SimpleAct keeps two kinds of obligation checklists. In the AI Act area, every AI system has its own checklist that matches its risk class and role. In the GDPR area there is one checklist for the whole organisation. Both separate "done" cleanly from "not applicable", and the latter only with a justification.

At a glance

Included from: AI Act checklist from Starter, GDPR checklist from Professional
Where in the app: Prove compliance → Obligation checklist (AI Act or GDPR)
Output: Status per obligation with evidence; basis of the "obligation checklist" criterion in the compliance score
Legal basis: AI Act Chapter III, Art. 4, 5, 50; GDPR; Sec. 38 BDSG; Sec. 25 TDDDG
API: /api/v1/compliance-checklists

AI Act checklist for high-risk systems by role

The high-risk checklist is split into four groups. The app only shows the groups for the role in "Classification & roles"; without a role it shows all of them so nothing gets lost. The split by role is marked as beta.

Group	Content
Role (R1–R3)	Are you provider, deployer or both, including whether you become a provider under Art. 25.
Common	Duties of every operator: Art. 4, 5, 50, supply chain, change management, authority requests.
Provider	Art. 16 and the articles it refers to (Art. 9–15, 17–21, 43, 47–49, 72, 73).
Deployer	Art. 26(1)–(12), Art. 27 (fundamental rights impact assessment, only where required) and Art. 86.

GDPR checklist V3

The GDPR checklist is a single template for every organisation with 18 items: twelve core duties every controller has, and six conditional duties that depend on the processing. Former items that only described how to use SimpleAct have been retired; their saved answers are offered as a suggestion on the matching legal item and reappear there as "How to do this in SimpleAct".

Twelve core duties

Item	Legal basis
Lawfulness of processing (legal basis)	Art. 6, 7, 9, 10
Principles and accountability	Art. 5, 24
Information obligations (privacy notices)	Art. 12, 13, 14
Data subject rights (process and deadlines)	Art. 12, 15–21
Record of processing activities	Art. 30
Processing by processors	Art. 28
Security of processing (TOMs)	Art. 32
Data protection by design and by default	Art. 25
Personal data breaches	Art. 33, 34
Storage limitation and erasure	Art. 5(1)(e), 17
Cooperation with the supervisory authority	Art. 31, 58
Awareness and training (organisational measure)	Art. 24, 32(4), 39(1)(b)

Six conditional duties and how they are derived

Each conditional duty has an applicability question. Where SimpleAct already knows the facts, it derives the answer itself. An existing record shows the duty applies; "not applicable" is only derived from the DPO requirement check and the EU representative check. Everything else you answer yourself.

Duty	Basis	Derived from
Data protection officer	Art. 37–39 GDPR, Sec. 38 BDSG	DPO profile or DPO requirement check
Data protection impact assessment	Art. 35	Existing DPIA records
Transfers to third countries	Art. 44–49	Transfer tracker or processing records with a third-country transfer
Consent for cookies and similar technologies	Sec. 25 TDDDG	Consent entries that require consent
Automated decisions including profiling	Art. 22	Processing records with automated decision-making
Representative in the Union	Art. 27	EU representative check

"Not applicable" only with a justification

Anyone marking a conditional duty in the GDPR checklist as "not applicable" must give a justification; the same applies there to any item set to "not applicable". Without a justification the app refuses to save. In an audit, that is the first question: why does this not apply to you?

Information

The checklists do not replace legal advice. They structure evidence and ownership. The share of applicable obligations done in the AI Act checklist counts 35% towards the compliance score; not applicable items are left out.

Compliance checklists