Knowing your risk tier is step one. Actually implementing compliance — across governance, data, documentation, security, transparency, oversight, and monitoring — is the part that takes months and spans multiple teams. This is the granular, function-by-function checklist for doing that work.
HexTyx Compliance & Governance··Updated June 18, 2026
Scope note: for what the Act requires conceptually — risk tiers, obligations, Article 11/72 — see EU AI Act Compliance for LLM Systems →. This page is the implementation checklist only, organized by the team that typically owns each section.
Check your risk tier before working through this list — high-risk systems need every section in full, limited-risk systems mainly need the transparency section, and minimal-risk systems carry light obligations throughout. See AI Risk Classification → if you haven't determined your tier yet.
Governance
Typically owned by: Compliance / Risk
AI governance framework established and documented
Risk ownership assigned to a named role, not a team in the abstract
Compliance responsibilities defined across engineering, legal, and product
Audit procedures documented and scheduled
Incident escalation process implemented with named contacts
Data Governance
Typically owned by: Engineering / Data Science
Training data quality verified against documented standards
Bias testing performed and results retained
Data lineage documented end to end
Dataset provenance tracked for every training source
Sensitive data controls enforced at ingestion, not just at output
Technical Documentation
Typically owned by: Engineering
System architecture documented in regulator-readable form
Model training process recorded, including key decisions and tradeoffs
Risk mitigation strategies defined per identified risk
Testing methodology documented, including adversarial testing
Model limitations recorded explicitly, not implied
Security and Robustness
Typically owned by: Security Engineering
Prompt injection protection implemented and tested
Adversarial testing completed with retained evidence
Runtime monitoring enabled across production traffic
API security controls enforced and reviewed periodically
Data poisoning defenses implemented for any retrieval or training pipeline
Transparency
Typically owned by: Product / Engineering
AI usage disclosed to users clearly, not buried in terms of service
Automated decision labeling enabled wherever the system influences an outcome
Explanation mechanisms implemented for consequential decisions
User notification systems active and tested
Validate Your Implementation — Free
The HexTyx AI Security Assessment tests the security and robustness section of this checklist directly against your live system.
Human override mechanisms enabled and tested under load
Escalation workflows defined with clear ownership at each step
Manual review processes implemented for high-risk decisions
Emergency shutdown capability available and rehearsed, not just theoretical
Monitoring and Logging
Typically owned by: Engineering / Security
Full audit logs enabled across inputs, outputs, and decisions
Decision traceability implemented end to end
Runtime observability deployed in production, not just staging
Behavioral anomaly detection active and reviewed regularly
Frequently Asked Questions
What's the difference between this checklist and a general EU AI Act overview?
An overview explains what the Act requires conceptually. This checklist is function-by-function and implementation-grade, meant to be worked through directly by the responsible teams.
Do I need every section of this checklist?
It depends on your risk tier. High-risk systems need every section in full; limited-risk systems mainly need transparency; minimal-risk systems have light obligations throughout.
Who should own each section?
Governance and oversight typically sit with compliance or risk. Data and documentation usually sit with engineering. Security sits with security engineering. Transparency and monitoring often span product and engineering jointly.