EU AI Act compliance · Free audit · No signup

EU AI Act Compliance Audit

The EU AI Act becomes generally applicable on 2 August 2026 — fines up to €35M or 7% of global turnover. Grade your AI governance, model documentation, and data-handling policies against the 12 clauses every provider and deployer must satisfy: risk classification, data governance (Art. 10), technical documentation (Annex IV), human oversight (Art. 14), transparency (Art. 50), and GPAI obligations (Art. 53–55).

Run free EU AI Act audit
Regulation (EU) 2024/1689 — Artificial Intelligence Act · European Union — extraterritorial: applies to providers placing AI systems on the EU market AND deployers established in the EU AND providers/deployers outside the EU whose AI output is used in the EU

What EU AI Act non-compliance actually costs

€35M or 7% of global turnover
Prohibited AI practices (Art. 5) — max
Art. 99(3) — whichever is higher
€15M or 3% of global turnover
High-risk AI non-compliance (Art. 6–15) — max
Art. 99(4)
€7.5M or 1% of global turnover
Incorrect / misleading information to authorities
Art. 99(5)
€15M or 3% of global turnover
GPAI obligations (Art. 53–55) breach — max
Art. 101 — Commission can fine GPAI providers directly

Who must comply with EU AI Act?

What this audit checks

12 required clauses, scored as Present / Partial / Missing with the exact regulatory citation and suggested fix.

1
Risk classification (prohibited / high-risk / limited / minimal)
Art. 6 + Annex III — biometric ID, critical infra, education, employment, essential services, law enforcement, migration, justice, democratic process = high-risk by default
2
Risk management system (Art. 9) — continuous, iterative, documented
Identify + analyse + estimate + evaluate foreseeable risks across full lifecycle; mitigation measures + residual risk acceptance criteria
3
Data governance + training data quality (Art. 10)
Relevant, representative, free of errors and complete; documented data origin, collection, labelling, cleaning + bias detection (Art. 10(2)(f))
4
Technical documentation (Art. 11 + Annex IV)
Drawn up before placing on market, kept up to date — system description, design, training data, testing, accuracy + robustness metrics, cybersecurity measures
5
Record-keeping / automatic logging (Art. 12)
Logs over the system's lifetime — period of use, reference DB, input data, persons involved in result verification — retained at least 6 months
6
Transparency + information to deployers (Art. 13)
Instructions for use specifying intended purpose, accuracy, robustness, cybersecurity, foreseeable misuse, human oversight measures, expected lifetime
7
Human oversight (Art. 14)
Natural persons able to understand capacity + limits, monitor operation, intervene or override, decide not to use, stop the system; '4-eyes principle' for biometric ID
8
Accuracy, robustness, cybersecurity (Art. 15)
Resilience against errors + faults + inconsistencies + attempts to alter use through data poisoning / adversarial / model evasion / confidentiality attacks
9
Quality management system for providers (Art. 17)
Strategy for regulatory compliance, design + development controls, examination + test + validation procedures, change management, post-market monitoring system
10
Conformity assessment + EU declaration of conformity (Art. 43–47)
CE marking before placing on market — internal control or notified body depending on Annex III category; EU database registration (Art. 49 + 71)
11
Transparency obligations for limited-risk AI (Art. 50)
Disclose AI interaction (chatbots), label deepfakes, mark synthetic content as AI-generated in machine-readable form, inform persons subject to emotion recognition / biometric categorisation
12
GPAI obligations (Art. 53–55) — model card, training summary, copyright policy
All GPAI providers: technical documentation, info to downstream providers, EU copyright policy, summary of training data; systemic-risk GPAI (>10^25 FLOPs): + model evaluation, adversarial testing, serious incident reporting, cybersecurity
Audit my policy now
Results in 20 seconds · 3 free per day · No signup

Why EU AI Act audits actually fail

Treating 'we just use OpenAI' as out-of-scope
Art. 25 + Recital 84 — if you substantially modify a high-risk AI system or put your own brand on it, YOU become the provider with full Art. 16 obligations. Fine-tuning a foundation model for HR screening or credit decisions = you are the high-risk provider, not OpenAI.
Annex III high-risk use without conformity assessment
Recruitment screeners, performance evaluation, worker monitoring, education admission/scoring, access to essential public/private services, credit scoring (excl. fraud detection), insurance pricing/risk assessment for life + health = ALL high-risk under Annex III §3–5. Most companies don't realise their HR or insurance AI tool falls here.
GPAI 'open source' exemption misread
Art. 53(2) exempts open-source GPAI from the documentation duties UNLESS the model has systemic risk OR is monetised. Llama-3-style 'community licences' restricting commercial use generally do NOT qualify as the AI Act's open-source definition (Recital 89).
Missing copyright + training data summary
Art. 53(1)(c) + (d) require ALL GPAI providers (incl. open-source) to have a policy respecting EU copyright and to publish a 'sufficiently detailed summary' of training content. The AI Office template was published 24 July 2025 and is binding — many providers still ship a one-paragraph blurb.

EU AI Act FAQ

When does the EU AI Act apply to my product?
Phased entry: prohibitions + AI literacy = 2 Feb 2025; GPAI obligations = 2 Aug 2025; high-risk Annex III + governance + penalties = 2 Aug 2026; high-risk under Annex I (product safety integrations) = 2 Aug 2027. If you sell into the EU or your AI's output is used in the EU, you are in scope today for prohibitions and GPAI.
We're a US-only SaaS. Are we really in scope?
Yes if any EU resident uses the system OR its output is used in the EU (Art. 2(1)(c)). The Act is extraterritorial like the GDPR. Practical test: if you'd need a GDPR data processing addendum for an EU customer, you almost certainly need an AI Act conformity assessment for that same use.
Do small companies get an SME exemption?
Limited — Art. 62 requires Member States to provide priority access to regulatory sandboxes + reduced fees + simplified technical documentation for SMEs and startups. The substantive obligations (risk class, data governance, transparency) still apply. There is no general SME carve-out.

Grade your policy in 20 seconds

Paste your existing document. Get a 12-clause EU AI Act scorecard. Generate a fully compliant version for $9 if you don't want to fix it manually.

Run free EU AI Act audit