EU AI Act Compliance Audit

EU AI Act Compliance Audit

Perform a structured compliance audit of a software project against the EU AI Act (Regulation (EU) 2024/1689). The audit produces a prioritized report with risk classification, article-by-article compliance status, and actionable remediation steps.

Why this matters

The EU AI Act is the world's first comprehensive AI regulation. Non-compliance carries fines up to 35M EUR or 7% of global annual turnover. Obligations are phased in — some are already in force, others take effect in August 2026.

Audit workflow

Follow these steps in order. Be thorough but efficient — skip steps that clearly don't apply.

Step 1: Research latest regulatory context

Before diving into the codebase, fetch the latest guidance and updates. The AI Act is actively being implemented, with new guidance, codes of practice, and delegated acts being published regularly.

Search for the latest updates using WebSearch:

1. Search EU AI Act 2026 latest guidance implementation to find recent updates from the EU AI Office
2. Search EU AI Act Code of Practice transparency AI-generated content for the latest draft of the transparency code
3. If the project involves a specific domain (healthcare, education, employment, etc.), search for sector-specific guidance

Key authoritative sources to check with WebFetch when relevant:

Fetch 2-3 of the most relevant sources based on what the project does. Don't fetch all of them — focus on what matters for the specific project being audited.

Step 2: Discover AI systems in the project

Search the codebase broadly for any AI/ML usage.

Direct indicators (packages, imports, API calls):

• LLM providers: openai, anthropic, @ai-sdk, langchain, llamaindex, openrouter, huggingface, cohere, mistral, groq, together, replicate, bedrock, claude, gpt
• ML frameworks: tensorflow, pytorch, torch, scikit-learn, sklearn, transformers, onnx, mlflow
• AI SDKs: ai, vercel/ai, assistant-ui, copilotkit
• Vector/embeddings: pinecone, weaviate, chromadb, pgvector, embedding

Indirect indicators (features that may use AI):

• Chat/assistant interfaces, chatbots, conversational UI
• Recommendation engines, content personalization
• Automated moderation, content filtering, spam detection
• Predictive analytics, scoring, classification, ranking
• Image/video/audio generation or analysis
• Search with semantic/AI-powered ranking

Where to look: package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, .env*, API routes, middleware, config files, system prompts, model configs.

For each AI system found, document:

• What model/service it uses and how (API, self-hosted, fine-tuned)
• What it does (purpose, functionality)
• Who interacts with it (internal users, general public, specific groups)
• What data flows through it (user inputs, outputs, any data stored)
• Whether it makes or influences decisions about people

If no AI systems are found, report that the project has no AI Act obligations and stop.

Step 3: Determine the organization's role

For each AI system, classify the organization's role:

Most projects using third-party LLM APIs are deployers. If the project significantly modifies model behavior (fine-tuning, custom training), it may qualify as a provider.

Step 4: Classify risk level

Read references/risk-classification.md for the full Annex III categories. Classify each AI system into one of four risk levels:

An informational chatbot that doesn't make decisions about people's rights or access to services is typically limited risk. However, if it operates in an Annex III domain or influences individual decisions, escalate the classification.

Step 5: Check applicable obligations

Based on risk level and role, audit each requirement. Use these tables for structured reporting.

For ALL AI systems (any risk level):

For limited-risk systems (chatbots, generative AI):

When checking transparency, search the latest Code of Practice using WebSearch: EU AI Act Code of Practice transparency marking labeling — as the final code may have been published with specific technical requirements.

For high-risk systems:

Read references/high-risk-obligations.md for the detailed checklist. Key areas: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy/robustness/security (Art. 15), quality management (Art. 17), FRIA for public bodies (Art. 27).

GPAI model obligations (Chapter V):

These obligations fall primarily on the model provider (OpenAI, Anthropic, Google, etc.), not on deployers. As a deployer, verify:

• Your provider publishes model documentation per Art. 53
• Your provider has a copyright compliance policy
• For systemic risk models: provider conducts adversarial testing (Art. 55)

Use WebSearch to check: [provider name] EU AI Act GPAI compliance — major providers are publishing compliance pages.

Step 6: Check GDPR intersections

The AI Act works alongside GDPR. For AI systems processing personal data:

Step 7: Review technical safeguards

Step 8: Accessibility check (complementary)

Not part of the AI Act itself, but public-sector digital services in the EU must comply with the Web Accessibility Directive (2016/2102). Flag if:

• The AI interface lacks WCAG 2.1 AA compliance
• No accessibility statement exists
• Screen reader support is insufficient
• The accessibility link was removed or is missing

Report format

Write the report in the same language the user used to request the audit. Use this structure:

# EU AI Act Compliance Audit — [Project Name]

## 1. AI Systems Identified
For each system: name, model/service, purpose, users, org role (provider/deployer)

## 2. Risk Classification
For each system: risk level, reasoning, which Annex III category (if high-risk)

## 3. Compliance Status
| Requirement | Article | Status | Detail |
Status: COMPLIANT / PARTIAL / NON-COMPLIANT / NOT APPLICABLE / NOT VERIFIABLE

## 4. Findings (by priority)

### High Priority (blocking — must fix before applicable deadline)
Numbered, with file:line references where possible

### Medium Priority (should address before deadline)
...

### Low Priority (recommendations / best practices)
...

## 5. Summary
| Area | Rating |
2-3 sentence conclusion with key deadlines and next steps

## Sources
Links to the regulatory sources consulted during the audit

Important guidelines

• Be precise about legal requirements vs. recommendations. The AI Act has specific obligations with specific deadlines. Clearly distinguish "the law requires X" from "it would be good practice to do Y."
• Check the current date against the timeline. If it's before August 2, 2026, some transparency obligations aren't yet enforceable — but flag them as upcoming.
• Don't burden deployers with provider obligations. Most GPAI model compliance (Art. 53-55) is the provider's responsibility.
• Flag public bodies. Government-linked projects face additional scrutiny (FRIA under Art. 27) and accessibility requirements.
• Reference specific articles and paragraphs. Don't just say "transparency requirements" — cite Art. 50(1) for chatbot disclosure, Art. 50(2) for content marking, etc.
• Give actionable code-level fixes. When finding non-compliance in the codebase, reference specific files and lines, and suggest concrete changes.