EU AI Act compliance checklist for small and medium businesses

The test is territorial reach, not company address. If you place an AI system on the EU market, put one into service there, or the output of your AI system is used in the EU, you are in scope. Write down the answer and the reasoning — that note is the first piece of evidence in your file.

• Tool name, vendor, and who owns it internally.
• What it is used for, in one sentence a non-technical colleague would recognise.
• Whether it touches personal data, and whose.
• Whether it influences a decision about a person, and how much.
• Whether any affected person is in the EU.

Check the prohibited list first — those uses must stop immediately, regardless of timeline. Then check Annex III: employment and worker management, credit and insurance scoring, education assessment, essential services, biometrics. Everything left over is usually limited or minimal risk.

Provider or deployer, tool by tool. If you white-label, resell, or materially modify a system, you are a provider for that system and the obligation set is far heavier.

• Name the person who reviews AI output for each high-risk or borderline use.
• State what authority they have to override, pause or escalate.
• State how often the tool's output is spot-checked, and where the record lives.

The literacy obligation has applied since February 2025 and applies to every organisation using AI, not only high-risk ones. A short internal session covering what the tools do, what may not be pasted into them, and who to ask is enough for most SMEs — provided you keep an attendance record and refresh it.

• Chatbots and AI agents facing customers must be identifiable as AI.
• Synthetic images, audio and video must be labelled as artificially generated.
• Staff subject to a high-risk system at work must be told before it is used.

Nearly every AI use in scope of the Act is also processing personal data. Lawful basis, transparency notices, DPIAs for high-risk processing, and international transfer checks for overseas AI vendors all need to line up with what you have just written down.

Providers must publish instructions for use and an intended purpose. Operating a tool outside that intended purpose can move liability onto you. Save the version you relied on, with the date.

A register goes stale in weeks. Review quarterly, and re-check whenever a new tool is adopted, a vendor changes its model, or a use case moves closer to hiring, credit or access to services.