--- title: "AI Act Readiness Assessment | DataWeavrs" description: "Know where your AI stands on the AI Act. Classify your use case, then score your readiness across seven domains in 21 questions. Report emailed immediately." url: "https://dataweavrs.com/assessment" lang: "en" --- AI Act · Transparency duties since 2 August 2026 · High-risk from 2 December 2027 # Can you prove what your AI did, _and why?_ Trust the input, trust the output, see every step in between. The AI Act’s transparency duties have applied since 2 August 2026; the high-risk obligations follow on 2 December 2027. Six questions place your AI use case in the Act’s risk categories; 21 more score your readiness across seven domains. About 15 minutes, a scored report by email. A preliminary self-assessment, not legal advice. Begin assessment → ## Risk classification Answer for the one AI system or use case you have most in mind. If you are unsure, answer as best you can and note the question for legal or compliance review. R.01 Does the system perform a prohibited practice? Examples: manipulation causing harm, exploitation of vulnerable groups, prohibited biometric or emotion practices. Art. 5 · Immediate stop or redesign trigger. YesNo R.02 Is this one of the common high-risk AI use cases such as hiring, education, credit, insurance, public services, law enforcement, border control, justice, or critical infrastructure? Answer Yes if the system is used in one of these sensitive decision or safety contexts. This is what the AI Act calls an Annex III high-risk use case. Art. 6, Annex III · Key trigger for high-risk classification. YesNo R.03 Could it significantly affect health, safety, or people’s core legal rights? Answer Yes if the AI meaningfully influences decisions, access, treatment, safety outcomes, privacy, equal treatment, or other important impacts on people. Art. 6 · Confirms high-risk treatment. YesNo R.04 Is the AI only supporting humans in a narrow or low-impact way without replacing human judgment? Answer Yes only if it is clearly limited to support tasks such as improving a prior human activity, handling a narrow procedural step, or detecting patterns without driving the final decision. Art. 6(3) · Can reduce a potential high-risk classification. YesNo R.05 Does it interact with people, generate AI content, or use biometric or emotion-related features? Examples: chatbots, AI-generated text, images, audio or video, face or voice analysis, biometric categorisation, or emotion recognition. Art. 50 · Triggers transparency obligations. YesNo R.06 Is this built on, or are you providing, a general-purpose AI model used across many different use cases? Think of foundation models or broad-purpose models that can be reused in many downstream products, not a narrowly scoped in-house rules engine or single-purpose model. Art. 53-56 · Triggers GPAI-specific obligations if applicable. YesNo ← Previous Continue → ## Governance and accountability Ownership, inventory, and integration into existing governance. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. GA1 Do you keep a clear inventory of AI systems, their purpose, and whether you act as provider, deployer, or both? What good looks like AI register with named system owner and role mapping. Art. 3, 6, 26 · Applies to Providers and deployers Not addressedIn progressImplementedN/A GA2 Is AI compliance assigned to accountable roles across legal, business, technical, and operational teams? What good looks like Named owners, escalation path, and governance forum. Art. 17, 26 · Applies to Providers and deployers Not addressedIn progressImplementedN/A GA3 Do your existing management systems explicitly include AI-specific controls and review points? What good looks like AI integrated into QMS, compliance, security, and change management. Art. 17, 26 · Applies to Providers and deployers Not addressedIn progressImplementedN/A ← Previous Continue → ## Risk, safety and performance Risk management, testing, resilience, and safeguards. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. RS1 Is there a documented process to identify and review AI risks across intended use, foreseeable misuse, and affected persons? What good looks like Risk register and review cycle covering safety and rights impacts. Art. 9 · Applies to High-risk, selected limited-risk Not addressedIn progressImplementedN/A RS2 Are mitigation measures defined, tested, and communicated for known risks, including vulnerable groups? What good looks like Documented controls, residual-risk communication, and group-specific safeguards. Art. 9 · Applies to High-risk Not addressedIn progressImplementedN/A RS3 Do you validate performance, robustness, and cybersecurity in conditions that reflect real use? What good looks like Test plan, thresholds, resilience checks, and security hardening evidence. Art. 15 · Applies to High-risk Not addressedIn progressImplementedN/A ← Previous Continue → ## Data and model management Data quality, bias management, and model design traceability. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. DM1 Are data sources, selection criteria, assumptions, and model design choices documented and governed? What good looks like Documented provenance, approval steps, and model rationale. Art. 10, Annex IV · Applies to Providers, data-managing deployers Not addressedIn progressImplementedN/A DM2 Do you assess data for quality, representativeness, bias, and fitness for the intended use? What good looks like Quality criteria, bias review, and remediation of data gaps. Art. 10 · Applies to High-risk Not addressedIn progressImplementedN/A DM3 When sensitive data is used, are legal safeguards and technical protections clearly defined? What good looks like Restricted access, justification, and GDPR-aligned safeguards. Art. 10(5) · Applies to Conditional Not addressedIn progressImplementedN/A ← Previous Continue → ## Transparency and human oversight Disclosure, human supervision, and safe operational use. