The SMB EU AI Act Compliance Checklist: 15 Steps Before August 2026

List every AI system your company uses: from customer-facing chatbots to internal analytics tools. Include third-party AI services (ChatGPT, Copilot, Salesforce Einstein) and any custom ML models. Many organizations discover they use 3-5x more AI systems than they initially estimated.

The Act defines four risk levels: prohibited (social scoring, real-time biometric surveillance),high-risk (hiring decisions, credit scoring, medical devices),limited risk (chatbots, emotion detection), and minimal risk (spam filters, games). Your obligations scale dramatically with risk level.

The EU AI Act applies to: (a) any organization placing AI systems on the EU market, (b) any organization deploying AI systems within the EU, (c) providers or deployers outside the EU whose AI system output is used within the EU. If you serve EU customers through any AI-powered feature, you're likely in scope.

Before building a compliance plan, understand where you stand today. Do you have documented AI policies? Is there human oversight for high-risk decisions? Are your AI systems transparent to users? A gap analysis reveals exactly what needs to change.

Document your organization's principles for AI use: what AI can and cannot be used for, who approves new AI deployments, how decisions are reviewed, and how employees should interact with AI tools. This becomes your governance foundation.

Any high-risk AI system requires a formal risk assessment covering: intended purpose, potential harms, mitigation measures, data quality requirements, accuracy metrics, and human oversight procedures. This must be updated when the system changes.

Model cards document the technical and ethical aspects of each AI system: what it does, what data it was trained on, known limitations, performance metrics across different populations, and intended vs. prohibited use cases.

AI systems are only as good as their data. Document how data is collected, processed, stored, and deleted for each AI system. Address data quality requirements, bias mitigation procedures, and data subject rights (especially under GDPR, which overlaps significantly).

What happens when your AI system produces harmful outputs or makes an incorrect decision? Define clear procedures for identifying, reporting, investigating, and remediating AI incidents. Include escalation paths, notification requirements, and post-incident review processes.

High-risk AI systems must have human oversight. This doesn't mean a human reviews every decision, but it means humans can: understand the system's capabilities, monitor operations, interpret outputs, and override or reverse decisions when necessary.

Users interacting with AI systems must be told they're interacting with AI. If your chatbot handles customer service, it needs to disclose that. If AI generates content, it should be labeled. Emotion detection and biometric categorization systems have additional notification requirements.

High-risk AI systems require ongoing monitoring: track accuracy metrics, detect drift, log decisions, and maintain audit trails. This isn't just a compliance checkbox; it's how you catch problems before they become incidents.

AI literacy is now a legal requirement under the EU AI Act (enforced since February 2, 2025). Ensure your team understands: which AI systems they use, what the risks are, how to escalate concerns, and what the organization's AI policies are.

AI governance isn't a one-time project. Schedule quarterly reviews to: reassess risk levels for existing systems, evaluate newly adopted AI tools, update documentation, review incident logs, and adjust policies as the regulatory landscape evolves.

The EU AI Act is framework legislation: implementing acts, guidelines, and harmonized standards are still being developed. Subscribe to updates from the EU AI Office, your industry association, and reliable AI governance publications. The rules will get more specific over time.