Compliance Checklist

Follow Provider Instructions

Low effort

Read and follow the instructions that came with your AI tool. Use it only for its intended purpose.

Article 26(1)

Obtain and read instructions of use from provider Ensure system is used only for intended purposes Train staff on proper use Document that instructions are being followed

Assign Human Oversight

Medium effort

Assign a real person (or team) to oversee the AI. They must understand how it works and have the authority to override it.

Article 26(2)

Designate person(s) responsible for oversight Ensure oversight persons have appropriate competence Provide necessary training on the AI system Give oversight persons authority to override decisions Document oversight assignments and procedures

Input Data Relevance

Medium effort

Make sure the data you feed into the AI is relevant and appropriate for what you're using it for.

Article 26(4)

Assess input data quality and relevance Document data sources used Monitor for data drift or quality degradation Establish data quality procedures

Monitor Operation

Medium effort

Keep an eye on how the AI is performing. If something goes seriously wrong, report it to the AI provider and relevant authorities.

Article 26(5)

Establish monitoring procedures Define what constitutes a 'serious incident' Set up incident reporting process Keep records of monitoring activities Report serious incidents within required timeframe

Keep Logs

Low effort

Save the AI system's logs for at least 6 months. These are needed if there's an investigation.

Article 26(6)

Ensure automatic logs are being generated Store logs securely for minimum 6 months Implement log backup procedures Ensure logs are accessible for auditing

Inform Affected Persons

Low effort

Tell people when an AI is being used to make decisions about them. For example, if you use AI in hiring, candidates must know.

Article 26(7)

Identify all persons affected by AI decisions Create notification/disclosure mechanism Provide clear, accessible information about AI use Document notification procedures

Data Protection Impact Assessment

Medium effort

If your AI processes personal data in a high-risk way, you need a DPIA. Your AI provider should give you the information you need for this.

Article 26(9)

Determine if DPIA is required Obtain necessary information from AI provider Conduct DPIA following GDPR Article 35 requirements Implement measures to address identified risks Document DPIA and findings

Fundamental Rights Impact Assessment

Medium effort

If you're a public body or provide public services, you need an extra assessment of how your AI might affect people's fundamental rights.

Article 27

Determine if this requirement applies to your organisation Describe the deployer's processes using the AI system Describe the period and frequency of use Identify categories of persons and groups potentially affected Assess specific risks of harm to identified groups Describe human oversight measures Describe measures if risks materialise

Your Checklist

Follow Provider Instructions

Assign Human Oversight

Input Data Relevance

Monitor Operation

Keep Logs

Inform Affected Persons

Data Protection Impact Assessment

Fundamental Rights Impact Assessment

Get weekly compliance reminders

Behind schedule? We can fast-track your compliance.