EU AI Governance Cheat Sheet

Key laws

EU AI Act Art. 4: AI literacy obligations (in force 2 Aug 2025)
EU AI Act Art. 5: prohibited AI practices (8 prohibitions, in force 2 Feb 2025)
EU AI Act Art. 6: high-risk AI classification (Annex I + Annex III)
EU AI Act Art. 9: risk management system for high-risk AI
GDPR Art. 5: principles for processing personal data
GDPR Art. 6: lawful basis for processing
GDPR Art. 9: special categories of personal data
GDPR Art. 13: information to be provided where data collected directly from data subject

Inventory every AI system against EU AI Act Annex III categories. Anything that lands in a high-risk category needs the full Article 9 / 13 / 14 documentation stack before 2 August 2026.
Confirm Article 4 AI literacy training is recorded for everyone who develops, deploys, or supervises AI systems. In force since 2 February 2025; auditors check the training register.
If you're a deployer of high-risk AI in scope of Article 27, prepare the Fundamental Rights Impact Assessment template now. Public bodies + essential-service providers can't wait until August.
For GPAI users: collect provider technical documentation under Article 53. If your provider hasn't published it, request it in writing — your audit trail starts there.
Map your data-processing chain for AI inputs against GDPR Article 35 (DPIA). EU AI Act FRIA can build on the DPIA; doing both in parallel saves rework.

One-page .docx · ~10 KB · free. You'll also be subscribed to the weekly Brief.