EU AI Act: What Auditors Need

The same AI model can be used in three business processes and create three different regulatory questions. A customer-service assistant may trigger transparency duties. A recruitment screening tool may fall within a high-risk use case. A lower-impact internal application may sit outside those specific regimes while the organization still has horizontal obligations such as AI literacy.

For auditors, that distinction changes where the work begins. The EU Artificial Intelligence Act is not one control checklist that applies to every AI system. You first determine scope, the organization’s role, and the regulatory treatment of the use case; only then can you identify the evidence that should exist.

That matters particularly in 2026. The Act became generally applicable on 2 August 2026, but key high-risk obligations were postponed by Regulation (EU) 2026/1744. An audit built around the original implementation calendar may test requirements too early while missing obligations that are already in force.

The first audit risk is getting the classification wrong

Regulation (EU) 2024/1689 uses a risk-based approach, but not every regime fits neatly into one ladder. For audit purposes, it is useful to separate four treatments for AI systems and an additional regime for general-purpose AI models.

Regulatory treatment	What the auditor should recognize	First question
Prohibited practices	Certain practices in Article 5 cannot be placed on the market, put into service, or used, subject to the Act’s conditions and exceptions.	Does any use case fall within a prohibited practice?
High-risk systems	Classification can arise from certain regulated products in Annex I or sensitive use cases in Annex III.	Is the classification documented, with the correct application date?
Transparency	Article 50 covers, among other things, certain systems that interact with people and certain AI-generated or manipulated content.	Can required disclosures or technical markings be demonstrated?
Minimal or no specific risk	Most AI systems do not fall into the regimes above. That does not automatically remove horizontal duties.	Is the classification rationale traceable?

General-purpose AI (GPAI) models need separate analysis. Chapter V establishes obligations for their providers and adds requirements for GPAI models with systemic risk. GPAI is not simply another “risk level” in the same system-classification ladder.

For Internal Audit, the practical consequence is that an AI inventory needs more than a product name. It should connect use case, intended purpose, users, affected persons, geography, technology provider, underlying model, regulatory role, and classification.

Determine the organization’s role before testing controls

The Act distinguishes providers, deployers, importers, distributors, authorised representatives, and other operators. Two organizations using technically similar systems may face different obligations because they occupy different positions in the AI value chain.

A provider develops an AI system or has one developed and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, excluding purely personal, non-professional activity. Article 25 also describes circumstances in which a distributor, importer, deployer, or other third party is treated as the provider of a high-risk system, including certain cases involving rebranding, substantial modification, or a change in intended purpose.

That is why asking “Who is the vendor?” is not enough. Audit should reconstruct the actual responsibility chain and inspect contracts, branding, modifications, integrations, and changes in intended purpose.

Territorial scope deserves the same discipline. The Act can apply to providers established outside the EU when they place AI systems or GPAI models on the Union market and, in certain circumstances, to providers or deployers in third countries where the system’s output is used in the Union. For groups headquartered in Mexico, Latin America, or elsewhere, the parent company’s location is not enough to conclude that the Act is out of scope.

Evidence should follow the obligation

An AI policy, governance committee, and system inventory may all be sensible controls, but none proves compliance by itself. Regulatory evidence needs to match the organization’s role and the specific obligation.

Situation	Evidence to look for	Example test
Any provider or deployer	AI inventory, scope analysis, role classification, and measures supporting AI literacy.	Sample use cases and reconstruct the rationale for scope, role, and duties.
Article 50	User disclosures, interaction design, machine-readable marking where applicable, testing, and documented exceptions.	Test real scenarios and verify that transparency works as intended.
GPAI provider	Technical documentation, information for downstream providers, copyright policy, and a training-content summary; additional evidence where systemic risk applies.	Trace obligations to current documents and accountable owners.
High-risk readiness	Classification, risk management, data governance, technical documentation, logs, instructions, human oversight, robustness, cybersecurity, accuracy, conformity assessment, and monitoring, as applicable.	Map obligation → control → evidence → audit procedure.
High-risk deployer	Use in line with instructions, competent and empowered human oversight, logs, monitoring, incident escalation, and a fundamental-rights impact assessment where required.	Verify controls operated in real decisions or incidents.

The practical audit principle is simple: evidence should allow another reviewer to reconstruct the regulatory decision and see that the control operated. A polished compliance matrix without records, test results, or traceable decisions may still be weak evidence.

The timeline auditors should use as of September 2026

The implementation calendar should be treated as controlled, versioned information. The current consolidated Act reflects the July 2026 amendments and differs from many roadmaps prepared in 2024 or 2025.

Date	What applies	Audit implication
2 Feb 2025	AI literacy and most prohibited practices began to apply.	Test prohibited-use coverage and context-appropriate literacy measures.
2 Aug 2025	GPAI-provider obligations and parts of the governance framework began to apply.	Identify any GPAI-provider role and distinguish new from legacy models.
2 Aug 2026	The Act became generally applicable; Article 50 transparency duties and Commission enforcement powers for GPAI also started to apply.	Treat transparency and relevant GPAI duties as current compliance.
2 Dec 2026	New prohibitions added in 2026 concerning certain non-consensual intimate material and child sexual abuse material begin to apply.	Update prohibited-use controls.
2 Aug 2027	Providers of GPAI models placed on the market before 2 Aug 2025 must have taken the necessary compliance steps.	Include legacy models in remediation and follow-up.
2 Dec 2027	Core Chapter III obligations apply to high-risk systems under Article 6(2) and Annex III.	Audit readiness for employment, education, biometrics, critical infrastructure, and other relevant areas.
2 Aug 2028	Those obligations apply to high-risk systems linked to products under Article 6(1) and Annex I.	Coordinate assurance with product-compliance and sector teams.

The postponement of high-risk requirements does not mean “wait.” It means separating obligations enforceable today from evidence-based readiness for future requirements. For systems likely to fall under Annex III, 2026 and 2027 are the period to close inventory gaps, resolve classification issues, clarify contracts, design controls, and begin generating operating evidence.

A practical audit can begin with five decisions

A first EU AI Act review does not require a generalist internal auditor to validate machine-learning mathematics. It can begin with five questions:

Scope: Which systems, models, entities, and output flows could fall within the Act?
Role: What role does the organization play for each use case, and could that role change because of branding, modification, or a change in intended purpose?
Classification: Is the use prohibited, high-risk, subject to transparency, built on GPAI, or outside those specific regimes?
Date: Is the obligation already applicable, transitional, or a readiness requirement for 2027 or 2028?
Evidence: Does each applicable obligation have an owner, control, record, and operating evidence sufficient to support a conclusion?

This avoids two common mistakes: turning the Act into a huge checklist without establishing applicability, and assuming that “we have an AI policy” means the organization is ready for compliance.

For auditors, the useful chain is more concrete: use case → scope → role → classification → obligation → control → evidence → conclusion. An auditor does not need to become an AI lawyer, but does need to make visible whether the organization can explain what AI it uses, under whose regulatory responsibility, under which obligation, and with what evidence it demonstrates compliance.