Reg. 2024/1689 · Annex III · 2027-12-02 deadline

EU AI Act high-risk checklist 24 steps to 2 December 2027

Regulation (EU) 2024/1689 obligations for Annex III high-risk AI systems become fully applicable on 2 December 2027. The earlier 2 August 2026 date was moved by Reg. (EU) 2026/1744, the Digital Omnibus on AI. This checklist is sourced from the EU primary documents, with exact Article references, applicability dates and fine thresholds. Last updated: 2026-08-14.

Request a free AI Act gap audit

30-min consultation

TL;DR

High-risk AI obligations apply from 2 December 2027, moved there by Reg. (EU) 2026/1744. Annex I product-embedded AI gets until 2 August 2028 (Art. 6(1)).
What already binds you: Article 50 transparency has applied since 2 August 2026, so chatbot disclosure and marking of generative output are live obligations today.
Maximum fine for prohibited practices: €35M or 7% of global turnover (Article 99(3)). High-risk non-compliance €15M / 3%.
Annex III (eight categories) covers credit scoring, insurance pricing, employment/HR and education scoring. Many SMEs are in scope and don't know it.
Article 5 (prohibited practices) has applied since 2025-02-02. Article 4 on AI literacy is now a duty to support literacy, not to guarantee it.
The 24-step checklist below maps to the EU primary sources (citations at the bottom).

Applicability timeline after the omnibus

Source: EUR-Lex Reg. (EU) 2026/1744, EUR-Lex 2024/1689 and the Commission regulatory framework page. Several secondary timeline pages, including artificialintelligenceact.eu, still show the pre-omnibus dates.

Date	Article	What becomes applicable
2024-08-01	Art. 113	Entry into force (no application yet)
2025-02-02	Art. 113(a), 4, 5	Prohibited AI practices and AI literacy obligation
2025-08-02	Art. 113(b), Ch. III §4, V, VII, 78, 99, 100	Notified bodies, GPAI, governance, penalties
2026-07-27	Reg. (EU) 2026/1744	Digital Omnibus on AI enters into force, timeline rewritten
2026-08-02	Art. 50	Transparency duties: chatbot disclosure, marking of synthetic content, deepfake labelling
2026-12-02	Art. 50(2), Art. 5	Grace period ends for marking output of systems already on the market, and for the new CSAM / NCII prohibition
2027-08-02	Art. 57(1), Art. 6(5)	Regulatory sandboxes, compliance date for pre-August-2025 GPAI models, Article 6 classification guidelines
2027-12-02	Ch. III §1-3 (Art. 8-27)	High-risk AI (Art. 6(2), Annex III) - full obligations
2028-08-02	Art. 6(1)	Annex I regulated-product embedded AI

Annex III - the 8 high-risk categories

Annex III item 1
Biometrics
Remote biometric ID (where not prohibited), emotion recognition, biometric categorisation.
Annex III item 2
Critical infrastructure
Digital infra, traffic, water, gas, heating, electricity safety components.
Annex III item 3
Education & vocational training
Admission, exam scoring, plagiarism detection, training allocation.
Annex III item 4
Employment & HR
Recruitment (CV screening), promotion, task allocation, monitoring, termination decisions.
Annex III item 5
Essential services
Credit scoring, insurance pricing, public/private benefits, emergency dispatch (911/112).
Annex III item 6
Law enforcement
Crime risk assessment, evidence evaluation, profiling, AI-based polygraph.
Annex III item 7
Migration & border
Visa applications, asylum, biometric border crossing, risk assessment.
Annex III item 8
Justice & democracy
Fact interpretation for judges/prosecutors, election influence detection.

Source: artificialintelligenceact.eu/high-level-summary.

Article 99: penalty thresholds

Maximum	For	Article
€35M or 7%	Prohibited AI practices (Art. 5)	Art. 99(3)
€15M or 3%	Provider/representative/importer/distributor/deployer/ transparency duties (Art. 16, 22-24, 26, 31, 33-34, 50)	Art. 99(4)
€7.5M or 1%	Inaccurate information to notified bodies / authorities	Art. 99(5)

For SMEs and start-ups the LOWER of the percentage and absolute amount applies - Art. 99(6).

Source: artificialintelligenceact.eu/article/99.

