Build your AI inventory
Catalog every AI system your organization develops, buys, or uses, including AI embedded in vendor software. Record purpose, data inputs, outputs, owners, and the people affected. You cannot comply for systems you don't know exist.
Classify each system by risk tier
Map every inventoried system to one of the four tiers. Screen first for prohibited practices, then check Annex I and Annex III for high-risk use cases, then transparency triggers. Document your reasoning, including for systems you conclude are not high risk.
Assess your role (provider, deployer, importer, distributor)
Your obligations depend on your role for each system. Note that putting your name on a system, substantially modifying it, or changing its intended purpose to a high-risk one makes you a provider.
Conduct a Fundamental Rights Impact Assessment (deployers of high-risk AI)
Public bodies, private entities providing public services, and deployers of credit scoring and life/health insurance AI must assess impacts on fundamental rights before first use, and notify the market surveillance authority of the results.
Implement the eight technical and governance requirements (high-risk AI)
Risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and robustness, and a quality management system. Complete the conformity assessment and affix the CE marking.
Register in the EU database (high-risk AI providers and certain deployers)
Providers must register Annex III high-risk systems in the EU database before placing them on the market. Public authority deployers must register their use.
Establish post-market monitoring
Actively collect and analyze performance data throughout the system's lifetime. Report serious incidents to authorities within the required timelines, as little as 2 days for widespread infringements.
Designate an EU representative (if outside the EU)
Providers established outside the EU must appoint an authorized representative in the Union by written mandate before making high-risk systems or GPAI models available on the EU market.
Need tier definitions? See risk tiers. Working to a date? See key dates.
Track every regulatory milestone in one place with the EU AI Act Deadline Tracker.
Compliance on paper vs. compliance in practice
Regulators will ask to see evidence that controls operated, not documentation that they were designed. Every high-risk system must produce logs, records, and audit trails demonstrating ongoing compliance.
Logs
Automatically generated event records for every high-risk system, retained for at least six months and traceable to specific outputs.
Audit trails
Evidence of who reviewed, approved, or overrode AI decisions, proving human oversight happened, not just that it was planned.
Incident records
Documented detection, investigation, and reporting of serious incidents and malfunctions, with corrective actions taken.
Trussed generates EU AI Act-mapped compliance evidence automatically from every governed AI interaction, no manual assembly.
See how it worksKnow where your AI systems stand before August 2026.
The 2-minute readiness assessment maps your AI deployments to the EU AI Act's risk tiers and shows where your compliance gaps are.