EU AI Act Self-Test: 8 Questions to Know Where Your Company Really Stands
By Henry — 2026-11-08
Eight questions, ten minutes, and a clear view of what the EU AI Act already requires from you today and what can wait until 2027.
Most companies discuss the EU AI Act as if it were one date, one deadline, one project. It is none of those. Some obligations have applied since February 2025, others since August 2025, and the heaviest ones, on high-risk systems, were pushed back by the Digital Omnibus. The result is a lot of confusion, and a lot of teams that either panic or do nothing. This self-test gives you a quick, honest picture. Answer yes or no to eight questions. Each 'no' is a concrete action, not a vague worry. This is a work tool, not legal advice: have counsel confirm anything that touches your business model.
Where the deadlines stand
The AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in stages. Bans on prohibited practices and the AI literacy duty have applied since 2 February 2025. Rules for general-purpose AI models apply since 2 August 2025. In May 2026, EU institutions reached a political agreement on the AI Digital Omnibus: according to law firm analyses (Gibson Dunn, Winston & Taylor), high-risk obligations for stand-alone systems (Annex III) move from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI embedded in regulated products (Annex I). Watermarking of synthetic content (Article 50(2)) applies from 2 December 2026 for systems already on the market. Check the final published text before you lock a plan.
The key point: the delay concerns high-risk systems only. Everything else is already live or about to be.
The 8 questions
1. Do you have a list of every AI system used in the company?
You cannot classify what you have not found. Count the tools bought by IT, but also the AI features switched on inside your SaaS products, and the assistants employees use on their own. If the list lives in someone's head, the answer is no. First action: a shared register with tool, owner, purpose, data used, and vendor.
2. Have you checked that none of your uses is prohibited?
Since 2 February 2025 certain practices are banned: social scoring, manipulative techniques that cause harm, untargeted scraping of facial images, emotion recognition in the workplace and in education (with narrow exceptions), among others. Most companies have none of these, but a 'harmless' HR or customer tool can drift into emotion detection. Check each item of your register against the Commission's guidelines on prohibited practices.
3. Do you know whether you are a provider or a deployer?
Most companies are deployers: they use a system built by someone else. You become a provider if you build a system, put your name on one, or change its purpose in a way that makes it high-risk. The obligations are very different, so write down your role for each system.
4. Does any use fall into a high-risk area?
Annex III lists the sensitive areas: recruitment and worker management, credit scoring, access to education, essential public and private services, biometrics, among others. A CV-screening tool or a performance-scoring model is typically in scope. You have until December 2027 under the agreed delay, but documentation, human oversight and data quality are not built in a quarter. Start with the systems closest to people's careers, money or rights.
5. Have you trained the people who use AI?
Article 4 requires providers and deployers to ensure a sufficient level of AI literacy among their staff. It has applied since February 2025. There is no certificate to obtain: the expectation is training adapted to roles and the risks of the tools they use. A one-hour session for everyone plus a deeper one for power users, with attendance recorded, is a solid base.
6. Do users know when they face an AI?
Transparency duties under Article 50 cover chatbots (people must be told they interact with an AI), and synthetic content such as generated images, audio and video, which must be marked in a machine-readable way. Review your customer chatbot, your voice agents and your marketing content pipeline.
7. Do your AI vendors give you what you need?
Since August 2025, providers of general-purpose models have their own duties, including technical documentation and information for downstream users. Ask your vendors for it, and put it in the contract: documentation, incident notification, training data policy, hosting location. If a vendor cannot answer, that is information.
8. Does someone own AI governance, with logs and a human in the loop?
Regulators will ask who decides, who checks, and what is recorded. Name one accountable owner, define when a human validates an AI output, keep logs of what systems did, and set an incident path. This question is where most 'yes' answers quietly turn into 'no'.
How to read your score
- 7 to 8 yes: you are in good shape. Keep the register alive and review it every quarter.
- 4 to 6 yes: normal for a company that started in 2025. Fix questions 1, 2 and 5 first, they are the cheapest and already enforceable.
- 0 to 3 yes: no panic, but start this month. Begin with the register (question 1), everything else depends on it.
What is at stake
Fines are tiered (Article 99): up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for most other obligations including high-risk, and up to EUR 7.5 million or 1% for supplying incorrect information to authorities. For SMEs, the lower of the two amounts applies.
Enforcement will vary by Member State, but the legal exposure is real, and so is the commercial one: large customers are already adding AI Act clauses to their procurement questionnaires.
A 30-day plan
- Week 1: build the AI register and name an owner.
- Week 2: screen it against prohibited practices and Annex III.
- Week 3: launch role-based AI literacy sessions.
- Week 4: review chatbot disclosure, vendor documentation and logging.
Conclusion
The delay on high-risk rules is a breathing space, not an exemption. The companies that will be calm in December 2027 are those that build their register, their training and their governance now. Run the eight questions with your legal, IT and HR leads this week.
Related reading: Shadow AI: how to govern the tools your teams already use and Who is accountable when your AI agent acts alone? A governance guide.
Sources: Regulation (EU) 2024/1689; European Commission AI Act overview; Gibson Dunn, EU AI Act Omnibus Agreement; Winston & Taylor, AI Digital Omnibus.