AI Act checklist: twelve points to check before 2 August 2026
The checklist is below, in full, no email required. It is the one we use with clients as the audit script. If you end up with more "don't know" than "yes", your problem is not compliance: it is that you do not yet have an inventory of what you use — and that is where to start.
Content reviewed on 13 July 2026
How to use it
Answer yes, no, or don't know — and treat every "don't know" as a no. The AI Act runs on accountability: being compliant is not enough, you must be able to demonstrate it. Someone who cannot say whether their own chatbot declares itself an AI is, by definition, unable to demonstrate it.
The Article 50 points are the ones with a deadline: 2 August 2026. The Article 4 points are the ones already past due — the AI literacy obligation has been in force since February 2025. If you have to pick where to start, start there.
The twelve points
- Inventory
Is there a written list of the AI systems the company uses or makes available to customers?
This is point zero. Without an inventory every other answer is an opinion, and no measure is demonstrable.
- Inventory
For each system, is it clear whether the company is the provider (builds and distributes it) or the deployer (uses it)?
The obligations differ. Confusing the two roles is the fastest way to comply with the wrong thing.
- Art. 5
Do none of the systems fall under the prohibited practices (manipulation, social scoring, emotion recognition in the workplace)?
The gravest ban, in force since February 2025, carrying the highest penalty ceiling.
- Art. 50(1)
Does the virtual assistant tell the user, at the start of the interaction, that an AI system may reply?
This is the obligation that becomes applicable on 2 August 2026. It must be visible without hunting for it.
- Art. 50(1)
If a user asks "are you a person?", does the system answer honestly?
An initial disclosure contradicted by the system's own behaviour is not a disclosure: it is a false statement.
- Art. 50(1)
In a hybrid system, can the user tell AI replies apart from a human operator's replies?
Without that distinction, the initial disclosure stops being true the moment a person takes over.
- Art. 50(1)
Is the disclosure on by default and impossible for the installer to switch off?
A "hide AI notice" toggle in the admin panel is the button that makes whoever presses it non-compliant.
- Art. 50(2)
Is published AI-generated content (text, images, audio, video) marked as such in a machine-readable format?
For systems already on the market, compliance on this point is expected by 2 December 2026.
- Art. 4
Is there a written AI literacy programme, differentiated by role?
The obligation has been in force since 2 February 2025 and has no transitional period.
- Art. 4
Is there a register of the sessions delivered (date, attendees, contents, duration), plus individual certificates?
Unrecorded training is worth, in front of an authority, exactly as much as training never delivered.
- GDPR
Does the privacy notice cover the processing performed by the AI system, and is there an impact assessment where required?
A chatbot talking to customers processes personal data. That is the channel challenges actually arrive through.
- Documentation
Is all of the above written down, dated, and updated when the system changes?
Documented diligence is one of the factors Article 99 uses to set the penalty. Undocumented diligence cannot be assessed.
Want us to go through it with you?
We get back to you within one business day. Thirty minutes with an engineer who has made a production chatbot compliant: we tell you what is missing and what it costs to fix. If there is nothing to fix, we tell you that too.
Frequently asked questions
Why is the checklist free and ungated?
- Because a checklist behind a form is a way to collect an address, not a way to help someone. If it is useful, take it. If you then want us to go through it with you, the form is below — but that is your choice, not the toll.
Do you actually use it with clients?
- Yes, it is the script for the audit phase. There is little to invent about the order: inventory first, then prohibited practices, then transparency, then training, then the documentation that holds it all together.
Prefer an automatic answer in a minute?
The check tool asks five questions about your virtual assistant and returns the list of gaps, article by article. No email.
Go to the checkSources
This page is informational and does not constitute legal advice. The authoritative texts are Regulation (EU) 2024/1689 and Italian Law no. 132 of 23 September 2025. We are engineers: we know how transparency is implemented in an AI system — we do not replace your lawyer. For hard cases, consult a qualified professional.