EU AI Act test checklist generator
The test checklist generator takes a classification tier, a role (provider or deployer) and the system types that apply. The generator returns one test item per testable element of each obligation in the selected profile, with the protocol that runs the item, and lists the documentation and process elements the tests need as inputs. The tool runs in the browser and sends nothing. The export is a Markdown file with one checkbox per item: a working document for the provider's or deployer's own file, built from the regulation data In force.
How the result is built
The form has three inputs. The tier is one of five: high-risk under Annex III (Art. 6(2)), high-risk under Annex I Section A (Art. 6(1)), an Art. 50 transparency duty only, a general-purpose AI model, or a general-purpose AI model with systemic risk. The role is provider or deployer. The system type is a multiple choice of six: a classification or scoring model with a fixed output set, a system built on a language model, a generator of audio, image or video, a system that processes biometric data, a system that continues to learn after placing on the market, and a safety component of a physical product. The tier and the role select the profiles in profiles.json whose role and tier match; a provider under the Annex III tier, for example, receives the provider profile and the authorised-representative row under Art. 22 that applies to a provider established outside the Union. For the two general-purpose AI tiers the role input is not used: the generator takes the profiles of the general-purpose AI provider, which carry Art. 53 and Art. 54, and the systemic-risk tier adds Art. 55.
Each profile lists articles. An article with an obligation page contributes every element of the testable list of its obligation record, and the protocol shown is the first protocol in the record's procedures that covers the article in the protocol data; Art. 15 resolves to PR-15-ROB v1.0, Art. 11 to PR-11-DOC v1.0, Art. 14 to PR-14-OVR v1.0. An article without an obligation page, such as Art. 16, Art. 43, Art. 49 or Art. 72, carries a label in the profile and contributes no test item, because the record that would supply the split does not exist. After the obligation items, the generator appends the system-type items from checklist.json whose article is in the profile, each with its own protocol: a language-model system adds, for a high-risk profile, the Art. 15(5) attack set under PR-15-ROB v1.0 and the Art. 13 instructions-for-use check under PR-11-DOC v1.0, and, for the transparency profile, the Art. 50(1) disclosure check under PR-50-MARK v1.0; a biometric system adds the Art. 14(5) two-person verification under PR-14-OVR v1.0 and the special-category data record under PR-10-BIAS v1.0; a system that continues to learn adds the drift measurement under Art. 15(4) and the re-test trigger in the risk management file under PR-17-QMS v1.0. The origin column names the source of each row: obligation for an element of the record, or the system type that added it.
Documentation and process elements of the same records are listed under "Inputs the tests need", with their kind, and are not test items: a declaration of accuracy metrics in the instructions for use under Art. 15(3) is a document the accuracy test reads, and the re-measurement trigger after a model change under Art. 15(1) is a process the test report cites. No item carries a metric threshold; where Regulation (EU) 2024/1689 sets none, the threshold note on each obligation page states the source hierarchy, from a harmonised standard cited in the Official Journal, of which none exists as of the anchor date, down to the provider's justified state of the art. The Markdown export tags every item with its protocol and version; its header names the tier and the role, and a stamp line gives the verified-on date and the source title of the tier's regulation entry, so that a reader of the file can trace the profile to the published logic it came from.
What the result is not
The result is a list of test items and inputs. It does not decide whether a system is high-risk under Art. 6; the tier is entered by the user, and the provider's own assessment under Art. 6(4) and its documentation stay with the provider. It does not perform or replace a conformity assessment under Art. 43, by internal control under Annex VI or with a notified body under Annex VII, and a ticked box records that a test was run; whether the result met the criterion is recorded in the test report. It is not legal advice, and the disclaimer applies to every item as it applies to the obligation pages the items come from.
Where the output goes next
The classifier passes its tier and role to this page through the page address, so the checklist opens on the profile the classifier selected where that tier and role are among those the form offers; the obligation tracker shows the same profile with the application date of each article, and the traceability matrix gives each element a row with the artifact it produces and an evidence status column for the assessor. The templates supply the Annex IV outline and the evidence-pack index that the completed items feed. Where a test item is to be run rather than planned, the robustness and adversarial testing service runs PR-15-ROB v1.0 and the technical documentation and evidence-pack preparation service runs PR-11-DOC v1.0, within the limits stated on what we cannot do.
Questions
What are the items an EU AI Act compliance checklist covers?
The generator on this page lists the elements a test can answer: every testable element of Art. 9 to Art. 15 and Art. 17 for a high-risk provider profile, of Art. 26 for a deployer and Art. 27 for an Annex III deployer, and of Art. 50 for a transparency-only profile, each with the protocol that runs it. Documentation and process elements appear as inputs the tests need. Compliance decisions remain with the provider or deployer, their notified body and their counsel.
Is there an EU AI Act Annex IV technical documentation checklist in this tool?
For a high-risk provider profile the Art. 11 group lists the testable consistency elements of Annex IV: the declared metric values match the dated test reports, the system version matches the deployed artefact, and the architecture description matches the system as built, each run under PR-11-DOC. The Annex IV sections themselves are documentation elements and appear under inputs the tests need. The Annex IV outline on the templates page gives the section structure.
How does an EU AI Act checklist differ from a conformity assessment?
A checklist records which test was run and which document exists. A conformity assessment under Art. 43 is the procedure by which the provider demonstrates that a high-risk system meets Chapter III Section 2, by internal control under Annex VI or with a notified body under Annex VII, ending in the EU declaration of conformity under Art. 47 and the CE marking under Art. 48. A completed checklist is an input to the Art. 43 procedure, which stays with the provider and, where Art. 43(1) requires one, a notified body.
Every inquiry receives a reply within 24 hours. Scope and availability are discussed per request.