The 24-step checklist

01.
AI inventory
List every AI system in use or planned (own, vendor, GPAI integration).
Art. 3 (definitions)
T-12 mo
02.
Risk classification
Assign each item to: prohibited / high / limited / minimal.
Art. 5–6, Annex III
T-12 mo
03.
Provider vs. deployer role
Many companies are both, and the two roles carry different duties.
Art. 3(3), 3(4)
T-12 mo
04.
AI literacy programme
Training for everyone using AI. Reg. (EU) 2026/1744 turned this into a duty to support literacy.
Art. 4
Ongoing
05.
Annex IV gap analysis
Inventory missing technical-documentation elements.
Annex IV
T-10 mo
06.
Risk Management System (Art. 9)
Iterative risk-management process documented.
Art. 9
T-9 mo
07.
Data governance (Art. 10)
Training/validation/test data quality, bias, representativeness.
Art. 10
T-9 mo
08.
Technical documentation
Full Annex IV pack.
Art. 11, Annex IV
T-7 mo
09.
Logging
Automatic event log over the system lifecycle.
Art. 12
T-7 mo
10.
Transparency to deployers
Instructions for use.
Art. 13
T-6 mo
11.
Human oversight
Override mechanism, monitoring, trained human in the loop.
Art. 14
T-6 mo
12.
Accuracy, robustness, cybersecurity
Measurement pipeline + thresholds documented.
Art. 15
T-5 mo
13.
Quality Management System (providers)
ISO-9001-style QMS for AI processes.
Art. 17
T-5 mo
14.
FRIA (qualifying deployers)
Fundamental rights impact assessment BEFORE deployment.
Art. 27
T-4 mo
15.
Article 50 transparency
Chatbot disclosure, generated-content marking, deepfake labelling. This deadline has already passed.
Art. 50(1)–(4)
live since 2026-08-02
16.
Conformity Assessment
Internal control or notified-body audit (Annex VI/VII).
Art. 43, Annex VI–VII
T-3 mo
17.
EU Declaration of Conformity
Signed EU DoC.
Art. 47
T-3 mo
18.
CE marking
Physical/digital marking on product or accompanying documentation.
Art. 48
T-3 mo
19.
EU AI Database registration
Article 71 central registry.
Art. 71
T-2 mo
20.
Post-Market Monitoring plan
Proactive observation post-launch.
Art. 72
T-2 mo
21.
Incident reporting procedure
Serious incident notification within 15 days (Art. 73).
Art. 73
T-2 mo
22.
Vendor / integrator contract update
Document provider–deployer responsibility split.
Art. 25, 27
T-2 mo
23.
Internal audit + tabletop
Mock authority inspection.
internal
T-1 mo
24.
Go-live 2027-12-02 + ongoing compliance
Annual review, document refresh, training renewal.
Art. 72(1)
Ongoing

What a compliance project costs

The ranges below are our own published project ranges (see /en/pricing/). Notified Body fees are separate; the official NB list is in the EU NANDO database.

· Single-system Annex III gap audit + documentation: 4–6 weeks, €13k–€32k
· Notified Body audit support: +8–16 weeks, +€21k–€66k (NB fees additional)
· Multi-system / full programme: 3–6 months, €40k–€130k
· GPAI integrator / downstream provider package: 4–8 weeks, €8k–€24k
· Ongoing compliance retainer (PMM, document refresh, incident response): €0.8k–€3.2k / month

Talk to us in person

When the cost of getting it wrong starts at €35M, a 30-minute scoping call is always worth it. Call +36 30 098 0767, write to balint@appforge.hu, or visit us in person.

Budapest office: Szabadság tér 7., 1054 Budapest (Bank Center), 2nd floor, office 217 · Mon–Fri 9:00–18:00 by appointment.

Official sources

Last updated: 2026-08-14. This page does not constitute legal advice. Book a scoping call for an obligation-specific review.

GYIK

EU AI Act: frequently asked

On 2 December 2027. The original date was 2 August 2026, but Reg. (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026 and pushed Chapter III Sections 1-3, meaning Articles 8 to 27, back by 16 months. AI embedded into already-regulated Annex I products (medical devices, vehicles, machinery, toys) under Article 6(1) now has until 2 August 2028. What did not move: prohibited practices (Article 5) since 2 February 2025, GPAI and penalties since 2 August 2025, and Article 50 transparency since 2 August 2026.

