# EU AI Act readiness evidence checklist

Use this only after verifying current law and establishing a preliminary EU nexus and role.

## Inventory controlled values

- `article_50_status`: `not-assessed`, `pending-fact-review`, `potentially-applicable`, `controls-documented-not-tested`, `controls-tested-by-owner`, or `not-applicable-basis-pending-counsel`.
- `counsel_status`: `not-reviewed`, `review-requested`, `in-review`, `counsel-reviewed`, or `not-applicable-pending-basis`.

These are recorded workflow claims. The structural checker verifies spelling and presence only; it does not verify their factual or legal correctness.

## Inventory and accountability

- Unique system/model/use/version identifiers, owner, lifecycle state, jurisdictions, launch/change dates, and affected groups.
- Intended purpose, documented use-case screen, prohibited uses, foreseeable misuse, material modifications, degree of automation, human-oversight authority, and appeal/complaint paths.
- Provider/deployer/importer/distributor/product-manufacturer/authorised-representative/GPAI-provider role facts.
- Vendor/model chain, contracts, branding, modifications, data flow, classification confidence, and change-control/reassessment triggers.
- Named legal, risk, privacy, security, quality, procurement, and business owners.

## Universal and urgent screens

- Current AI literacy program tied to staff role, risk, context, and demonstrated competence.
- Article 5 screen with exact use facts and legal escalation.
- Worker, child, vulnerable-person, biometric, rights-impact, safety, and public-authority contexts.
- Other applicable law: GDPR, equality/employment, consumer, accessibility, copyright, cybersecurity, product safety, and sector/Member State rules.

## Article 50 transparency

- Provider/deployer role and exact paragraph(s) mapped.
- Disclosure timing, wording, prominence, accessibility, language, exceptions, and user testing.
- Machine-readable marking/detection controls and transition date where applicable.
- Deep-fake, public-interest text, emotion-recognition, or biometric-categorisation notices where applicable.
- Evidence that notices match the live system and are retained through changes.

## Potential high-risk systems

- Article 6 and Annex I/III basis, exceptions, intended-purpose facts, and counsel decision.
- Risk management across lifecycle and foreseeable misuse.
- Data governance, provenance, representativeness, bias testing, and lawful data handling.
- Technical documentation, instructions for use, logs/recordkeeping, versioning, and change control.
- Human oversight authority, competence, usability, testing, and override/escalation paths.
- Accuracy, robustness, cybersecurity, evaluation thresholds, monitoring, and incident response.
- Quality management, conformity route, declaration/marking, registration, authorised representative, and post-market monitoring as applicable.
- Deployer controls, input-data relevance, worker information, monitoring, log retention, and fundamental-rights impact assessment/notifications as applicable.

## GPAI models

- Provider status, placement date, open-source conditions, significant modification, and downstream role.
- Technical documentation and information supplied to downstream providers.
- Copyright-compliance policy and public training-content summary using the required template.
- Systemic-risk threshold/designation analysis, Commission notification, evaluations/adversarial testing, risk mitigation, incident reporting, cybersecurity, and energy information where applicable.
- Code-of-Practice use described accurately as a compliance aid, not automatic compliance.

## Evidence quality and sign-off

- Evidence names the exact system/version, owner, date, scope, result, exceptions, and retest trigger.
- Policies are tested against technical artifacts, logs, evaluations, interfaces, and user workflows.
- Each gap has an owner, due date, dependency, acceptance artifact, and verification method.
- Legal classifications and deadlines are reviewed by qualified counsel using current official sources.
- Reassessment triggers cover new use, model/version/vendor, geography, role, substantial modification, incident, and legal update.
- Time-based staleness is documented as an administrative threshold rather than a statutory deadline; any recorded trigger causes reassessment regardless of assessment age.
- `article_50_status` and `counsel_status` use the controlled vocabulary emitted by the checker; their values are inventory claims, not checker-verified legal conclusions.