Part A · Your role
Where do you sit in the AI value chain?
The Act assigns different obligations to providers and deployers. Most organizations are deployers and underestimate what that still requires.
Which best describes your organization?
Art. 3 definitions
Part B · Risk classification
What kind of AI are you running?
Obligations scale with risk. Answer for every AI use case you know of, including pilots and vendor embedded features.
Do any use cases involve social scoring, emotion recognition in the workplace or education, biometric categorization by sensitive attributes, untargeted facial image scraping, or manipulation of vulnerable groups?
Art. 5 · Prohibited practices · In force since 2 Feb 2025
Do any systems operate in these domains: recruitment or HR decisions, credit scoring, access to essential services, education admissions or evaluation, critical infrastructure, or safety components of regulated products?
Art. 6 + Annex III · High-risk classification
Do you run customer facing chatbots, generate synthetic content, or use AI generated media in communications?
Art. 50 · Transparency obligations
Part C · Governance readiness
What is actually in place today?
Ten controls that regulators, auditors, and enterprise customers will ask about. Answer honestly, the score is for you.
Priority gaps
Fix these first
Your timeline
Deadlines that apply to you
Want a second pair of eyes on this?
I led AI transformation programs at A.P. Moller Maersk for over a decade, including production AI agents delivering USD 9M in annual savings. I write about enterprise AI governance and EU AI Act implementation on this site. Reach out if you want to compare notes on your readiness plan: denisabaluta@gmail.com or find me on LinkedIn →