Two routes. (1) Article 6(1): the AI is a safety component of a product covered by EU product-safety law listed in Annex I (medical device, vehicle, machinery, toys, etc.). (2) Article 6(2) + Annex III: it falls into one of eight categories: biometrics (non-prohibited), critical infrastructure, education, employment/HR, essential services (credit scoring, insurance pricing, public benefits, emergency dispatch), law enforcement, migration/border, justice and democracy. If classification is unclear, run a documented gap analysis. That is item 1 on this 24-step checklist.

Article 99 sets three tiers. Prohibited AI practices (Article 5): up to €35M or 7% of worldwide annual turnover, whichever is higher. High-risk non-compliance (Articles 16, 22-24, 26, 31, 33-34, 50): up to €15M or 3%. Inaccurate information to authorities or notified bodies: €7.5M or 1%. SMEs benefit from the lower of the percentage and absolute amount, which is meaningful relief but not exemption.

The FRIA (Fundamental Rights Impact Assessment, Article 27) must be performed BEFORE deploying a high-risk AI system. It binds public bodies, private organisations providing public services, and deployers of the Annex III 5(b) and 5(c) systems, meaning creditworthiness assessment and life or health insurance pricing. Article 27 sits in Chapter III Section 3, so Reg. (EU) 2026/1744 moved it to 2 December 2027 along with the rest of the high-risk package. The FRIA must include deployment purpose, affected persons, deployment risks, human oversight arrangements, complaints handling, and a remediation plan for harms. The result must be notified to the market surveillance authority.

Article 53 obligations for every GPAI provider: (1) technical documentation; (2) information for downstream integrators; (3) copyright policy (respect EU copyright, opt-out signals); (4) sufficiently detailed summary of training content. Systemic-risk GPAI (above 10^25 FLOPs or designated by the AI Office) gets Article 55 additional duties: adversarial testing, serious-incident reporting, cybersecurity. GPAI obligations have applied since 2 August 2025.

Hungary designated its authority in late 2025. Act LXXV of 2025 and Government Decree 344/2025 (X. 31.) put market surveillance and the Article 70(2) single point of contact with the Artificial Intelligence Authority (Mesterséges Intelligencia Hivatal, mihivatal.gov.hu), a ministry unit rather than a standalone agency. The Article 28 notifying authority is the National Accreditation Authority. The central bank (MNB) covers high-risk AI in financial services; the data protection authority (NAIH) acts under GDPR only. The EU AI Office (Articles 64-69) at DG CNECT directly supervises GPAI models.

Single high-risk system Annex III gap analysis + documentation pack (Annex IV technical file, FRIA, instructions for use, post-market monitoring plan): 4–6 weeks, EUR 13k–32k. Notified Body audit support, when third-party conformity assessment is required: +8–16 weeks and +EUR 21k–66k (NB fees additional). Multi-system program or GPAI integrator package: 3–6 months, EUR 40k–130k. Exact quote after a free 30-min scoping call.

(1) AI inventory: list every AI system in use or planned (ChatGPT plugins, embedded Copilot, custom ML, vendor AI components). (2) Risk-classify each (prohibited / high / limited / minimal). (3) Close the Article 50 transparency gaps first, since that deadline passed on 2 August 2026. (4) Gap-assess high-risk items against Annex IV and build a roadmap to 2027-12-02. (5) Keep AI literacy training running, even though Reg. (EU) 2026/1744 turned Article 4 into a duty to support literacy rather than guarantee it. A 30-minute free scoping call gives you a concrete action plan with a project price band.

Kapcsolódó megoldások

Start the audit before the 2027-12-02 deadline

A 30-minute scoping call maps your high-risk AI systems and gives you a precise project timeline and cost band.

Book the AI Act gap audit →Free 30-min consultation

EU AI Act high-risk checklist 24 steps to 2 December 2027

TL;DR

Applicability timeline after the omnibus

Annex III - the 8 high-risk categories

Article 99: penalty thresholds

The 24-step checklist

What a compliance project costs

Talk to us in person

EU AI Act: frequently asked

Related topics

EU AI Act compliance

NIS2 compliance

AI development

Process automation

Start the audit before the 2027-12-02 deadline