Can you prove what your AI did, and why?

Does the system perform a prohibited practice?

Examples: manipulation causing harm, exploitation of vulnerable groups, prohibited biometric or emotion practices.

Art. 5 · Immediate stop or redesign trigger.

Is this one of the common high-risk AI use cases such as hiring, education, credit, insurance, public services, law enforcement, border control, justice, or critical infrastructure?

Answer Yes if the system is used in one of these sensitive decision or safety contexts. This is what the AI Act calls an Annex III high-risk use case.

Art. 6, Annex III · Key trigger for high-risk classification.

Could it significantly affect health, safety, or people’s core legal rights?

Answer Yes if the AI meaningfully influences decisions, access, treatment, safety outcomes, privacy, equal treatment, or other important impacts on people.

Art. 6 · Confirms high-risk treatment.

Is the AI only supporting humans in a narrow or low-impact way without replacing human judgment?

Answer Yes only if it is clearly limited to support tasks such as improving a prior human activity, handling a narrow procedural step, or detecting patterns without driving the final decision.

Art. 6(3) · Can reduce a potential high-risk classification.

Does it interact with people, generate AI content, or use biometric or emotion-related features?

Examples: chatbots, AI-generated text, images, audio or video, face or voice analysis, biometric categorisation, or emotion recognition.

Art. 50 · Triggers transparency obligations.

Is this built on, or are you providing, a general-purpose AI model used across many different use cases?

Think of foundation models or broad-purpose models that can be reused in many downstream products, not a narrowly scoped in-house rules engine or single-purpose model.

Art. 53-56 · Triggers GPAI-specific obligations if applicable.

Do you keep a clear inventory of AI systems, their purpose, and whether you act as provider, deployer, or both?

What good looks like AI register with named system owner and role mapping.

Art. 3, 6, 26 · Applies to Providers and deployers

Is AI compliance assigned to accountable roles across legal, business, technical, and operational teams?

What good looks like Named owners, escalation path, and governance forum.

Art. 17, 26 · Applies to Providers and deployers

Do your existing management systems explicitly include AI-specific controls and review points?

What good looks like AI integrated into QMS, compliance, security, and change management.

Art. 17, 26 · Applies to Providers and deployers

Is there a documented process to identify and review AI risks across intended use, foreseeable misuse, and affected persons?

What good looks like Risk register and review cycle covering safety and rights impacts.

Art. 9 · Applies to High-risk, selected limited-risk

Are mitigation measures defined, tested, and communicated for known risks, including vulnerable groups?

What good looks like Documented controls, residual-risk communication, and group-specific safeguards.

Art. 9 · Applies to High-risk

Do you validate performance, robustness, and cybersecurity in conditions that reflect real use?

What good looks like Test plan, thresholds, resilience checks, and security hardening evidence.

Art. 15 · Applies to High-risk

Are data sources, selection criteria, assumptions, and model design choices documented and governed?

What good looks like Documented provenance, approval steps, and model rationale.

Art. 10, Annex IV · Applies to Providers, data-managing deployers

Do you assess data for quality, representativeness, bias, and fitness for the intended use?

What good looks like Quality criteria, bias review, and remediation of data gaps.

Art. 10 · Applies to High-risk

When sensitive data is used, are legal safeguards and technical protections clearly defined?

What good looks like Restricted access, justification, and GDPR-aligned safeguards.

Art. 10(5) · Applies to Conditional

Are users, operators, and affected persons clearly informed when AI is used or when decisions are AI-assisted?

What good looks like Clear notices, user-facing disclosures, and deployer instructions.

Art. 13, 50 · Applies to All relevant systems

Can responsible humans understand the system’s limits and override or stop it when needed?

What good looks like Oversight procedures, stop controls, and override paths.

Art. 14 · Applies to High-risk

Are teams trained to avoid over-reliance on AI and to use the system only within its intended purpose?

What good looks like Training records, usage rules, and automation-bias safeguards.

Art. 14, 26 · Applies to Providers and deployers

Do you maintain up-to-date technical and operational documentation covering purpose, design, limitations, and expected performance?

What good looks like Core technical file with versioned updates.

Art. 11, Annex IV · Applies to Providers primarily

Can system behaviour be traced through records or logs that show how outputs were generated and used?

What good looks like Traceable logging fields and accessible operational records.

Art. 12, 26(5) · Applies to High-risk, relevant deployers

Are documentation and logs retained, protected, and accessible for audits, incidents, and regulator requests?

What good looks like Retention rules, integrity protection, and retrieval process.

Art. 12, 17 · Applies to Providers and deployers

Do you monitor performance, drift, misuse, complaints, and other operational signals after deployment?

What good looks like Monitoring plan, feedback channels, and review cadence.

Art. 72 · Applies to High-risk, GPAI as relevant

Do you have thresholds and workflows for corrective action, rollback, suspension, or retraining?

What good looks like Incident playbooks and remediation triggers.

Art. 72, 73 · Applies to High-risk

Are serious incidents and regulator interactions handled through a defined reporting and escalation process?

What good looks like Authority notification process and evidence pack preparation.

Art. 73 · Applies to High-risk, GPAI as relevant

If you deploy high-risk AI in public-sector or public-service contexts, have you assessed impacts on affected groups and defined safeguards?

What good looks like FRIA process, affected-group analysis, and mitigation measures.

Art. 27 · Applies to Conditional

If systems generate synthetic content or use biometric or emotion functions, are the additional transparency obligations operationalised?

What good looks like Labelling, notices, and operational handling for special cases.

Art. 50 · Applies to Conditional

If you provide or build on GPAI, do you manage model documentation, downstream information, copyright, and systemic-risk obligations?

What good looks like GPAI documentation pack and systemic-risk governance.

Art. 53-56 · Applies to GPAI providers