EU AI Act compliance checklist for organisations that use AI: record-keeping, logging and audit evidence

Provider or deployer: which one are you?

A provider develops an AI system or has it developed and places it on the market under its own name. A deployer uses an AI system under its own authority in the course of business. Most organisations connecting Claude, ChatGPT, Claude Code or Cursor to their own data are deployers. You become a provider if you put your own name on a system you built or substantially modified, or if you use a general-purpose model to build something high-risk.

Deployers have fewer duties than providers, but not none. The checklist below is written for deployers.

The dates

Check the dates against the Digital Omnibus text before you plan around them: it changed the high-risk timeline in 2026 and may be amended again.

Deployer duties for high-risk systems (Article 26)

• Use the system in line with the provider's instructions.
• Assign human oversight to people with the competence, training and authority to intervene.
• Make sure the input data you control is relevant and representative for the intended purpose.
• Monitor the system's operation and tell the provider, and where relevant the market surveillance authority, about serious incidents.
• Keep the logs the system generates, under your control, for at least six months unless other law says longer.
• Tell workers' representatives and affected workers before putting a high-risk system to use at work.
• Where you make decisions about people, tell them a high-risk system is involved.
• Carry out a data protection impact assessment where the GDPR requires one, using the provider's information.

Transparency duties for everyone (Article 50)

From 2 August 2026, people must be told when they are interacting with an AI system unless it is obvious, and AI-generated or manipulated images, audio, video and text published to inform the public must be disclosed or marked. Deployers of emotion recognition and biometric categorisation systems must tell the people exposed to them.

The EU AI Act compliance checklist for deployers

1. List every AI system in use, who uses it, what data it reaches and what it can do. Include the AI apps on people's laptops, not just the ones IT bought.
2. Classify each use: prohibited, high-risk (Annex III), transparency-only, or minimal risk. Record the reasoning.
3. For each high-risk use, name the person responsible for oversight and the provider contact.
4. Decide how you will keep the system's logs for six months, and who can read them.
5. Put the transparency notices in place: in the product, on the content, in the HR process.
6. Make sure the DPIA covers the AI use, and that the record of processing lists the AI apps as recipients.
7. Set the controls in advance: which tools an AI app can call, what it must never send, who reviews what.
8. Keep a record of what each AI system actually did, so that an incident, an audit or a complaint can be answered with facts.
9. Review the list when a new app, tool or model arrives.

Record-keeping and logging: what the record should show

Article 12 requires providers of high-risk systems to build automatic logging into the system; Article 26 requires deployers to keep those logs. For AI apps that call tools, the useful record is at the tool boundary: which app called which tool, for which user, with what arguments, what came back, and whether a control blocked or changed it.

ContextGate keeps exactly that record for every tool call made through it, with policies that block, warn or redact set in advance and the blocked and warned calls showing them working. It is evidence for the oversight and monitoring duties, not a classification of your systems: working out which of your AI uses are covered, and at what risk level, stays with you.