EU AI Act — High-Risk System Assessment

Tasks in this template

1. 1
   Classify the AI system against Annex III and prohibited practices D+2

   Article 5 lists prohibited practices. Annex III lists high-risk areas. Verify the system does not fall under prohibited practices before proceeding.

2. 2
   Document the intended purpose and context of use D+4

   Article 6 and Annex III classification depends on the intended purpose. Mis-scoping is the most common compliance error.

3. 3
   Establish a risk management system throughout the AI lifecycle D+7

   Article 9: a risk management system must be established, implemented, documented, and maintained. It shall be a continuous iterative process planned and run throughout the entire lifecycle.

4. 4
   Implement data governance and management practices for training, validation, testing D+10

   Article 10: datasets shall be relevant, sufficiently representative, and to the best extent possible free of errors and complete.

5. 5
   Document dataset provenance, collection, and preparation processes D+14
6. 6
   Prepare the technical documentation required by Annex IV D+17

   Article 11 and Annex IV: technical documentation must be drawn up before the system is placed on the market and kept up to date.

7. 7
   Implement automatic logging and record-keeping over the system's lifetime D+21

   Article 12: high-risk AI systems shall technically allow for the automatic recording of events (logs) over the lifetime of the system.

8. 8
   Draft the transparency notice and instructions for use for deployers D+24

   Article 13: high-risk AI systems shall be designed to ensure operation is sufficiently transparent to enable deployers to interpret output and use appropriately.

9. 9
   Design and document human oversight measures D+28

   Article 14: human oversight shall aim at preventing or minimising risks to health, safety, or fundamental rights. Interfaces must support effective oversight.

10. 10
    Specify accuracy, robustness, and cybersecurity requirements and test results D+31
11. 11
    Establish a quality management system D+35

    Article 17: providers shall put a QMS in place, documented in written policies, procedures, and instructions. Required elements enumerated in Art. 17(1)(a)–(m).

12. 12
    Register the system in the EU database where applicable (Art. 49, 71) D+38
13. 13
    Conduct the conformity assessment procedure D+42

    Article 43: conformity assessment route depends on the risk category. Most Annex III systems use internal control (Annex VI); certain cases require notified-body involvement (Annex VII).

14. 14
    Prepare and sign the EU declaration of conformity D+45
15. 15
    Affix CE marking and ensure traceability D+49
16. 16
    Set up post-market monitoring and serious incident reporting D+52