EU AI Act Readiness Assessment
Which parts of the EU AI Act apply to you, and from when?
Free. 25 questions map your AI use against the Act as amended by the Digital Omnibus. You get the obligations that apply to your company, the date each one starts and where your answers show a gap, with each legal obligation cited to the article it comes from.
Next date in the Act
2 December 2026
New bans and content marking
New bans apply, including AI that generates intimate or sexually explicit images of an identifiable person without their consent. Providers of AI content generators placed on the market before 2 August 2026 must also mark what they produce.
- High-risk uses in Annex III2 December 2027
- AI in regulated products2 August 2028
Source: Reg. (EU) 2024/1689, Art. 113(a), as amended; Reg. (EU) 2024/1689, Art. 5(1)(ba), as amended; Reg. (EU) 2024/1689, Art. 111(4), as amended
Dates as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744.
If you use AI at work, the Act probably covers you.
The Act is not only for companies that build AI. It assigns duties by role, and a company that uses AI tools at work holds the role of deployer.
Deployer
Any organization using an AI system under its authority, other than for personal use. That includes ChatGPT, Copilot and the AI features inside your HR or CRM software.
Source: Reg. (EU) 2024/1689, Art. 3(4)
Provider
Whoever develops an AI system or has one developed, and puts it on the market or into service under its own name, paid or free.
Source: Reg. (EU) 2024/1689, Art. 3(3)
A deployer who becomes the provider
Repurpose an AI system, including a general-purpose one, into a high-risk use, and the provider’s obligations become yours.
Outside the EU is not outside the Act
The Act covers deployers established in the EU, and providers and deployers anywhere else when the output of their AI system is used in the EU.
Where everyday AI becomes high-risk
Annex III lists the uses that make an AI system high-risk. These are the four the assessment asks about first:
Hiring
Targeting job ads, filtering applications, evaluating candidates.
Managing people
Promotion or termination decisions, allocating tasks by behavior or traits, monitoring performance.
Credit and insurance
Scoring the creditworthiness of individuals, pricing life or health insurance.
Education and training
Evaluating learning outcomes in educational or vocational training institutions.
A system in these areas is not high-risk if it poses no significant risk of harm, including by not materially influencing the outcome of a decision. One that profiles people always is.
The dates, after the Digital Omnibus.
The Digital Omnibus on AI, in force since 27 July 2026, pushed the high-risk rules back. The bans and AI literacy have applied since 2 February 2025, and most transparency duties apply from 2 August 2026, with a short grace period for content marking.
Source: Reg. (EU) 2026/1744, Art. 4, first paragraph; Reg. (EU) 2024/1689, Art. 113(c), as amended; Reg. (EU) 2024/1689, Art. 113(a), as amended; Reg. (EU) 2024/1689, Art. 113, first and second paragraphs; Reg. (EU) 2024/1689, Art. 111(4), as amended
- 2 February 2025
Bans and AI literacy
Prohibited practices are banned, and providers and deployers must support the AI literacy of their staff.
- 2 August 2025
General-purpose AI models and penalties
Obligations for providers of general-purpose AI models apply, and so do the penalty rules.
Source: Reg. (EU) 2024/1689, Art. 113(b) - 2 August 2026
General application, including transparency
Most of the Act applies, including telling people they are dealing with AI and disclosing deep fakes.
- 2 December 2026
New bans and content marking
New bans apply, including AI that generates intimate or sexually explicit images of an identifiable person without their consent. Providers of AI content generators placed on the market before 2 August 2026 must also mark what they produce.
- 2 December 2027
High-risk uses in Annex III
Hiring, people management, credit, insurance, education and the other Annex III areas: the high-risk obligations apply.
- 2 August 2028
AI in regulated products
High-risk AI in products covered by EU product law (Annex I).
What non-compliance can cost.
Fines are capped at a fixed amount or a share of worldwide annual turnover, whichever is higher.
