Ask where your business uses AI and the first answer might be “a few places”. Ask who checks the chatbot's replies, or which tool writes the website copy, and the gaps become easier to spot.
An AI inventory lists those tools and uses, with someone responsible for each. Start with a shared register. A chatbot answering customers, a video tool creating synthetic presenters and a writing assistant drafting public guidance will each need different checks.
This guide covers practical checks for the EU AI Act, using sources checked on 16 September 2026. The register isn't a statutory template or proof of compliance.
Give each use its own row
Record internal notes and public guidance separately, even if one tool produces both. The audience and consequences differ.
For each use, answer these questions:
- Who is responsible, and which team uses the tool?
- What does it produce, and who relies on the result?
- What goes into it, including personal or confidential information?
- Is the output kept inside the business, sent to customers or published?
- Where is it used, and is there an EU connection?
- Which supplier, product version and settings are involved?
- Who checks the output, and who can pause its use?
Include features people are trying out on real work. Calling something a pilot doesn't tell you what happens to people's information or how its results affect decisions.
Get specific answers from suppliers
A supplier saying its product is “AI Act ready” leaves plenty of questions. You still need to know which controls to switch on and what your business must do.
Start with the purpose you've recorded. What is the system intended to do? Which business is its provider? What limitations should staff know about? Which instructions apply to your use? What changes will the supplier tell you about? Who should you contact if something goes seriously wrong?
For a tool that generates content, ask about technical marking, visible notices and what happens when you export the result. For a chatbot, find out who controls the opening message. Check whether the notice still appears on a phone or when the chatbot is embedded in another page.
Keep the answer and supporting document with the relevant row. Note any settings to change. Assign missing answers to someone to chase, with a due date or a restriction on use while you wait.
Look at what your customers see
The Commission's July 2026 transparency guidance explains obligations applying from 2 August 2026. The different parts of Article 50 cover different activities and roles.
For direct interaction, Article 50(1) requires providers to design systems so that people are told they're interacting with AI, unless that's obvious in the relevant circumstances. Article 50(5) requires applicable information to be clear, distinguishable and provided by the first interaction or exposure, with accessibility requirements respected. See Article 50.
Try the service on a phone and a laptop. Would a new customer understand what the assistant is before typing? Does the notice survive a page redesign? Can you find a human contact? Keep screenshots and assign any unclear wording to someone to fix.
Check technical marking as well as visible labels
Article 50(2) concerns providers marking synthetic outputs in a machine-readable way so software can detect that they've been generated or manipulated. There are qualifications, including for ordinary assistive editing. A visible label and a technical mark serve different purposes, so check both where relevant.
One specific transition matters here. Providers of qualifying systems placed on the market before 2 August 2026 have until 2 December 2026 to comply with Article 50(2). The 2026 amending regulation sets out that provision. It doesn't extend every transparency deadline.
Ask whether the transition covers your system and how its marking works. Then try the steps your team normally takes: generate a sample, download it, edit it and upload it. Check whether the marking survives. Converting a file can lose provenance information, so don't assume it'll still be there. These checks can uncover practical gaps, but they don't prove legal conformity on their own.
Give public-interest text and deepfakes a closer look
The Commission's transparency announcement highlights deployer duties for deepfakes and certain public-interest text. Each needs its own assessment. There isn't one label that every AI-assisted document must carry.
Article 50(4) requires disclosure for AI-generated or manipulated text published to inform the public on matters of public interest. An exception applies where the text has undergone human review or editorial control and a person or organisation holds editorial responsibility. The Commission's transparency questions and answers explain the distinction. Having another AI model check the draft doesn't count as human review.
Imagine a website that publishes AI-generated guidance. Its register should say who decides whether the exception applies and what review happens before publication. If the business relies on human editorial control, someone needs to do that work. Adding a person's name to the page isn't enough. Where disclosure is required, readers should see it when they encounter the content.
Review realistic synthetic images, voices and videos separately. Before publishing, check whether they're deepfakes and what disclosure fits the context.
Make the register part of the work
Every reviewed row should name someone responsible, record a decision and list open actions. Start with tools that reach customers or influence important decisions about people.
Update a row when the use, audience, supplier or output format changes. If something goes wrong, your team should be able to find what's been checked and contact the person who can switch it off.