Home / EU AI Compliance

EU AI Compliance

Resources for people who build, sell, deploy, audit or govern AI systems that touch the EU. The pages map the AI Act, GDPR and related EU laws, guidance and standards to the wiki's control library and test cases. The GCC AI Compliance section does the same for the Gulf states.

Verification required. Everything in this section about laws, dates, article numbers and penalties was compiled on 7 October 2026 from two kinds of source. The first is secondary web sources (law-firm notes, vendor blogs and research notes), which disagree in places. The second is memory of the text of Regulation (EU) 2024/1689 and related laws. The Official Journal text was not read, and the Digital Omnibus may have amended some provisions. Check EUR-Lex before relying on any claim. This is not legal advice.

What is in this section

Part	Pages	What it holds
EU AI Regulatory Hub	1	The AI Act timeline, risk tiers, roles and high-risk obligations, plus 18 related instruments, each mapped to wiki controls and tagged with its verification status.
Role guides	4	What to do and what to keep as evidence, for practitioners, product companies, auditors and implementors.
Templates T01 to T12	12	Fill-in documents: system classification, impact assessment, supplier addendum, transfer record, incident workflow, transparency notice, literacy record, audit checklist, inventory, technical documentation index, authority log and general-purpose AI model checklist.
EU drivers for AI-CTRL-041 and AI-CTRL-042	1	The EU instruments behind the controls on impact assessment and on fairness, with their templates and test cases.
EU Regulatory Crosswalk and EU Evidence Register	2	The instrument-to-control map and a starter evidence list, each also downloadable as a CSV file.

How claims are tagged

Tag	Meaning
[Verified]	The point stated was checked against the primary text at the URL given, on the date given. The text was read with a retrieval tool and not line by line, so confirm the wording before you cite it.
[Reported]	Stated by secondary web sources. Verify before relying on it.
[Recalled]	Stated from memory of the legal text and not re-checked. Verify the article on EUR-Lex before citing it.
[Conflict]	Secondary sources disagree. Resolve from the primary text.
[Unverified]	Single source, or not researched.

The templates are working documents, not regulator-approved forms. Where a template cites an article, treat that as a pointer to check.

AI Act dates have moved

The Digital Omnibus on AI is Regulation (EU) 2026/1744 of 8 July 2026. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026 [Verified]. It moved the high-risk dates: Annex III systems to 2 December 2027, and Annex I product-embedded systems to 2 August 2028 [Verified]. See section 2 of the hub.

Where to start

If you are	Read	Then use
A data scientist, ML or security engineer	Guide for AI Practitioners	T01, T02, T10
A provider or SaaS vendor selling into the EU	Guide for AI Product Companies	T01, T10, T12, T06
An internal or external auditor	Guide for Auditors	T08, EU Evidence Register
A programme lead, GRC lead, CISO or DPO	Guide for Implementors	EU AI Regulatory Hub, T09, T07

Using the templates

Templates T01 to T12 are fill-in documents. To reuse one, open the page, follow the "Suggest an edit to this page" link in the footer to reach its Markdown source on GitHub, and copy it into your own repository or document tool.

Keeping this section current

The AI Act timeline is still moving. Re-check the hub every month until the standards and guidelines settle. When you confirm an instrument against its primary text, record the primary URL and the retrieval date beside it in the EU Regulatory Crosswalk.

Pages in This Section

EU AI Regulatory HubEU AI Act timeline, risk tiers, roles and high-risk obligations, with GDPR, NIS2, DORA, CRA and standards mapped to AI security controls. Guide for AI Practitioners Working Under EU RulesWhat EU rules ask of the people who build AI: role and tier, engineering requirements by AI Act article, a lifecycle checklist and evidence to keep. Guide for AI Product Companies Selling into the EUFor AI vendors selling into the EU: whether the AI Act reaches you, product classification, buyer questions, a go-to-market checklist and contract points. Guide for Auditors of AI Systems Under EU RulesFor auditors of AI systems under EU rules: setting criteria, scoping, tests by control family, sampling, common findings and report wording. Guide for Implementors: Building an EU AI Governance ProgrammeFor programme leads, GRC teams, CISOs and DPOs: what applies when, a 90-day plan, RACI, early decisions, maturity steps and metrics under EU rules. EU Drivers for AI-CTRL-041 and AI-CTRL-042The EU instruments behind AI-CTRL-042 on fundamental rights and data protection impact assessment and AI-CTRL-041 on fairness, with templates and test cases. EU Regulatory CrosswalkEU instruments mapped one per row to AI security controls and control themes, with verification status. Also available as a CSV file. EU Evidence RegisterStarter list of 31 evidence items an auditor would request for an AI system under EU rules, by control family. Also available as a CSV file. T01 AI System Classification (Role and Risk Tier)Fill-in form to classify an AI system under the EU AI Act: prohibited-practice screen, provider or deployer role, risk tier, GDPR flags and next steps. T02 Impact Assessment (FRIA and DPIA Combined)Combined fill-in form for a GDPR data protection impact assessment and an AI Act fundamental rights impact assessment of an AI system. T03 Supplier Due-Diligence EU AddendumQuestions to add to a third-party questionnaire for AI suppliers under EU rules: role, conformity documents, data and transfers, security and exit. T04 Data Location and International Transfer RecordFill-in record of where each AI data component is stored and processed, the transfers outside the EEA, their mechanisms and who signs for them. T05 AI Incident and Breach Reporting Workflow (EU)AI incident types, a reporting matrix across GDPR, the AI Act, NIS2, DORA and the CRA, and a ten-step response workflow to complete in advance. T06 Transparency Notice (AI Act Article 50 and GDPR)Draft AI transparency notice: short notice, full GDPR notice elements, AI Act Article 50 disclosures and labels, and a publication checklist. T07 AI Literacy Programme RecordRecord of an AI literacy programme under AI Act Article 4: role groups and needs, modules, completion records and effectiveness checks. T08 AI Audit Checklist (EU)Audit checklist of 52 tests across ten areas under EU rules, from governance and classification to provider and deployer duties and incidents. T09 AI System Inventory (EU)Column definitions, a CSV header row and maintenance rules for an inventory of AI systems that records AI Act role, risk tier and applicable date. T10 Technical Documentation Index and Conformity ChecklistReadiness index for high-risk AI providers: technical file sections, data governance, logging, human oversight, QMS and the conformity route. T11 Authority and Standards Engagement LogRegister of EU and national authorities, a log of contacts with them, and a watchlist of pending AI Act guidelines, standards and dates. T12 General-Purpose AI Model ChecklistChecklist of AI Act duties for providers of general-purpose AI models, including systemic-risk models, and for teams that build on one.