The EU AI Act is the world's first comprehensive law governing artificial intelligence, and in 2026 its obligations are landing in phases on any organization that builds or deploys AI touching the European market. Whether you are a European company or a US firm with EU users, the practical question is the same: can you demonstrate, with evidence, how your AI systems are governed? This checklist is a pragmatic starting point — not legal advice, but the operational groundwork most teams need.
What the EU AI Act is (in one paragraph)
The Act regulates AI by risk, not by technology. The higher the potential for harm, the stricter the obligations. It applies extraterritorially: if your AI system's output is used in the EU, the Act can reach you regardless of where you are based. Penalties are significant — for the most serious violations, up to the greater of tens of millions of euros or a percentage of global annual turnover — which is why boards are paying attention.
The four risk tiers
| Tier | Examples | What it means for you |
|---|---|---|
| Unacceptable | Social scoring, manipulative or exploitative systems | Banned. Do not build or deploy. |
| High-risk | AI in hiring, credit, education, critical infrastructure, medical devices | The heavy obligations live here: risk management, data governance, logging, human oversight, documentation. |
| Limited-risk | Chatbots, generative AI, deepfakes | Transparency duties — tell people they are interacting with AI or that content is AI-generated. |
| Minimal-risk | Spam filters, AI in games | Largely unregulated; voluntary codes of conduct encouraged. |
Most enterprise deployments of general-purpose models fall into limited-risk (transparency) unless they are used for a high-risk purpose — but the moment you point that chatbot at hiring, lending, or another regulated decision, you inherit the high-risk obligations.
Who it applies to
The Act distinguishes providers (who develop AI systems) from deployers (who use them). Most enterprises are deployers, and deployers have real duties too: using systems as intended, ensuring human oversight, monitoring operation, and keeping the logs the system generates. If you fine-tune or substantially modify a model, you may cross into provider territory.
A practical compliance checklist
- Inventory your AI. You cannot govern what you cannot see. Build a register of every AI system and feature in use — including the "shadow AI" employees adopted without approval — and classify each by risk tier.
- Add transparency where required. Disclose AI interaction to users and label AI-generated content. This is the most broadly applicable obligation.
- Establish human oversight. For consequential decisions, ensure a person can review, override, or halt the AI — and that they have the information to do so meaningfully.
- Keep records and logs. The Act expects traceability. You need durable, tamper-resistant logs of AI activity: what was asked, what was returned, who was involved, and when.
- Govern your data. Know what data flows into your models, prevent sensitive or prohibited data from leaving your control, and document your data-handling.
- Manage risk continuously. Risk assessment is not a one-time gate. Monitor deployed systems for drift, misuse, and new failure modes, and review periodically.
- Assign accountability. Name an owner. Regulators want to see that someone is responsible for AI governance, with authority to act.
Compliance is, in practice, an evidence problem. When a regulator or auditor asks "show me," the difference between a good day and a bad one is whether you can produce the records on demand.
The controls that do the heavy lifting
Read the checklist again and a pattern emerges: nearly every item reduces to visibility, control, and records over your AI traffic. That is precisely what a governance gateway delivers. Routing AI requests through a single control point gives you the inventory (every call is seen), the transparency and oversight hooks (policy and human approval in-path), the data governance (DLP and residency controls), and — critically — the tamper-evident audit trail that turns "we take compliance seriously" into "here is the evidence."
WeeBie Monitor was built around this reality. It meters and logs every AI interaction to a hash-chained audit record, enforces guardrails and human-in-the-loop approvals, keeps regional traffic on regional models, and generates evidence reports mapped to frameworks including the EU AI Act, GDPR, and SOC 2. The Act does not require you to stop using AI — it requires you to prove you use it responsibly. That proof is a system you put in place now, not a document you scramble to assemble later.