OOOMETA/OS
← Back to Insights

September 2026 · 5 min read

EU AI Act Compliance Checklist for Enterprises

EU AI Act Compliance Checklist for Enterprises

Key Definitions

In-force obligations AI Act provisions already enforceable as of September 2026: the Feb 2025 ban on unacceptable AI practices, the Aug 2025 GPAI model obligations, and — since Aug 2, 2026 — Article 50 transparency duties plus the full market-surveillance and enforcement framework.

Request for Information (RFI) A formal evidence demand issued by the EU AI Office under its enforcement powers, requiring providers to submit technical documentation, training-data provenance, risk assessments, and mitigations within a set deadline. The first wave went to 30+ AI providers in September 2026 as a testing-phase action.

Deferred high-risk timeline Under the Digital Omnibus (Regulation (EU) 2026/1744), core obligations for Annex III standalone high-risk systems move to Dec 2, 2027, and Annex I embedded AI to Aug 2, 2028. Transparency duties were not deferred.

30+ AI providers already face EU AI Office information requests. An enforcement-ordered checklist: transparency duties in force since Aug 2, deferred high-risk deadlines to 2027/2028, and the documentation evidence regulators now demand.

Enforcement reality: the first RFIs are out

In September, the European Commission confirmed the AI Office has sent Requests for Information to more than 30 AI providers worldwide, demanding documentation of model testing, incident reporting, and risk mitigations. Officials framed the wave as a testing-phase action — not about immediate fines, but calibrating enforcement intensity. The precedent matters more than the penalty: regulators are no longer waiting for voluntary disclosure; they are actively pulling evidence. For recipients, an RFI carries a legal response deadline — silence is itself a violation.

The Act has crossed from paper obligations into an enforcement record. Everything a provider submits joins the file and is cross-checked against public claims — overstating compliance in a blog post is now a liability, not marketing.

The obligation timeline: what is live, what moved

After the Digital Omnibus, obligations stack in three enforceable layers — plan by “in force”, not by “high-risk”:

In force · since Feb 2025: unacceptable-practices ban

Social scoring, manipulative or deceptive AI, workplace emotion recognition, untargeted facial scraping — all prohibited. Penalties up to €35M or 7% of global turnover.

In force · since Aug 2025: GPAI model duties

General-purpose model providers must maintain technical documentation, publish training-data summaries, enforce a copyright policy, and release model cards. Systemic-risk models add adversarial testing and serious-incident reporting.

In force · since Aug 2, 2026: transparency + enforcement

Article 50 applies to every risk tier: chatbots disclose AI identity, deepfakes get labeled, AI-generated content carries machine-readable marks. National authorities and the AI Office gained full investigative powers the same day.

Deferred · Annex III → Dec 2, 2027 / Annex I → Aug 2, 2028

Core obligations for high-risk systems in employment, education, law enforcement, and critical infrastructure were postponed by the Omnibus — but transparency, prohibitions, and GPAI duties were not.

Checklist A: six things due today

Auditable now, with no grace period:

1. AI identity disclosure — every user-facing interactive AI (support bots, voice assistants, copilots) tells users they are talking to a machine. 2. Content marking — AI-generated or altered text, image, audio, and video output carries machine-readable marks; deepfakes are visibly labeled. 3. Prohibition audit — inventory live AI features and confirm none touch banned practices. 4. GPAI documentation — providers hold technical docs, data summaries, and copyright policy; deployers of third-party models request and retain them. 5. RFI response process — a named owner for regulatory correspondence and a rehearsed path to assemble evidence inside 30 days. 6. Vendor contract clauses — AI procurement contracts carry compliance allocation, documentation delivery, and incident notification duties; the regulatory chain runs downstream.

