# EU AI Act Compliance Checklist

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Organisation:** Acme Inc
**Project:** nextjs-saas-example
**Risk Classification:** Limited
**Generated:** 2026-03-19

## Related Documents

- AI Disclosure (`AI_DISCLOSURE.md`)
- AI Model Card (`AI_MODEL_CARD.md`)
- AI Governance Framework (`AI_GOVERNANCE_FRAMEWORK.md`)

---

> This checklist is based on the EU Artificial Intelligence Act (Regulation (EU) 2024/1689). Full transparency obligations take effect on **2 August 2026**. Use this checklist to track your compliance progress.

**AI Services Detected:** openai

## Transparency

- [ ] Users are clearly informed when they are interacting with an AI system (Art. 50(1))
- [ ] AI disclosure statement is published and accessible from the application
- [ ] AI disclosure is provided at or before the user's first interaction with AI features (Art. 50(5))
- [ ] Disclosure meets accessibility standards per Directive (EU) 2019/882
- [ ] AI-generated content is clearly labelled as such to users
- [ ] Synthetic media (images, audio, video) is disclosed as AI-generated (Art. 50(4))
- [ ] AI-generated text published to inform the public is labelled as artificially generated
- [ ] Users are informed about the limitations and potential inaccuracies of AI outputs

## Documentation

- [ ] Complete inventory of all AI systems used in the application is maintained
- [ ] Each AI system's purpose, provider, and data processed is documented
- [ ] AI provider agreements and data processing terms are reviewed and on file
- [ ] Data processing records (GDPR Art. 30) include AI service providers
- [ ] AI disclosure statement is reviewed and updated at least annually
- [ ] Changes to AI systems or providers are reflected in documentation within 30 days
- [ ] Records of AI risk classification rationale are maintained

## Human Oversight

- [ ] AI features do not make autonomous decisions with legal or similarly significant effects
- [ ] A process exists for users to request human review of AI-assisted decisions
- [ ] Staff responsible for human review are identified and trained
- [ ] Response time for human review requests is defined and communicated
- [ ] AI outputs that may affect user rights are subject to human verification before action
- [ ] Override mechanisms exist to correct or reverse AI-generated decisions
- [ ] Regular audits of AI decision quality are conducted

## Incident Reporting

- [ ] Process exists to identify and report serious AI-related incidents
- [ ] Contact information for relevant national supervisory authority is on file
- [ ] Incident reporting timeline is defined (serious incidents must be reported promptly)
- [ ] Internal escalation procedure for AI malfunctions or harmful outputs is established
- [ ] Log of AI-related incidents and corrective actions is maintained
- [ ] Users have a clear channel to report concerns about AI behaviour

## Content Marking (Art. 50(2))

- [ ] Technical mechanism is implemented to mark AI-generated content as machine-readable
- [ ] Marking method is interoperable with standard detection tools
- [ ] Marking is applied at the point of content generation
- [ ] C2PA content credentials, watermarking, or equivalent metadata standard is adopted
- [ ] Compliance with the EU Code of Practice on marking AI-generated content is verified
- [ ] Marking cannot be easily removed or circumvented by end users

## Data Protection

- [ ] Data processing agreements are in place with all AI service providers
- [ ] Cross-border data transfer safeguards are documented (SCCs, EU-US DPF, adequacy decisions)
- [ ] Data minimisation principle is applied to data sent to AI providers
- [ ] Data retention policies for AI interaction data are defined
- [ ] Users can request deletion of their data from AI processing pipelines
- [ ] Privacy impact assessment (DPIA) has been conducted for AI features
- [ ] AI provider data processing policies are reviewed for GDPR compliance

---

*This checklist was generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on automated code analysis. It is intended as a compliance tracking aid and should be reviewed by a legal professional. The EU AI Act requirements may evolve as implementing acts and codes of practice are finalised.*