the time of interaction, not only inside the Terms.
- Human escalation. Give users a clear route to a person where an error may materially affect them.
- Logs and versions. Record the model, system configuration, change date, owner and significant incidents.
- Data control. Document what reaches the vendor, whether it is used for training and how long it is retained.
- Testing. Test quality, harmful edge cases, discriminatory outcomes, prompt injection and leakage.
- Content marking. Match visible and machine-readable marking to the actual publishing format.
If the product is still being built, these controls are cheaper to add at architecture and UX stage. CrystalCore connects requirements to UX, data and integrations through AI platform development and web application development.
Step 5: retain evidence, not just a policy
A policy without operating artefacts is weak evidence of control. A useful file contains the inventory, classification decisions, data-flow map, vendor due diligence, staff instructions, test log, incident procedure, notice copy and change history. For an external model, request technical information, limitations, acceptable-use terms and material needed by downstream teams.
A practical first 30 days
| Period | Deliverable |
|---|---|
| Days 1–5 | Project owner, AI inventory and vendor map |
| Days 6–10 | Roles, initial risk classification and disputed cases |
| Days 11–20 | Notices, human escalation, data flows and logging requirements |
| Days 21–25 | Vendor review, tests, staff instructions and incident workflow |
| Days 26–30 | Evidence register, product backlog and legal-review plan |
Frequently asked questions
Does every AI chatbot need certification?
No. Duties depend on the role, purpose and risk. For many chatbots, transparency and sound data controls will be more relevant than a high-risk conformity route.
Is a “made with AI” label enough?
Not necessarily. The rules distinguish interactive systems, deepfakes, synthetic content and certain public-interest materials. Both a visible notice and machine-readable marking may be relevant.
If we use a major vendor's API, is the vendor solely responsible?
No. The model provider and the business implementing it in a specific workflow can have different duties. Your interface, data, instructions and actual purpose remain within your control.
When should high-risk preparation begin?
Before the application date. An inventory, classification record, data governance, logs and technical documentation cannot be recreated reliably one week before launch.
Official sources
- European Commission: AI Act and current application timeline
- European Commission: transparency guidance
- EUR-Lex: consolidated AI Act
Reviewed on 10 October 2026. This guide is general information. Applicable duties depend on the product, role, data, industry and launch countries.