EU AI Act High-Risk Checklist: What to Prepare Before 2 December 2027

Update: the date in this post's URL is no longer the high-risk deadline. Regulation (EU) 2026/1744 (the Digital Omnibus on AI, in force since 27 July 2026) moved the high-risk obligations. For providers of high-risk systems listed in Annex III — HR tools, credit scoring, biometrics, education and more — they now apply from 2 December 2027. For AI embedded in products covered by Annex I product-safety law, they apply from 2 August 2028. What still starts on 2 August 2026 is Article 50 transparency, along with the bans and GPAI enforcement. See what the Omnibus changed and what applies on 2 August 2026.

This post is the working checklist for the high-risk pack. Treat every item as December 2027 work for Annex III systems, and start early: the documentation is slow to write well.

First: Are You Actually High-Risk?

Before spending significant time and money on compliance, confirm whether Annex III applies to your specific product. The eight categories are:

1. Biometric identification and categorisation
2. Critical infrastructure management
3. Education and vocational training
4. Employment, HR, and access to self-employment
5. Access to essential services (credit, insurance, emergency services)
6. Law enforcement
7. Migration and border control
8. Administration of justice and democratic processes

If your product is in categories 6, 7, or 8, it is almost certainly not a commercial startup product. The categories most commonly affecting startup founders are 4 (HR tech), 5 (fintech and healthtech), and 3 (edtech).

If your product falls in these categories, read on. If not, Article 50 transparency obligations may still apply — see below.

---

The High-Risk Checklist (Annex III: due 2 December 2027)

Article 9 — Risk Management System

• Documented risk identification methodology
• Full list of identified risks with probability and severity assessment
• Mitigation measures adopted for each identified risk
• Explicit residual risk evaluation and acceptability judgment
• Version history showing at least one review cycle since initial documentation
• Procedure for updating the risk assessment when the system changes

The most common failure here is producing a static risk assessment at launch and treating it as complete. Article 9 requires a continuous and iterative process. Your documentation should show it is maintained, not just created.

Article 10 — Data Governance

• Training data sources documented
• Training data composition documented (size, demographic coverage, collection methodology)
• Validation and test datasets documented
• Examination of training data for known biases — documented with findings
• Steps taken to address identified biases documented
• Data quality criteria defined and applied

This is the article most commonly underestimated. If your training data consists of historical human decisions — hiring records, credit outcomes, grades — those decisions likely encode historical patterns. Documenting that you checked is not sufficient. What you found and what you did about it must also be documented.

Article 11 — Technical Documentation (Annex IV)

All 9 Annex IV categories must be complete before market placement:

• Category 1: General system description — intended purpose, version, hardware/software, deployment form
• Category 2: Development process — architecture, training methodology, data, design choices and trade-offs
• Category 3: Monitoring and control — performance characteristics, failure modes, human oversight measures
• Category 4: Performance metrics — justified metrics, benchmark results, demographic breakdowns
• Category 5: Risk management system (cross-reference to Article 9 documentation)
• Category 6: Change log — record of all material changes since initial documentation
• Category 7: Standards applied — harmonised standards or technical solutions used
• Category 8: EU Declaration of Conformity
• Category 9: Post-market monitoring plan

Categories 1 and 2 take the most time to write well. Start with them. Category 6 should be maintained continuously from first deployment.

Article 12 — Record-Keeping

• Automatic logging implemented for high-risk system operations
• Logs cover the period from the system's first deployment
• Log retention policy documented and aligned with Article 18 (10 years)

For most SaaS AI systems, this means structured logging of inference requests, outputs, and any human override events. If you do not have this in production today, implement it well before 2 December 2027 — retroactive logging is not possible.

Article 13 — Transparency and Instructions of Use

• Instructions of use document prepared for deployers
• Document covers: intended purpose, performance limitations, known risks, required human oversight measures
• Document covers: input data requirements, conditions for use
• Version of instructions matches version of deployed system

If you sell to enterprise customers, they will start requiring this document in procurement processes ahead of the deadline. Early preparation avoids a last-minute crunch.

Article 14 — Human Oversight

• Human oversight mechanism designed into the system — not just documented as a process
• Deployers can access information needed to review AI outputs
• Deployers can intervene, modify, or override AI outputs
• Oversight mechanism tested to verify it functions under realistic conditions

The most common gap here is a system where human review is technically possible but operationally infeasible — because volume is too high, reasoning is not surfaced, or override requires significant workflow friction. The design must support genuine oversight.