Checklist B: six things to finish inside the deferral window

The 2027/2028 deferral is a preparation window, not an exemption:

1. AI system inventory — a company-wide register covering built, bought, and embedded AI inside SaaS; most organizations discover 30-50% more systems than expected. 2. Risk classification — map each system against Annex III categories (employment, education, credit, law enforcement, critical infrastructure). 3. Gap analysis — score each high-risk candidate against the obligation set: quality management, risk management, data governance, technical documentation, logging, human oversight, accuracy-robustness-cybersecurity. 4. Logging and evidence chain — high-risk systems must auto-log operations; standardize log structure now and it becomes conformity-assessment evidence later. 5. Incident reporting flow — serious-incident deadlines are short (15 days, 10 for fatalities, 2 for critical-infrastructure disruption); the runbook needs a regulator-notification path. 6. Role clarity — name the AI compliance owner and split provider vs. deployer duties per system; the same company often carries both, with different obligations.

What regulators will check: evidence beats declarations

The first RFIs signal what enforcement actually consumes: documentation, not promises. The four request categories — model test records, training-data provenance, risk assessments, deployed mitigations — are all “prove you did it” artifacts. Most compliance gaps are not missing work but missing records: evaluation meetings with no minutes, model tests with no archive, vendor diligence with no written conclusion. These surface only when the RFI clock is already running.

The operational test is simple: design every compliance action as evidence for a regulator’s file. Versioned system inventory, signed-off risk assessments, retained vendor-document requests, archived screenshots of disclosure UIs. With an intact evidence chain, an RFI is a 30-day assembly job; without one, it is an invitation to confess.

OOMeta AI

OOMeta’s AI governance platform helps enterprises rapidly build AI system inventories, risk assessment processes, and compliance documentation systems — ensuring readiness and competitiveness in a fast-changing regulatory environment.

Schedule a Diagnostic

Sources

FAQ

Which EU AI Act obligations are in force right now?+

Three layers are enforceable today: the Feb 2025 ban on unacceptable practices (social scoring, manipulative AI); the Aug 2025 GPAI duties for general-purpose model providers (technical docs, copyright policy, model cards); and since Aug 2, 2026, Article 50 transparency duties plus full enforcement powers — chatbots must disclose AI identity, deepfakes must be labeled, AI-generated content must carry machine-readable marks.

What should you do if the AI Office sends an RFI?+

RFIs carry a legal response deadline — silence is itself a violation. Assign a single owner immediately and respond item by item: model and system technical documentation, training-data provenance and rights clearance, risk assessments, and the mitigations deployed. Everything submitted enters the enforcement record and is checked against public claims — the September wave is a testing phase calibrating future enforcement intensity.

High-risk duties were deferred to 2027/2028 — prepare anyway?+

Yes. Only the Annex III/Annex I core obligations (quality management, conformity assessment, human oversight) moved. Transparency, prohibitions, and GPAI duties all stayed on schedule. More practically: the evidence chain for high-risk compliance — system inventory, classification records, documentation templates, logging — takes 6-12 months to build, so a gap analysis started now is what makes Dec 2027 achievable.

Does the AI Act apply to non-EU companies?+

Yes — it applies when the AI system's output is used in the EU, no EU establishment required. A US or Chinese provider whose model output reaches EU users is in scope. Several recipients of the September RFIs are non-EU model providers.

What are the penalty ceilings?+

Breaching the unacceptable-practices ban: up to €35M or 7% of global turnover, whichever is higher. Most other obligations including transparency: up to €15M or 3%. Supplying false information to regulators: up to €7.5M or 1%. SMEs get proportionality on fines, but the obligations still apply.

Related Articles

Digital Omnibus: High-Risk Deferred, Transparency First

Regulation (EU) 2026/1744, in force July 27, pushes high-risk duties to 2027/2028 — but Article 50 transparency and enforcement powers activated Aug 2 on schedule.

EU AI Act’s First Enforcement: 30+ RFIs Sent

The AI Office’s first wave demands model testing, incident reporting, and mitigation documentation — enforcement has entered the evidence-pulling phase.

EU AI Act Enforcement Starts Aug 2: Compliance Checklist

The general-application date: transparency duties enforceable, market surveillance and AI Office powers active, fines up to €35M or 7%.

EU AI Omnibus Is Now Law: Regulation 2026/1744 in Force

Digital Omnibus on AI published as Regulation 2026/1744, in force July 27. High-risk deferred to Dec 2027, Article 50 transparency remains Aug 2.