Free EU AI Act Flash Audit

⚠️ Section 0: IMMEDIATE ACTIONS (Critical Priority)

These questions are binary pass/fail - failure requires immediate remediation

CRITICAL Q0

Have you verified that NONE of your AI systems engage in prohibited practices under Article 5?

Prohibited AI practices include:

Subliminal manipulation causing harm
Exploitation of vulnerable groups
Social scoring by public authorities
Real-time remote biometric identification in public spaces (with limited exceptions)
Emotion recognition in workplace/education
Biometric categorization inferring sensitive attributes

YES NO

CRITICAL Q1

Do you have an AI Literacy training program for staff who operate or interact with AI systems?

Article 4 requires providers and deployers to ensure sufficient AI literacy among staff. This includes understanding how AI systems work, their capabilities and limitations, and potential risks. Training should be proportionate to the role and risk level of the AI systems used.

YES NO

Section 1: MAPPING & IDENTIFICATION

Maximum 9 points

3 POINTS Q2

Have you mapped ALL AI systems currently deployed or in development within your organization?

This includes internal tools, third-party SaaS with AI features, embedded AI in other software, and AI in development pipelines. A complete inventory is the foundation of compliance.

YES PARTIAL NO

3 POINTS Q3

Do you know the risk classification (Unacceptable, High-Risk, Limited, Minimal) for each AI system?

The EU AI Act classifies AI systems into risk tiers. High-risk systems (Annex III) include AI in employment, credit scoring, education, law enforcement, and critical infrastructure. Understanding your classification determines your compliance obligations.

YES PARTIAL NO

3 POINTS Q4

Do you maintain a registry of all AI suppliers and their compliance certifications?

As a deployer, you share responsibility for AI compliance. This registry should include provider names, AI system details, declared conformity assessments, and contractual compliance commitments.

YES PARTIAL NO

Section 2: HIGH-RISK SYSTEMS

Maximum 20 points — Skip if you have no high-risk AI systems

5 POINTS Q5

Have you conducted a Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems?

Article 27 requires deployers of high-risk systems to assess impact on fundamental rights before deployment. This includes assessing risks to privacy, non-discrimination, freedom of expression, and human dignity.

YES PARTIAL NO N/A

5 POINTS Q6

For AI used in HR & recruitment, is there meaningful human oversight before consequential decisions?

AI systems for recruitment, promotion, termination, or task allocation are high-risk. Human oversight means humans can understand, intervene, and override AI decisions. Automation bias must be actively mitigated.

YES PARTIAL NO N/A

5 POINTS Q7

Are automatic logs maintained for at least 6 months for high-risk AI systems?

Article 12 requires high-risk AI systems to have automatic logging capabilities. Logs must be kept for a period appropriate to the intended purpose—minimum 6 months for most deployers, longer in specific regulated sectors.

YES PARTIAL NO N/A

5 POINTS Q8

Have you verified your AI systems are free of discriminatory bias in training data and outputs?

Article 10 requires appropriate data governance for high-risk systems. This includes examining training data for biases, testing outputs across protected characteristics, and implementing bias mitigation measures.

YES PARTIAL NO N/A

Section 3: GOVERNANCE & TRANSPARENCY

Maximum 9 points

3 POINTS Q9

Do you label AI-generated synthetic content (images, audio, video, text) as artificially generated?

Article 50 requires that AI-generated content be disclosed. Users must be informed when they're interacting with AI or viewing AI-generated content, unless it's obvious or used for legitimate artistic/satire purposes.

YES PARTIAL NO N/A

3 POINTS Q10

Do you mark AI-generated text intended for public information with machine-readable markers?

For text published to inform the public on matters of public interest, machine-readable markers (metadata, watermarks) are required. This enables downstream detection and verification of AI-generated content.

YES PARTIAL NO N/A

3 POINTS Q11

Do you have a formal AI governance structure (policies, roles, review processes)?

ISO 42001 recommends establishing an AI Management System (AIMS) including documented policies, defined responsibilities, regular reviews, and continuous improvement processes. This governance foundation supports all EU AI Act compliance activities.

YES PARTIAL NO

Section 4: REGULATORY PREPARATION

Maximum 16 points

4 POINTS Q12

Have you appointed an AI Compliance Officer or equivalent responsible person?

While not explicitly required for all organizations, having a designated person responsible for AI compliance demonstrates governance maturity. This role coordinates compliance activities, liaises with regulators, and ensures accountability.

YES PARTIAL NO

4 POINTS Q13

Have you budgeted for conformity assessments and potential third-party audits?

High-risk AI systems require conformity assessments before market placement. Some categories require third-party notified body involvement. Budget planning ensures you can meet compliance deadlines without financial surprises.

YES PARTIAL NO

4 POINTS Q14

Are you prepared to register high-risk AI systems in the EU Database?

Article 71 establishes an EU database for high-risk AI systems. Providers and deployers must register systems before deployment. The database includes system descriptions, conformity information, and contact details.

YES PARTIAL NO N/A

4 POINTS Q15

Do you know who your relevant Competent Authorities and Market Surveillance Authorities are?

Each EU member state designates Competent Authorities to enforce the AI Act. Knowing your authorities is essential for incident reporting, queries, and demonstrating compliance. For cross-border operations, you may need to coordinate with multiple authorities.

YES PARTIAL NO

Free EU AI Act Flash Audit

Start Your Free Flash Audit

⚠️ Section 0: IMMEDIATE ACTIONS (Critical Priority)

Have you verified that NONE of your AI systems engage in prohibited practices under Article 5?

Do you have an AI Literacy training program for staff who operate or interact with AI systems?

Section 1: MAPPING & IDENTIFICATION

Have you mapped ALL AI systems currently deployed or in development within your organization?

Do you know the risk classification (Unacceptable, High-Risk, Limited, Minimal) for each AI system?

Do you maintain a registry of all AI suppliers and their compliance certifications?

Section 2: HIGH-RISK SYSTEMS

Have you conducted a Fundamental Rights Impact Assessment (FRIA) for high-risk AI systems?

For AI used in HR & recruitment, is there meaningful human oversight before consequential decisions?

Are automatic logs maintained for at least 6 months for high-risk AI systems?

Have you verified your AI systems are free of discriminatory bias in training data and outputs?

Section 3: GOVERNANCE & TRANSPARENCY

Do you label AI-generated synthetic content (images, audio, video, text) as artificially generated?

Do you mark AI-generated text intended for public information with machine-readable markers?

Do you have a formal AI governance structure (policies, roles, review processes)?

Section 4: REGULATORY PREPARATION

Have you appointed an AI Compliance Officer or equivalent responsible person?

Have you budgeted for conformity assessments and potential third-party audits?

Are you prepared to register high-risk AI systems in the EU Database?

Do you know who your relevant Competent Authorities and Market Surveillance Authorities are?

Your EU AI Act Readiness Score

⚠️ CRITICAL: Immediate Action Required

Score Breakdown by Section

🎯 Top 3 Priority Actions

What's Next?