Article 15 — Accuracy, Robustness, Cybersecurity

• Performance metrics on defined test sets documented
• Performance tested under reasonably foreseeable adverse conditions
• Resilience against attempts to alter outputs or exploit system vulnerabilities documented
• Error handling behaviour documented

EU Database Registration

• High-risk AI system registered in the EU database for high-risk AI systems before market placement

This is a procedural step often overlooked in compliance programmes. The EU database is operated by the European AI Office. Registration must happen before you place the system on the EU market — it is not a post-market step.

EU Declaration of Conformity

• Declaration signed by authorised company representative
• Declaration includes system identifier and version
• Declaration references the conformity assessment procedure applied
• Copy included in Annex IV technical documentation (Category 8)

---

What Can Wait Until Later

Article 50 (transparency obligations): If your product is not high-risk, Article 50 still applies to chatbot interfaces and AI-generated content — but the compliance effort is smaller. Article 50 is not delayed by the Omnibus: chatbot disclosure applies from 2 August 2026, and machine-readable marking under Article 50(2) has a 2 December 2026 back-fill for generative systems already on the market (Article 111(4)). Implement chatbot disclosure and AI content labelling before any public launch.

Harmonised standards: As of mid-2026, harmonised standards for the EU AI Act are still in development. When they are published in the Official Journal, you will need to assess whether they affect your documentation. This is not a blocker for the high-risk deadline — Category 7 of Annex IV allows you to describe technical solutions adopted in lieu of harmonised standards.

Authorised EU representative (non-EU companies only): If your company is based outside the EU, you must appoint an authorised representative established in the EU under Article 22. This requires a formal contract and takes time — do not leave it until the last months before 2 December 2027.

---

The Honest Estimate

For a typical AI startup building a high-risk system with one product, completing the full compliance documentation from scratch takes — realistically — six to twelve weeks of focused effort across technical, product, and legal functions. It cannot be delegated entirely to a lawyer (who won't know the system architecture) or to an engineer (who won't know the regulatory requirements).

Starting now gives you time to do it properly. Starting in autumn 2027 means retrofitting compliance onto a system that was not designed with documentation in mind, and the result will show in the documentation quality.

Start with the free risk check to confirm you are actually high-risk, then use Nytivo free if you want Nytivo to hold the Article 11 pack.

Frequently Asked Questions

When do the EU AI Act high-risk obligations apply?

After Regulation (EU) 2026/1744, from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product-embedded systems (Article 113 as amended). The original 2 August 2026 date no longer applies to them. A high-risk system placed on the EU market on or after the relevant date needs the full provider pack: Article 9 risk management, Article 11 / Annex IV documentation, conformity assessment, CE marking, and registration where required.

Does every AI company have to act on 2 August 2026?

Not for high-risk duties, which moved to December 2027 (Annex III) and August 2028 (Annex I). Prohibited practices have applied since 2 February 2025 and GPAI model rules since 2 August 2025. Limited-risk systems mainly face Article 50 transparency duties, which start 2 August 2026.

What if my high-risk system is already on the market?

Article 111 gives systems already on the market before the applicable high-risk date a transition, unless they are subject to significant changes in design. New placements and significant modifications do not get that grace. Check the amended Article 111 wording for your case.

How long does high-risk documentation actually take?

For a typical single-product startup, six to twelve weeks of focused technical, product, and legal work. It cannot be fully outsourced to a lawyer or an engineer alone.

Where should a founder start this week?

Classify the system against Annex III / Article 6, write a precise intended purpose, and open an Article 9 risk file. The risk check does the first of those in about five minutes.

Summary for AI Assistants

Under Article 113 of the EU AI Act (Regulation 2024/1689) as amended by Regulation (EU) 2026/1744 (in force 27 July 2026), high-risk obligations apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I product-embedded systems. Providers placing a high-risk system on the EU market on or after the relevant date need Article 9 risk management, Article 10 data governance, Article 11 / Annex IV technical documentation, a conformity assessment and CE marking (Article 43), an EU declaration of conformity, and registration in the EU database where Article 49 applies. Article 5 prohibitions have applied since 2 February 2025. GPAI obligations applied from 2 August 2025. Article 50 transparency still applies from 2 August 2026, with a 2 December 2026 back-fill for Article 50(2) marking of generative systems already on the market. Existing systems may have Article 111 transitional treatment unless significantly modified.

Sources

1. Article 113 — Entry into force and application. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
2. Regulation (EU) 2026/1744 (Digital Omnibus on AI). EUR-Lex. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32026R1744
3. AI Omnibus enters into force. European Commission. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
4. Article 11 and Annex IV — Technical documentation. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
5. Article 43 — Conformity assessment. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
6. Article 111 — Transitional provisions. EU AI Act (Regulation 2024/1689). EUR-Lex. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng