Checklist · AI Act Chapter III

Status: 4 October 2026

High-Risk AI Checklist: All Obligations under the EU AI Act

Your AI system is high-risk – now what? This checklist turns Chapter III of the AI Act into tasks you can tick off: separately for providers and deployers, with article, evidence and deadlines. Interactive in the browser or as a free Excel file for your project team.

Start the checklist Download the Excel checklist

17 obligations for providers
14 points for deployers
Evidence and retention periods
Deadlines after the Digital Omnibus

app.simpleact.de

High-risk checklist

Applicant screening · Annex III point 4

ProviderDeployer

Role checked: deployer, not providerArt. 25
Overseers appointed and enabledArt. 26(2)
Works council and staff informedArt. 26(7)
Logs kept for at least six monthsArt. 26(6)
Affected persons informedArt. 26(11)

9 of 14 done64%

Sample data · deployer obligations apply from 2 December 2027

In short

The AI Act assigns high-risk obligations by role. Providers need, among other things, risk management, data governance, technical documentation, quality management, a conformity assessment, CE marking and registration. Deployers must use the system as instructed, ensure human oversight, keep logs and inform staff and affected persons. For Annex III, the obligations apply from 2 December 2027.

Context

What the checklist covers – and who it applies to

The obligations in Chapter III of the AI Act (Regulation (EU) 2024/1689) only apply to high-risk AI systems. Under Art. 6, a system is high-risk in two ways: as a safety component or product covered by the harmonisation legislation in Annex I that requires a third-party conformity assessment (para. 1), or as a use case listed in Annex III, for example in employment, creditworthiness assessment or education (para. 2). Annex III systems can be exempt if they do not pose a significant risk (para. 3) – but profiling of natural persons is always excluded from that exemption.

This page starts where classification ends. Which areas and use cases Annex III covers and how the exemption is tested is explained in detail on our Annex III page. Here the question is what comes next: what exactly has to be done, documented and evidenced?

The obligations depend on your role. A provider develops an AI system or has it developed and places it on the market or puts it into service under its own name (Art. 3(3)). A deployer uses an AI system under its own authority, except for purely personal activities (Art. 3(4)). Most obligations sit with the provider: Art. 16 bundles them and refers to the requirements for the system in Art. 8 to 15 as well as quality management, documentation, conformity assessment and registration. Deployers’ obligations are mainly in Art. 26, supplemented by the fundamental rights impact assessment in Art. 27 for certain deployers.

Most mid-sized companies are deployers: they buy an HR tool with AI pre-screening, a scoring solution or control-room software. Their list is shorter but not trivial – human oversight by competent people, keeping the logs and informing staff and affected persons in particular need preparation. Software companies that build AI features into such products, on the other hand, are providers and carry the full list.

On timing, the Digital Omnibus (Regulation (EU) 2026/1744, in force since 27 July 2026) postponed the high-risk obligations: for Annex III to 2 December 2027, for Annex I to 2 August 2028. The prohibitions under Art. 5 and the duty to take AI literacy measures under Art. 4 already apply. For systems placed on the market before the cut-off date, the obligations generally only apply after a significant change; high-risk AI used by public authorities must comply by 2 August 2030 (Art. 111(2)).

Infringements of providers’ obligations under Art. 16 and deployers’ obligations under Art. 26 can be fined up to €15 million or 3% of worldwide annual turnover; for SMEs the lower amount applies (Art. 99(4) and (6)). The checklist below is built as a working list: one row per task, one article, one piece of evidence.

obligations for high-risk AI under Annex III apply (Digital Omnibus): 2 Dec 2027; obligations for high-risk AI under Annex III apply (Digital Omnibus)
or 3% of turnover: fine ceiling for infringements of Art. 16 and 26 (Art. 99(4)): €15m; or 3% of turnover: fine ceiling for infringements of Art. 16 and 26 (Art. 99(4))
retention of technical documentation and the declaration of conformity by the provider: 10 years; retention of technical documentation and the declaration of conformity by the provider

Not yet sure whether your system is high-risk?

Settle that first. The checklist assumes the classification is done.

Evidence

Which documents and evidence high-risk AI requires

In the end, what counts is what you can show an authority. The table lists the documents that result from the obligations – who produces them, what they are based on, what they must contain at a minimum and how long to keep them.

