Define the system
Start by naming the AI feature, users, decision impact, data categories, vendors, and the team member responsible for maintaining the review record.
High-risk checklist
EU AI Act High-Risk Checklist
Use this checklist when an AI feature may affect safety, rights, eligibility, access, employment, education, public services, law enforcement, migration, courts, or democratic processes.
Disclaimer: This checklist is a practical starting point for internal review. It is not legal advice and does not determine your final regulatory classification.
Step 1: classify the use case
| Question | What to record |
|---|---|
| What is the intended purpose? | Write the product task, user group, decision context, and expected output. |
| Is the system a safety component? | Check whether it is part of a regulated product or safety-related workflow. |
| Does it match an Annex III area? | Screen employment, education, essential services, biometrics, public services, law enforcement, migration, courts, and democratic processes. |
| Does it make or influence consequential decisions? | Note whether people can lose access, ranking, opportunity, services, money, or rights. |
| Can a human meaningfully review the output? | Describe the reviewer role, override path, escalation rule, and timing. |
Step 2: prepare the evidence file
- Risk management process and known foreseeable misuse.
- Training, validation, and testing data description where relevant to your role.
- Accuracy, robustness, cybersecurity, and monitoring notes.
- Human oversight instructions and escalation thresholds.
- Logging or record-keeping approach for important decisions.
- User instructions, limitations, and transparency materials.
- Post-market monitoring or customer feedback process.
Step 3: decide the launch lane
| Result | Recommended product action |
|---|---|
| No high-risk signal | Keep a dated classification memo and still check transparency obligations. |
| Possible Annex III signal | Pause self-serve launch, gather evidence, and ask for specialist review. |
| Clear high-impact decision support | Build human oversight, documentation, monitoring, and customer controls before release. |
| Prohibited-practice signal | Stop the use case and redesign before testing with real users. |
Use the documentation template
Official sources
Last reviewed: July 3, 2026.
- EU AI Act Article 6: high-risk classification rules
- EU AI Act Annex III: high-risk use areas
- EU AI Act Article 9: risk management system
- EU AI Act Article 14: human oversight
- European Commission: guidelines on high-risk AI systems
practical AI compliance self-assessment
Practical notes for EU AI Act High-Risk Checklist
EU AI Act High-Risk Checklist | Product Review Guide is maintained for founders, product managers, compliance owners, agencies, and small teams building AI workflows who need AI governance workflow. The goal is to help visitors complete a real task and leave with an AI inventory, risk note, disclosure draft, vendor question set, policy outline, or review workflow report, not only read a generic summary.
Separate triage from advice
Use the generated output as first-pass operational triage. Legal, medical, hiring, credit, education, biometric, and public-sector uses still need specialist review.
Keep evidence
Save the output, assumptions, date, source links, and reviewer notes so the team can explain why a risk level, disclosure, or vendor question set was chosen.
Before relying on this page
- Review high-impact use cases manually.
- Keep policies and disclosures aligned with the real product behavior.
- Re-run the workflow when vendors, data, or user impact changes.
Review record
How to use EU AI Act High-Risk Checklist in an AI compliance file
A compliance tool is useful when it leaves a traceable record. The output should name the AI system, explain the assumptions, and show what the team still needs to verify with product, legal, security, or vendor owners.
Describe the real system
Record the feature name, user group, decision impact, data sources, vendor dependencies, and the human owner. A generic "chatbot" label is rarely enough. A hiring assistant, support summarizer, medical triage bot, and product recommender can have very different risk profiles even if they all use language models.
Separate signal from conclusion
Treat this page as first-pass triage. It can flag high-risk areas, transparency duties, missing evidence, and questions to ask a vendor. It should not be treated as legal approval, clinical advice, hiring approval, credit approval, or permission to launch without human review.
Save evidence and changes
Save the generated result with the date, reviewer, source links, and unresolved questions. Update the record when the model, data, users, product flow, vendor, or region changes. This keeps the site useful for actual operators rather than only being a static explanation page.
Evidence checklist
- Document what the AI system does and what it does not do.
- Record whether the system influences employment, education, credit, public benefits, healthcare, biometric identification, safety, or other high-impact outcomes.
- Keep vendor documentation, model notes, data descriptions, user notices, human oversight notes, and monitoring plans together.
- Re-run the review when the product behavior changes, not only when the law changes.
- Use specialist review for high-impact or regulated workflows before relying on any generated text.