How to get your company ready for the EU AI Act: a compliance checklist

The real risk in using artificial intelligence isn’t admitting that you used it. It’s being unable to explain how it was used, what controls were applied, and who took responsibility for the result.

For agencies, production companies, brands and media outlets, getting ready for the EU AI Act means turning informal AI use into a process that’s governed, documented and verifiable.

AI literacy obligations are already in force, and the Article 50 transparency obligations have applied since 2 August 2026.

This checklist walks through what your organisation needs in place to meet those requirements.

The EU AI Act compliance checklist: 8 key steps#

Step 1. Inventory the AI tools in your business#

Map where artificial intelligence actually shows up: copywriting, image generation, video editing, voice cloning, chatbots, ad personalisation, audience analysis, content curation.

For each tool, log what it’s used for, the data it touches, the team responsible, and the outputs it produces.

Step 2. Work out your organisation’s legal role#

An organisation is usually a deployer when it uses third-party tools, and becomes a provider if it develops a system itself or puts one on the market under its own name.

You also need clarity on who is answerable for what when agencies, production companies, advertisers, media outlets, contributors and freelancers are all involved in the same project. Settling AI governance and accountability early saves a lot of trouble down the line.

Step 3. Classify your use cases by risk level#

Check whether each system falls under a prohibited practice, could count as high-risk, or is subject to specific transparency obligations.

Generating content doesn’t automatically make a system high-risk. But obligations can arise when you’re creating deepfakes, publishing text on matters of public interest, or running systems that interact directly with people.

Step 4. Assign AI governance responsibilities#

Set out who may use each tool, who reviews the output, who authorises publication, and who takes charge when something goes wrong.

This policy needs to reach creative, production, marketing, editorial, technology, legal and compliance teams alike.

Step 5. Train your teams in AI literacy#

The EU AI Act requires organisations to ensure a sufficient level of AI literacy among staff, taking into account their existing knowledge, the context in which AI is used, and the people affected by it.

Training should cover privacy, intellectual property, bias, hallucinations, security, transparency and the role of human review.

Step 6. Set an internal transparency and labelling policy#

Decide when you need to disclose that someone is interacting with an AI system, and when images, video or audio that amount to deepfakes need to be labelled.

Text generated or manipulated with AI and published to inform the public on matters of public interest also needs a label where it hasn’t had substantive human review and effective editorial control. A quick spellcheck doesn’t meet that bar.

Step 7. Document and certify every production process#

For the piece-by-piece detail, see the guide on how to document and certify AI-generated content, step by step.

Keep evidence of the tools, models, prompts, input files, versions, modifications, rights in the source material, human involvement and labelling decisions.

Hold external suppliers to the same standard of traceability.

Step 8. Revisit contracts and procedures with suppliers and collaborators#

Getting ready for the AI Act also means reviewing your contracts: clauses on AI use, confidentiality, intellectual property, labelling, evidence retention and where responsibility sits. Review your inventory and controls regularly, not just once.

How does VeriqX help?#

VeriqX turns a transparency policy into an operating procedure. The platform documents how each piece of content was made, records the human involvement, and ties that evidence to the final file through certificates, timestamping and standards such as C2PA / Content Credentials.

It doesn’t replace legal analysis, but it does let you show which tools were used, which controls were applied, and why a piece was labelled — or wasn’t.

Complying with the EU AI Act isn’t only about following the rules. It’s about being able to prove that you did.

Key points and frequently asked questions#

When do AI literacy obligations apply to companies?#

AI literacy obligations already apply across the European Union. Companies should be training their teams on safe use, bias and intellectual property now, if they haven’t started already.

What role does a company have under the EU AI Act?#

A company is usually a deployer when it uses third-party tools, but becomes a provider if it develops its own system or puts one on the market under its own brand.

How does VeriqX help with the AI Act checklist?#

VeriqX documents how content was created, records human involvement, and issues certificates with timestamping and the C2PA / Content Credentials standard.

Need help or advice?#

• AI consultancy and audit for businesses: [email protected]
• Talk to the author directly (David Lahoz): https://www.linkedin.com/in/dlahoz/