Scroll the table sideways →

Which documents and evidence high-risk AI requires
Document	Who	Reference	Core content	Retention
Risk management documentation	Provider	Art. 9	Identified risks, evaluation, measures, residual risks, tests; continuously updated.	Part of the technical documentation
Technical documentation	Provider	Art. 11, Annex IV	At least the elements in Annex IV; SMEs and small mid-caps simplified via the Commission form.	10 years (Art. 18)
Instructions for use	Provider → deployer	Art. 13(3)	Intended purpose, accuracy and metrics, performance limits, oversight measures, maintenance, logs.	With the system
Quality management system	Provider	Art. 17	Written policies and procedures from change management to accountability; proportionate to size.	10 years (Art. 18)
EU declaration of conformity	Provider	Art. 47	Declaration per system, written, machine-readable, physically or electronically signed.	10 years (Art. 47(1))
Registration in the EU database	Provider; authorities as deployers	Art. 49	Details on provider and system; also when relying on the Art. 6(3) exemption.	Keep up to date
Post-market monitoring plan	Provider	Art. 72	How performance data is collected and analysed over the lifetime.	Part of the technical documentation
Logs	Provider and deployer	Art. 12, 19, 26(6)	Automatically generated records, where under own control.	at least 6 months
Fundamental rights impact assessment	Certain deployers	Art. 27	Processes, period, affected groups, risks, oversight, remedies; notification to the authority.	Update on changes
Data protection impact assessment	Deployer (as controller)	Art. 26(9), Art. 35 GDPR	Where a high risk is likely; include the provider’s Art. 13 information.	Update on changes
Information to staff	Deployer as employer	Art. 26(7)	Before use at the workplace, to workers’ representatives and affected workers.	Recommendation: with the AI inventory
Serious incident reports	Provider; deployer to provider	Art. 73, 26(5)	Incident, link to the system, measures; an incomplete initial report is possible.	Recommendation: incident register

Simplified overview. Where the law sets no period, retention is marked as a recommendation. Data protection deletion duties remain unaffected.

Deadlines

Key dates, reporting periods and retention at a glance

The most important dates for high-risk AI after the Digital Omnibus – from application to reporting a serious incident.

Scroll the table sideways →

Key dates, reporting periods and retention at a glance
Topic	Deadline	Reference
High-risk obligations for Annex III apply	2 December 2027 (before: 2 August 2026)	Regulation (EU) 2026/1744
High-risk obligations for Annex I apply	2 August 2028 (before: 2 August 2027)	Regulation (EU) 2026/1744
High-risk AI for public authorities already on the market	by 2 August 2030	Art. 111(2)
Reporting a serious incident – general rule	no later than 15 days after becoming aware	Art. 73(2)
Reporting a widespread infringement or serious disruption of critical infrastructure	no later than 2 days after becoming aware	Art. 73(3)
Reporting in the event of a death	no later than 10 days after becoming aware	Art. 73(4)
Technical documentation, QMS, declaration of conformity	10 years from placing on the market	Art. 18(1), Art. 47(1)
Automatically generated logs	at least 6 months	Art. 19(1), Art. 26(6)

All AI Act deadlines, including GPAI and transparency obligations, are on our deadlines page.

Role change

When deployers become providers

Art. 25(1) names three cases in which a deployer, distributor or importer is considered a provider – with all the provider obligations in this checklist. The original provider must then cooperate closely and make the necessary information available.

Own name or trade mark

You put your name or trade mark on a high-risk system already placed on the market – for example as a white-label solution for your customers.

Art. 25(1)(a)

Substantial modification

You substantially modify a high-risk system and it remains high-risk – for example through your own retraining that changes performance or purpose.

Art. 25(1)(b)

New intended purpose

You use a system that was not high-risk in a way that makes it high-risk – such as a general assistant for pre-screening job applications.

Art. 25(1)(c)

The third case in particular is underestimated: using a general AI tool for an Annex III purpose can suddenly put the full provider list on you. Check new purposes in advance.

Free template

High-risk checklist as Excel – free, no sign-up

The same list as above, prepared for teamwork: one sheet each for providers and deployers, with columns for owner, status and due date, plus a sheet with all deadlines.

“Providers” sheet with 17 obligations
“Deployers” sheet with 14 points
Status picker and date fields
“Deadlines” sheet and guide

SimpleAct_High_Risk_AI_Checklist_EN.xlsx

Excel (.xlsx) · status 4 October 2026

Download the Excel checklist

Approach

Implementation in seven steps

How to tackle the checklist without getting lost. The order is a recommendation; providers typically need far more lead time for documentation, quality management and conformity assessment than deployers.

1
Inventory your AI systems
No overview, no classification. Record all AI systems with purpose, provider and area of use in an AI inventory.
2
Classify and clarify your role
Is the system high-risk? Are you provider or deployer – or do you become a provider under Art. 25? Document the result.
3
Appoint owners
One owner per system, plus people responsible for oversight, logs, data protection and incidents.
4
Record the gaps
Work through the checklist per system and give open points a date. The Excel file helps with distribution.
5
Obtain or create documents
Providers create documentation and the declaration; deployers request instructions, declaration of conformity and log details from the provider.
6
Enable people
Train overseers, inform staff and workers’ representatives, prepare information for affected persons.
7
Monitor operation
Run monitoring, the incident process and log retention – and re-check the list whenever the system changes.

Common mistakes

Where implementation stalls in practice

Role misjudged

Anyone who adapts a system or sells it under their own brand quickly becomes a provider. The role check belongs at the start, not the end.

