EU AI Act Compliance Checklist: 59 Requirements for 2026

⏰ Deadline: August 2, 2026

All high-risk AI systems must comply with these requirements. Fines for non-compliance: up to €15 million or 3% of global annual turnover.

This checklist covers the 59 individual requirements across the 7 core articles (9–15) that apply to all high-risk AI systems under the EU AI Act. Each item is derived directly from the regulation text.

📊Article 10: Data and Data Governance(9 requirements)

10.1 Training data must be subject to appropriate data governance practices10.2 Examine data for possible biases that could lead to discrimination10.3 Identify relevant data gaps or shortcomings and mitigate them10.4 Training data must be relevant, sufficiently representative, and as error-free as possible10.5 Consider the specific geographical, contextual, or behavioral setting of deployment10.6 Use appropriate statistical properties including where applicable at individual sub-group level10.7 Processing of special category personal data only where strictly necessary for bias detection10.8 Document data provenance, collection methods, and preparation procedures10.9 Apply data quality criteria to validation and testing datasets

📄Article 11: Technical Documentation(8 requirements)

11.1 Documentation must be drawn up BEFORE the system is placed on the market11.2 Include general description of the AI system and its intended purpose11.3 Document design specifications and system architecture11.4 Describe development process including training methodologies11.5 Document validation and testing procedures with results11.6 Include information about training and testing datasets used11.7 Describe computational resources and hardware requirements11.8 Keep documentation up to date throughout the system lifetime

📝Article 12: Record-Keeping(7 requirements)

12.1 System must enable automatic recording of events (logging)12.2 Logging must be appropriate to the intended purpose of the system12.3 Logs must enable monitoring of operation and post-market surveillance12.4 Record traceability of results to input data where technically feasible12.5 Logging capabilities must conform to recognized standards or specifications12.6 Ensure logs capture events relevant to identifying risks12.7 Retain logs for an appropriate period consistent with intended purpose

🔍Article 13: Transparency and Information(9 requirements)

13.1 Provide clear instructions of use for deployers13.2 Include concise, complete, correct, and clear information13.3 Disclose the AI system identity and provider contact details13.4 Describe the system's intended purpose and capabilities13.5 Specify the level of accuracy, robustness, and cybersecurity13.6 Describe known or foreseeable circumstances of misuse13.7 Provide information to enable deployers to interpret system output13.8 Describe human oversight measures and their implementation13.9 Specify expected system lifetime and maintenance requirements

👤Article 14: Human Oversight(8 requirements)

14.1 Design system to enable effective oversight by natural persons14.2 Include human-machine interface tools appropriate to the use case14.3 Enable the overseer to fully understand the system's capabilities and limitations14.4 Enable detection and addressing of anomalies, dysfunctions, and unexpected performance14.5 Enable the overseer to correctly interpret the AI system's output14.6 Enable the overseer to decide not to use or to override the output14.7 Enable the overseer to interrupt or stop the system via a 'stop' mechanism14.8 For biometric identification: require two natural persons to verify results

🛡️Article 15: Accuracy, Robustness, and Cybersecurity(8 requirements)

15.1 Achieve appropriate levels of accuracy for the intended purpose15.2 Declare accuracy levels in instructions of use15.3 Design system to be resilient against errors, faults, and inconsistencies15.4 Implement technical redundancy solutions where appropriate15.5 Design system to be resilient against unauthorized third-party manipulation15.6 Implement measures against AI-specific vulnerabilities (data poisoning, adversarial attacks)15.7 Apply cybersecurity measures proportional to the risk level15.8 Accuracy metrics and robustness measures must be testable and verifiable

Summary by Article

🎯

Art. 9

requirements

📊

Art. 10

requirements

📄

Art. 11

requirements

📝

Art. 12

requirements

🔍

Art. 13

requirements

👤

Art. 14

requirements

🛡️

Art. 15

requirements

59total requirements

Automate your compliance check

Our multi-model AI verification checks all 59 requirements automatically and generates a signed compliance report.

EU AI Act Compliance Checklist: 59 Requirements You Need to Meet

🎯Article 9: Risk Management System(10 requirements)

📊Article 10: Data and Data Governance(9 requirements)

📄Article 11: Technical Documentation(8 requirements)

📝Article 12: Record-Keeping(7 requirements)

🔍Article 13: Transparency and Information(9 requirements)

👤Article 14: Human Oversight(8 requirements)

🛡️Article 15: Accuracy, Robustness, and Cybersecurity(8 requirements)

Summary by Article

Automate your compliance check