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. TH1 Are users, operators, and affected persons clearly informed when AI is used or when decisions are AI-assisted? What good looks like Clear notices, user-facing disclosures, and deployer instructions. Art. 13, 50 · Applies to All relevant systems Not addressedIn progressImplementedN/A TH2 Can responsible humans understand the system’s limits and override or stop it when needed? What good looks like Oversight procedures, stop controls, and override paths. Art. 14 · Applies to High-risk Not addressedIn progressImplementedN/A TH3 Are teams trained to avoid over-reliance on AI and to use the system only within its intended purpose? What good looks like Training records, usage rules, and automation-bias safeguards. Art. 14, 26 · Applies to Providers and deployers Not addressedIn progressImplementedN/A ← Previous Continue → ## Documentation and traceability Technical documentation, logging, retention, and auditability. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. DT1 Do you maintain up-to-date technical and operational documentation covering purpose, design, limitations, and expected performance? What good looks like Core technical file with versioned updates. Art. 11, Annex IV · Applies to Providers primarily Not addressedIn progressImplementedN/A DT2 Can system behaviour be traced through records or logs that show how outputs were generated and used? What good looks like Traceable logging fields and accessible operational records. Art. 12, 26(5) · Applies to High-risk, relevant deployers Not addressedIn progressImplementedN/A DT3 Are documentation and logs retained, protected, and accessible for audits, incidents, and regulator requests? What good looks like Retention rules, integrity protection, and retrieval process. Art. 12, 17 · Applies to Providers and deployers Not addressedIn progressImplementedN/A ← Previous Continue → ## Monitoring and incident response Post-deployment monitoring, corrective action, and reporting. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. MI1 Do you monitor performance, drift, misuse, complaints, and other operational signals after deployment? What good looks like Monitoring plan, feedback channels, and review cadence. Art. 72 · Applies to High-risk, GPAI as relevant Not addressedIn progressImplementedN/A MI2 Do you have thresholds and workflows for corrective action, rollback, suspension, or retraining? What good looks like Incident playbooks and remediation triggers. Art. 72, 73 · Applies to High-risk Not addressedIn progressImplementedN/A MI3 Are serious incidents and regulator interactions handled through a defined reporting and escalation process? What good looks like Authority notification process and evidence pack preparation. Art. 73 · Applies to High-risk, GPAI as relevant Not addressedIn progressImplementedN/A ← Previous Continue → ## Fundamental rights and advanced obligations FRIA, special transparency cases, and GPAI-specific obligations. What the four answers mean Not addressed No clear owner, no process and no evidence. In progress Recognised and partly addressed, but not yet implemented end to end. Implemented A clear process, ownership and evidence exist and are used in practice. N/A Justified non-applicability based on role, risk or system scope. FA1 If you deploy high-risk AI in public-sector or public-service contexts, have you assessed impacts on affected groups and defined safeguards? What good looks like FRIA process, affected-group analysis, and mitigation measures. Art. 27 · Applies to Conditional Not addressedIn progressImplementedN/A FA2 If systems generate synthetic content or use biometric or emotion functions, are the additional transparency obligations operationalised? What good looks like Labelling, notices, and operational handling for special cases. Art. 50 · Applies to Conditional Not addressedIn progressImplementedN/A FA3 If you provide or build on GPAI, do you manage model documentation, downstream information, copyright, and systemic-risk obligations? What good looks like GPAI documentation pack and systemic-risk governance. Art. 53-56 · Applies to GPAI providers Not addressedIn progressImplementedN/A ← Previous Continue to report → Last step ## Where should we send _your report?_ Your scored readiness report, in English, will arrive within 60 seconds. If you would like to discuss the results, reply directly and we will respond. Full name Required Company Required Email Please enter a valid email address Role Select your role CEO / Managing Director CIO / Chief Information Officer CTO / Chief Technology Officer COO / Operations Compliance Officer Data Protection Officer Legal Counsel IT Manager Other Required I agree to receive my assessment report and understand DataWeavrs may contact me once to discuss the results. What we store and why: [privacy policy](https://dataweavrs.com/privacy). ← Previous Send me my report → Report sent ## Check your _inbox._ Your scored readiness report is on its way. It should arrive within a minute. Check your spam folder if you do not see it, and add **assessment@mail.dataweavrs.com** to your safe senders. Sent to — Your readiness See report Next step Reply to the email to book a 30-minute review Your answers indicate a practice the AI Act prohibits (Article 5). The score above does not soften that: read the report and have the use case reviewed by legal counsel before anything else. ```json [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://dataweavrs.com/#organization", "name": "DataWeavrs", "url": "https://dataweavrs.com/", "email": "hello@dataweavrs.com", "logo": "https://dataweavrs.com/dataweavrs-logo.png", "sameAs": [ "https://www.linkedin.com/company/dataweavrs" ], "location": [ { "@type": "Place", "name": "Brussels", "address": { "@type": "PostalAddress", "addressLocality": "Brussels", "addressCountry": "BE" } }, { "@type": "Place", "name": "Madrid", "address": { "@type": "PostalAddress", "addressLocality": "Madrid", "addressCountry": "ES" } } ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://dataweavrs.com/#website", "url": "https://dataweavrs.com/", "name": "DataWeavrs", "inLanguage": "en", "publisher": { "@id": "https://dataweavrs.com/#organization" } } ] ```