EU AI Act Readiness Assessment

Do you maintain a complete, current inventory of all AI systems in use: internal, vendor-embedded, and customer-facing?

Have you determined which of your AI systems fall under the EU AI Act (placed on the EU market, or outputs used in the EU)?

Have you classified each AI system against the EU AI Act risk tiers: unacceptable (e.g. social scoring, manipulative systems), high-risk (e.g. biometrics, employment, critical infrastructure), limited (e.g. chatbots, synthetic content), or minimal (e.g. spam filters, recommendation engines)?

Have you screened your AI systems against the Act's prohibited practices (social scoring, workplace emotion recognition, manipulative techniques)?

Is there a named executive or owner accountable for AI governance in your organization?

Do you have an approved AI governance policy covering acceptable use, development, and procurement of AI?

Is there a defined review and approval process before new AI use cases go live?

Do you run a documented risk management process across the AI lifecycle, from design through deployment and retirement?

Do you have data governance for AI training and input data: quality, bias, and provenance?

Do you assess third-party AI vendors and models before adopting them?

Do you maintain technical documentation for each AI system: intended purpose, capabilities, and limitations?

Are people informed when they are interacting with an AI system or AI-generated content?

Do you log AI system activity so decisions and events are traceable after the fact?

Is AI-generated content (audio, image, video, or text) marked in a machine-readable format so it can be detected as artificially generated, per Article 50?

Are human oversight mechanisms in place for AI decisions with legal or otherwise significant effects on people?

Do you have monitoring and incident response for AI system failures or unexpected behavior?

Have staff who operate or use AI systems received AI literacy training (required by Article 4)?