EU AI Act 2026: A Practical Readiness Checklist for Businesses

The EU AI Act is moving from policy discussion into operational reality. Businesses using AI need to know which systems they have, what those systems do, who is responsible for them and where human oversight belongs.

According to the European Commission's AI Act implementation overview, the Act entered into force on 1 August 2024 and applies in stages, with most provisions scheduled around 2 August 2026 and specific exceptions and transition rules.

This article is a technical and operational starting point, not legal advice. Applicability depends on the system, role, region and use case, so organisations should obtain qualified legal guidance.

1. Create an AI system inventory

Include more than software labelled "AI." Record:

• public and internal chat assistants;
• automated scoring or recommendations;
• AI features inside CRM, recruitment and productivity tools;
• generative content services;
• document extraction;
• call analysis;
• biometric or monitoring functions;
• custom models and APIs; and
• experimental tools used with company data.

For each system, name an owner, purpose, provider, users, affected people, data sources, outputs and connected business actions.

Shadow AI is an inventory problem before it is a policy problem. A short, usable reporting process helps staff disclose tools instead of hiding them.

2. Identify your role

An organisation may be a provider, deployer, importer or distributor depending on how it develops, supplies or uses the system. A company that simply uses a third-party product has different obligations from one that modifies and sells an AI-powered service under its own name.

Record the reasoning and have it reviewed. Do not assume that buying an API transfers all responsibility to the vendor.

3. Classify use by risk and impact

The Act uses a risk-based structure. Some practices are prohibited, while certain high-risk uses face stronger obligations. Other systems may have transparency duties or general governance requirements.

Even when a use case is not high-risk under the Act, assess:

• effect on employment, finance, education, healthcare or essential services;
• possibility of discrimination;
• scale;
• reversibility of an error;
• use of sensitive data;
• whether people know AI is involved; and
• availability of meaningful human review.

The classification should reflect the real deployment, not the vendor's marketing category.

4. Document purpose and boundaries

Write what the system is allowed to do and what it must not do. For an AI customer-support assistant, that may include:

• approved knowledge sources;
• supported languages;
• prohibited topics;
• when identity verification is required;
• actions it can prepare;
• actions it can complete;
• confidence and escalation rules; and
• retention of conversation data.

Our AI Assistants & Automation approach builds these boundaries into workflow and permissions rather than leaving them only in a policy document.

5. Establish human oversight

Name the people who can:

• review outputs;
• override or stop the system;
• investigate incidents;
• update source material;
• approve higher-risk actions; and
• answer complaints.

Oversight must be practical. A human cannot meaningfully review thousands of decisions if the interface hides the relevant evidence or rewards instant approval.

6. Map data and retention

Record the personal, confidential and copyrighted data entering the system; where it is processed; whether it is used for provider training; how long it is stored; and who can retrieve it.

Apply data minimisation. If a workflow does not need a full document, extract or redact the necessary fields before sending it to a model where feasible.

Security controls around access, logging and incident response are part of our Cybersecurity & Performance work.

7. Evaluate vendors and contracts

Ask suppliers for:

• system documentation;
• model and service change notices;
• data locations and subprocessors;
• security controls;
• training-data and customer-data terms;
• logging and audit support;
• incident notification;
• availability commitments; and
• exit and data-export procedures.

Plan what happens if a model is withdrawn, a price changes or the provider alters behaviour. Technical dependency is also operational risk.

8. Test and monitor after launch

Pre-launch tests should cover accuracy, harmful output, bias, privacy leakage, prompt manipulation, failed integrations and human escalation.

Production monitoring should track:

• error and override rates;
• complaints;
• unusual access;
• source-data changes;
• model or vendor changes;
• high-impact outcomes; and
• incidents and corrective action.

Reassess the system when its purpose, audience, data or level of authority changes.

9. Build AI literacy

People need role-specific training. Users should understand limitations, reviewers need to recognise automation bias, developers need secure implementation practices, and leaders need to know which decisions cannot be delegated.

A one-hour generic presentation is not enough for teams operating different systems and risks.

10. Prepare an evidence pack

Keep the inventory, classification, owners, risk assessment, data map, supplier documents, test results, oversight procedure, incident log and training record together.

Good documentation is not only for compliance. It makes the system easier to improve, audit, transfer and retire.

A practical starting sequence

In the first two weeks, inventory systems and assign owners. Next, classify the highest-impact uses and stop any deployment whose purpose or data flow cannot be explained. Then document oversight, vendor terms, testing and monitoring. Have legal counsel confirm applicability and priorities before the relevant deadline.

If you need help turning governance requirements into technical controls, talk to Auztec about your AI systems. We can map data flow, permissions, escalation, logging and supplier dependencies alongside your legal and compliance advisers.