EU AI Act Readiness Scorecard
10 questions covering EU AI Act Articles 4, 6, 9, 14, 26(9), 43, 50, 72 + GDPR DPIA. Answer yes / partial / no / not sure. End: signed compliance attestation + personalized gap list.
Have you formally classified your AI system's risk tier under EU AI Act Article 6 (prohibited / high-risk Annex III / limited / minimal)?
If you generate synthetic content (image / video / audio / text), do you embed C2PA + invisible watermark + perceptual fingerprint per the Code of Practice (effective 2 Aug 2026)?
If you're a public-sector deployer or fall under Annex III, have you completed an Article 26(9) Fundamental Rights Impact Assessment (FRIA)?
Is human oversight per Article 14 documented for your high-risk system (who oversees, how they intervene, escalation paths)?
Do you maintain a continuous Risk Management System per Article 9 (identification, analysis, evaluation, mitigation — updated across the lifecycle)?
If your AI processes personal data, have you completed a Data Protection Impact Assessment per the EDPB harmonised template (14 April 2026)?
Are your technical documentation (datasets, model cards, training logs, eval metrics) maintained as living documents the regulator could request?
Do you have a post-market monitoring plan + AI incident reporting flow per Article 72 (incidents reported within 15 days; deadly within 2 days)?
If high-risk, have you scoped a conformity assessment (self-assessment vs notified body) and identified your CE-marking path?
Have your staff completed AI literacy training per Article 4 (in force since 2 Feb 2025)?