Flisko
Free check

EU AI Act check in 8 questions.What the AI Act asks of a business that only uses AI.

Eight yes/no questions about how your business uses AI: customer-facing bots, HR decisions, staff literacy, prohibited practices, personal data, oversight and logs, vendor contracts and internal rules. The result appears at once, with the article of Regulation (EU) 2024/1689 and the date from which it applies for every open item. We store nothing; your answers live only in the result link. Dates reflect the Digital Omnibus on AI (July 2026) and were checked on 10 October 2026 against the AI Act Service Desk. This is not legal advice.

  1. 01Do customers or the public interact with your AI system (a website chatbot, a voice assistant) without being clearly told that it is AI?

    This also covers AI-generated text published to inform the public without human review.

  2. 02Does AI take part in decisions about people at your company: screening or ranking candidates, performance evaluation, promotion, task allocation or termination?

    Drafting a job ad or summarising a CV without influencing the decision does not count.

  3. 03Have the staff who use AI tools completed short training on using them, and do you have a record of it?

    Role-specific training plus a record of who completed it is enough.

  4. 04Does any of your AI systems recognise the emotions of staff in the workplace or of learners in education, categorise people by biometric data to infer sensitive traits, or score people by their social behaviour?

    Examples: reading staff mood from camera or voice, scoring customers on behaviour unrelated to the service.

  5. 05Do staff enter customers' or employees' personal data into public AI tools (ChatGPT, Claude, Gemini, Copilot) without the company having checked the legal basis, the purpose and where the data is processed?

    Names, e-mail addresses, contracts, payslips, health data.

  6. 06Does a person review significant decisions that AI took part in before they take effect, and do you keep a record of when and for what AI was used?

    A rule of 'AI proposes, a person confirms' and a simple usage log are enough.

  7. 07Do you have written contracts or terms with your AI tool vendors that show where data is processed, whether it is used to train models and how long it is kept?

    For ChatGPT, Claude or Copilot business plans this is the data processing agreement (DPA).

  8. 08Do you have written internal rules on AI use: which tools are allowed, which data must never go in and who is responsible for questions?

    One page that every employee knows.

0 of 8 answered

What the check covers, and what it does not

Eight areas that concern a business acting as a deployer, that is, a business that uses an AI system in its work:

  • ✦Bots and AI-written text: Article 50, since 2 August 2026.
  • ✦HR decisions: Annex III and Article 26, from 2 December 2027.
  • ✦Staff AI literacy: Article 4, since 2 February 2025.
  • ✦Prohibited practices: Article 5, since 2 February 2025.
  • ✦Personal data: Article 2(7) of the AI Act and the GDPR (Articles 5 and 6, Chapter V).
  • ✦Human oversight and logs: Article 26 for high-risk systems, Article 22 GDPR for automated decisions.
  • ✦Vendor contracts: Article 28 GDPR and Article 26.
  • ✦Internal AI use policy: evidence of the measures under Article 4.

The check does not cover the obligations of providers, that is, businesses that develop an AI system and offer it to others under their own name, the rules for general-purpose AI models, or high-risk AI in products under Annex I. It does not review your systems or documents and does not replace a legal assessment.

The dates the check uses

EU AI Act application dates after the Digital Omnibus on AI
DateWhat appliesIn the check
2 Feb 2025Prohibited practices, definitions and AI literacy (Article 4).questions 3, 4 and 8
2 Aug 2025Rules for general-purpose AI models and EU-level governance.not covered (model providers)
2 Aug 2026Most rules, including transparency obligations; enforcement starts.question 1
2 Dec 2026New prohibitions, including systems that generate non-consensual sexually explicit content.no dedicated question
2 Dec 2027Rules for high-risk systems in Annex III.questions 2 and 6
2 Aug 2028Rules for high-risk AI embedded in products covered by Annex I.not covered

Frequently asked questions about the EU AI Act check

  • Does the EU AI Act apply to a business that only uses AI?

    Yes. A business that uses an AI system in its work is a deployer under Regulation (EU) 2024/1689. The only exception is a natural person using AI for a purely personal, non-professional activity. For most small businesses this means AI literacy for staff (Article 4), transparency when people talk to a bot (Article 50) and care with HR uses listed in Annex III.

  • What does the check measure, and what does it not?

    The check shows which of the eight areas are open according to your answers and, for each, names the article, the date from which it applies and the shortest step. It does not measure your systems, review documents or give a legal assessment. The result is only as accurate as your answers.

  • Which dates apply?

    The regulation entered into force on 1 August 2024. Prohibited practices (Article 5) and AI literacy (Article 4) have applied since 2 February 2025, the rules for general-purpose AI models since 2 August 2025, transparency obligations (Article 50) and most other rules since 2 August 2026. After the Digital Omnibus on AI, the rules for high-risk systems in Annex III apply from 2 December 2027 and for high-risk AI in products under Annex I from 2 August 2028. We checked the dates on 10 October 2026 against the AI Act Service Desk.

  • What happens to my answers?

    Nothing is stored. Your answers live only in the result link (the r parameter), which you can share or discard. If you request the checklist by email, your name, email and yes/no answers go to us only; the privacy policy describes the process.

  • When is an AI use high-risk?

    When it falls in one of the eight areas in Annex III. For businesses the most common one is employment and workers' management: screening candidates, evaluation, promotion, task allocation or termination. Searching internal documents, summarising contracts and drafting e-mails are not on that list.

Sources

This check is not legal advice. The result is based solely on your answers; we store nothing, the answers live only in the result link. For a specific assessment, especially anything high-risk, talk to a lawyer who knows both the AI Act and the GDPR.

Rezervirajte brezplačen 30-minutni klic