EUR 35 million
or 7% of worldwide turnover
Using a prohibited AI practice
Source: Reg. (EU) 2024/1689, Art. 99(3)
EUR 15 million
or 3% of worldwide turnover
Breaching operator obligations, including deployer duties and transparency
EUR 7.5 million
or 1% of worldwide turnover
Giving authorities incorrect, incomplete or misleading information
Source: Reg. (EU) 2024/1689, Art. 99(5)
Company size changes the cap
SMEs
Fewer than 250 staff and turnover up to EUR 50 million (or a balance sheet up to EUR 43 million): each fine is capped at the lower of the two figures, not the higher.
Small mid-caps
Not an SME, fewer than 750 staff, turnover up to EUR 150 million (or a balance sheet up to EUR 129 million): no lower cap, but authorities must weigh your economic viability.
Part of a larger group? Confirm with counsel which group figures count before you rely on either cap.
Draft rules, not yet adopted
Draft rules would let each AI Office investigative step restart the five-year window to fine.
The EU AI Office supervises some AI systems directly, including those built on a provider’s own general-purpose AI model. For those, its power to fine runs out five years after the infringement, or after a continuing one stops.
A Commission draft published on 12 October 2026 would let any investigative step interrupt that clock: an information request, a system evaluation, an inspection, an invitation to a structured dialogue. Each one restarts it, up to an outer limit of twice the period, plus any time the clock is suspended.
It is a consultation draft, open for feedback until 9 November 2026, and not yet adopted. As drafted, it covers only the AI Office’s own proceedings, not those of national authorities.
For a deployer, the practical step is the same either way: keep a written record of what you checked, and when.
What the assessment checks
The first section maps your exposure: where your AI touches the EU, your role, and whether you work in any high-risk area. The other five check the controls behind each obligation.
Your AI footprint
8 questionsEU reach, provider or deployer, and AI in hiring, people management, credit, insurance, education or other Annex III areas.
Prohibited practices
2 questionsWhether every AI use has been checked against the bans, and whether any tool infers how staff or candidates feel.
Inventory and roles
4 questionsA list of every AI system, its risk class with the reasoning, and when a change would make you the provider.
AI literacy and oversight
3 questionsAI literacy measures, a named overseer for each system that affects people, and telling workers first.
Deployer controls
5 questionsInstructions for use, log retention, monitoring, notices to affected people, and vendor contracts.
Transparency and ownership
3 questionsTelling people they are talking to AI, labeling generated content, and one accountable owner.
Cited to the article
Each obligation in your results links to the article it comes from, with the provision quoted from the regulation as amended.
Written by rules, not a model
Your results come from fixed rules applied to your answers. No AI model writes them, so the same answers always give the same obligations and scores.
A starting point, not legal advice
It tells you which obligations are likely to apply and where your answers show gaps. Confirm the conclusions with counsel before you rely on them.
What you get, and what happens to your answers
What you get
- Your exposure: in scope or not, your likely role, your risk tier and the high-risk areas you work in.
- The obligations that apply to you, each with its status from your answers, the date it applies and the article it comes from.
- A readiness score for each of the five control areas, and a first read of whether you count as an SME or a small mid-cap.
- The same results by email, so you can forward them to legal, IT or HR.
What happens to your data
- We save your contact details, answers and results. No AI model reads them.
- Up to two follow-up emails over the next two weeks. Each one has an unsubscribe link, and replying “stop” works too.
- Records are removed when no longer needed. Ask us for your retention date at any time.
- Email hello@vibrana.ai to access, correct or delete your data.
This assessment gives general information about Regulation (EU) 2024/1689 as amended. It is not legal advice. Read the privacy policy
Start with your own obligations
Know which dates are yours, and the article behind each one.
25 questions. Your obligations, their dates and your gaps on screen when you finish, each cited to the article. If it’s useful, book a 30-minute call to walk through it with us.
Every legal statement on this page links to the provision it comes from, quoted from the official text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. This page is general information, not legal advice.