Audit Your AI Compliance

Do you have a written list of every AI tool in use, including staff using public tools on their own?

You can’t govern what you can’t see. "Shadow AI" is the #1 blind spot.

Have you checked whether any use is high-risk under Annex III (e.g. hiring/HR, credit scoring, biometrics, education assessment, critical infrastructure)?

High-risk carries the heaviest obligations. Most SMB uses are lower-risk, but you must confirm, not assume.

None of your AI does social scoring, emotion recognition of staff at work, manipulative/subliminal targeting, or untargeted face-scraping?

These are already illegal (since Feb 2025), and the Digital Omnibus added one more: AI that generates non-consensual intimate imagery or CSAM (fully biting by Dec 2026). A single "No" here is urgent regardless of your total.

Since Feb 2025 you have a duty to support your staff in developing "sufficient AI literacy." Do you have any training or policy in place?

Read this one carefully, because the market is lying to you about it. The Omnibus softened Article 4 from "ensure" to "support": it is an obligation of effort, not of result. The published text says it outright: "This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual." (Art. 4, as amended by Regulation (EU) 2026/1744). So: no mandated format, no certificate, no measurable level, no approved provider. Do it because untrained staff are your real risk, not because an inspector is coming. Anyone selling you a "mandatory AI Act certification" is selling you fear.

Where AI chats with customers, or generates text/images/audio/video, do you clearly disclose it (and label synthetic/"deepfake" content)?

Article 50 transparency duties apply broadly from Aug 2026. If your system was already live before then, the machine-readable content-marking part gives you until Dec 2026. This is the near-term deadline that actually has teeth.

For any consequential decision AI helps make, can a competent human understand, review, and override it?

"The system decided" is not a defence. Human-in-the-loop is the core of trustworthy AI.

Do your AI uses have a lawful basis, data minimisation, and (where needed) a DPIA, and do you avoid pasting confidential or personal data into public AI tools?

The AI Act sits on top of GDPR; both still apply, including rules on automated decisions (Art. 22).

For third-party and general-purpose AI (ChatGPT, Claude, Copilot, etc.), do you know each vendor's data handling and your own duties as a deployer?

Using someone else’s model doesn’t outsource your responsibility.

Is there a named person responsible for AI, a simple acceptable-use policy, and a basic record of decisions and monitoring?

If challenged, "we had it under control" needs evidence. Lightweight documentation is enough to start.

Do you have a concrete plan to close your gaps: transparency & GPAI from Aug 2026, and high-risk (Annex III) by Dec 2027 if any of your uses qualify?

The near-term pressure with real teeth is transparency. Literacy is a soft duty. Do it anyway, because it's cheap and untrained staff are your actual risk. High-risk got more runway, so use it, don't ignore it.