ComplianceSME · Free EU AI Act checker

Free EU AI Act compliance tool

ComplianceSME builds self-serve compliance systems for small and medium businesses, and the EU AI Act system, B-001, carries the whole of Regulation (EU) 2024/1689 in one run. This checker is the free front door to it. Answer four short steps, about one minute, and the page assembles your duty card: your role under the Act, your duties with their article citations and dates, your timeline and your next steps. Nothing is stored, no account is needed, and no email address is asked for. The card prints on one page.

Most published guidance still tells businesses that the high-risk duties start on 2 August 2026. Article 113, third paragraph, now sets those dates at 2 December 2027 and 2 August 2028. This checker uses the current text.

Regulation (EU) 2026/1744, the Digital Omnibus on AI, was published on 24 July 2026 and entered into force on 27 July 2026. The application dates for the high-risk requirements now sit in Article 113, third paragraph.

Those dates are 2 December 2027 for AI systems classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for AI systems classified as high-risk under Article 6(1) and Annex I. A great deal of published material was written against an earlier reading and tells businesses that the high-risk duties start on 2 August 2026. They do not. The confusion is the reason this page carries a date stamp.

Two dates moved forward rather than back. Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), apply from 2 December 2026. They prohibit AI systems that generate or manipulate non-consensual intimate material and child sexual abuse material, and they require providers whose systems could produce that material as a foreseeable outcome to put safeguards in place.

2 August 2026 is the general date of application of the Regulation under Article 113. For a normal small business the practical content of that date is Article 50, the transparency duties.

• Article 50(1). Providers of AI systems intended to interact directly with natural persons design them so that people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person.
• Article 50(2). Providers of AI systems, including general-purpose AI systems, that generate synthetic audio, image, video or text mark the outputs in a machine-readable format and make them detectable as artificially generated or manipulated, using effective, interoperable and reliable technical solutions as far as technically feasible.
• Article 50(3). Deployers of emotion recognition systems or biometric categorisation systems inform the natural persons exposed to the system of its operation, and process personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680.
• Article 50(4). Deployers of AI systems that generate or manipulate image, audio or video content constituting a deep fake disclose that the content has been artificially generated or manipulated.
• Article 50(5). The information required by Article 50(1) to (4) is given in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, and conforms to applicable accessibility requirements.

Article 111(4) gives one transitional allowance. Providers of systems generating synthetic content that were placed on the market before 2 August 2026 have until 2 December 2026 to meet the Article 50(2) marking duty. Systems placed on the market on or after 2 August 2026 receive no transitional period.

Two duties are already live and have been since 2 February 2025, when Chapters I and II began to apply. Article 4 requires providers and deployers to take measures supporting the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. Article 5 prohibits a defined set of practices outright, including AI systems that infer emotions of a person in the workplace or in education institutions except for medical or safety reasons, and biometric categorisation systems that deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.

The EU AI Act compliance system is the complete instrument in one run. It carries the full obligation register, taken word for word from Regulation (EU) 2024/1689, and it is built to take a person who has never read the Act to a completed, cited compliance report in one session. It teaches as it goes, step by step, one question at a time, in your own Claude account. Its first module is AI literacy training, which is the Article 4 duty this checker names, so the training obligation is discharged before the compliance work begins. Your reports are produced at the end, with article citations.

£3,000, one purchase, yours. ComplianceSME monitors the instrument and issues update files through the membership when the law changes.

Start the free assessment See the EU AI Act system

We use ChatGPT and Microsoft Copilot at work. Does the EU AI Act apply to us?

If your business is established in the European Union, or the output of your AI is intended for use in the Union, the Regulation reaches you. Using ChatGPT or Microsoft Copilot at work makes your business a deployer. Article 4 then requires you to take measures supporting the AI literacy of your staff and of other persons operating those systems on your behalf. That duty has applied since 2 February 2025.

What applies on 2 August 2026?

2 August 2026 is the general date of application set by Article 113. The Article 50 transparency duties start on that date: telling people they are interacting with an AI system, marking synthetic audio, image, video and text, informing people exposed to emotion recognition or biometric categorisation, and disclosing deep fakes. National authorities can enforce those duties with fines from that date.

What is the difference between a provider and a deployer?

A provider takes responsibility for placing an AI system on the market or putting it into service. A deployer uses an AI system under its own authority, outside personal non-professional activity. Article 25(1) turns a deployer into a provider where it puts its own name or trademark on a high-risk system, makes a substantial modification to one, or changes an intended purpose so that the system becomes high-risk.

Are the high-risk obligations delayed?

The high-risk requirements in Chapter III, Sections 1, 2 and 3 do not start on 2 August 2026. Article 113, third paragraph, sets 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for systems classified under Article 6(1) and Annex I. Guidance written before the current text of Article 113 gives the earlier date and is out of date.

What are the penalties under the EU AI Act?

Recitals 168 and 169 record the ceilings. Breach of the Article 5 prohibited practices carries up to EUR 35,000,000 or 7 per cent of total worldwide annual turnover, whichever is higher. Other operator breaches carry up to EUR 15,000,000 or 3 per cent. Supplying incorrect, incomplete or misleading information to authorities carries up to EUR 7,500,000 or 1 per cent. For SMEs, including start-ups, each fine is capped at the lower of the two figures.

Does the system cover the Article 4 AI literacy training requirement?

Yes. The first module of every ComplianceSME system is AI literacy training, and it runs before any compliance work begins. Article 4 requires providers and deployers to take measures supporting the AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf. Running the module and keeping the record is how the Article 4 duty is met.

More free from ComplianceSME: Free assessment · GDPR toolkit · Companies Act 2006 library · EU AI Act system