Waiting for 2027

Technical documentation and quality management are not created in three months. Contracts with providers should secure the documents now.

Oversight on paper only

A named person without training, time and authority does not meet Art. 26(2). Oversight needs competence and backing.

Logs at the provider forgotten

If the logs sit with the provider, access and retention must be agreed by contract – otherwise you can hardly meet your duty.

GDPR treated separately

DPIA, Art. 22 GDPR and information duties run in parallel. Planning them together avoids double work – the FRIA can build on the DPIA.

Changes not followed up

New versions, new data sources, new purposes: every change can affect documentation, risk assessment and even your role.

With SimpleAct

The checklist per AI system – with evidence instead of ticks

In SimpleAct you record your AI systems in the AI inventory, classify them by risk class and work through a compliance checklist per system that matches its risk class. On top, a library of 19 controls along the EU AI Act lets you store status and evidence links per system.

In a pilot project, six AI systems – one of them high-risk – were recorded and assessed in around four hours.

AI inventory with role, purpose and provider
Risk classification per system
Compliance checklist per risk class
19 controls with status and evidence links
DPIA and record of processing in the GDPR module (from Professional)

View the AI inventory software

Open-Source Framework

simpleact-ai-act-checklist

Open-source checklist of all EU AI Act requirements under Art. 8–15 for high-risk AI systems – with article references and evidence guidance.

View on GitHub

FAQ

Frequently asked questions about the high-risk AI checklist

After the Digital Omnibus (Regulation (EU) 2026/1744), the obligations for high-risk AI under Annex III apply from 2 December 2027 and for AI in products under Annex I from 2 August 2028. Originally, 2 August 2026 and 2 August 2027 were planned. Prohibitions (Art. 5) and AI literacy (Art. 4) have applied since 2 February 2025.

Deployers must use the system in line with the instructions, assign human oversight to competent people, ensure relevant input data (where under their control), monitor operation, pass on incidents, keep logs for at least six months and inform staff and affected persons (Art. 26). Certain deployers must also carry out a fundamental rights impact assessment (Art. 27).

Art. 16 bundles them: meet the requirements for the system in Art. 8 to 15 (risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness, cybersecurity), a quality management system, keeping documentation and logs, conformity assessment, declaration of conformity, CE marking, registration, corrective actions and accessibility.

For most Annex III systems, no: for Annex III points 2 to 8, Art. 43(2) provides for internal control under Annex VI without a notified body. Only biometric systems (point 1) may need a notified body. For AI in products under Annex I, the conformity assessment procedure of the relevant product legislation applies.

Providers register themselves and Annex III systems in the EU database before placing them on the market (Art. 49(1)), except Annex III point 2 (critical infrastructure). This also applies if the provider relies on the Art. 6(3) exemption (Art. 49(2)). Deployers only register their use if they are public authorities or Union bodies (Art. 49(3)).

Providers and deployers keep automatically generated logs under their control for a period appropriate to the intended purpose of at least six months, unless other law – such as data protection law – provides otherwise (Art. 19(1), Art. 26(6)).

Under Art. 27, deployers that are bodies governed by public law or private entities providing public services, and deployers of systems for creditworthiness assessment and for risk assessment and pricing in life and health insurance (Annex III point 5(b) and (c)). Systems for critical infrastructure (Annex III point 2) are excluded. An existing DPIA can be built on.

A serious incident is an incident or malfunction leading to death or serious harm to health, serious and irreversible disruption of critical infrastructure, infringement of obligations protecting fundamental rights, or serious harm to property or the environment (Art. 3(49)). Providers report no later than 15 days after becoming aware, in certain cases within 2 or 10 days (Art. 73). Deployers inform the provider first, without delay (Art. 26(5)).

Yes. SMEs, start-ups and small mid-caps may provide the technical documentation in simplified form using a Commission form (Art. 11(1)), implement the quality management system in proportion to their size (Art. 17(2)), and for fines the lower amount applies (Art. 99(6)). The obligations themselves remain.

The Annex III page answers whether a system is high-risk – with all areas, use cases and the test for the exemption. This checklist answers what to do next: obligations by role, evidence and deadlines to tick off and as an Excel file.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

Last reviewed on 4 October 2026 · SimpleAct editorial team

This page, the checklist and the Excel file are a simplified overview and do not constitute legal advice. The text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 is authoritative. The approach, examples and points marked as recommendations are not legal obligations.

Changes to this page

4 October 2026 – Rebuilt: interactive checklist by role with task list, free Excel file, evidence and deadline tables, role change under Art. 25, status after the Digital Omnibus. Deployer obligations added; categories now point to the Annex III page.
23 May 2026 – First version with obligations from Art. 8 to 18.

Keep high-risk obligations in view, system by system

AI inventory, classification, checklist and evidence in one place – for providers and deployers.

Book a demo Try 7 days (credit card required)