Most compliance programs fail because they stay conceptual too long. This checklist translates Article 17 obligations into implementation workstreams that product, engineering, and compliance teams can execute. Use it as a program baseline, then adapt by sector and risk profile.
Phase 1: Scope and Classify
Start by determining exactly which systems and releases are in scope for high-risk obligations. Do not build controls for undefined scope.
Role clarity is essential. Provider obligations differ from deployer obligations, and role confusion is still one of the most expensive sources of rework.
- Inventory AI systems and classify high-risk status by intended purpose
- Confirm provider/deployer boundaries per product and customer scenario
- Track transitional handling for pre-existing market placements and modifications
Phase 2: Build Requirement-to-Control Mapping
Create a requirement matrix for Article 9-15 plus Article 17 control families. Each requirement needs an owner, operating procedure, and evidence artifact definition.
Where harmonised standards are not available or not fully covering requirements, document alternative technical measures and rationale explicitly.
- Risk management (Article 9) integrated with release and change controls
- Data governance (Article 10) with representativeness and bias-management logic
- Technical documentation and record-keeping readiness (Articles 11-12)
- Transparency, oversight, and quality thresholds (Articles 13-15)
Phase 3: Operationalize Lifecycle Controls
Documented procedures are necessary but insufficient. Controls must be active at design, testing, deployment, post-market monitoring, and incident stages.
A common weak point is change governance: teams track version changes but do not assess conformity impact with Article 3(23) substantial-modification logic.
- Pre-deployment verification with reproducible test evidence
- Supplier and external-component governance with risk-proportionate controls
- Change-management gates that trigger reassessment when required
- Traceability linking production versions to documentation and evidence
Phase 4: Build Post-Market and Incident Muscle
Post-market monitoring and serious incident readiness are where paper programs fail in real-world conditions. Build workflows now, not after launch.
Operational teams should run simulation drills at least quarterly so escalation pathways and reporting responsibilities are not theoretical.
- Define monitored performance and risk indicators by AI system
- Set thresholds, ownership, and response SLAs for adverse events
- Implement incident triage, regulatory reporting, and corrective action loops
- Retain evidence in a format usable for audit and authority requests
Phase 5: Governance, Training, and Evidence Quality
QMS effectiveness depends on competence and accountability, not just templates. Ensure responsible teams are trained on role-specific obligations and decision authority.
For readiness acceleration, use Annex IV documentation guidance and EU AI Act requirements baseline together with this checklist.
- Define accountable owners and escalation governance at management level
- Run role-based training for engineering, product, legal, and operations
- Use periodic internal audits with corrective actions and closure evidence
- Keep a regulator-facing evidence index current and reviewable
Frequently Asked Questions
What is the first thing to do for Article 17 compliance?
Establish scope and role boundaries. Without clear high-risk system scope and provider responsibility, every downstream control plan becomes unstable.
Do we need all harmonised standards finalized to be compliant?
No. You need compliant implementation of legal obligations. Harmonised standards help with presumption routes, but compliance work cannot wait for full publication completeness.
What evidence do auditors ask for first?
Typically control ownership, operating procedures, version-linked evidence artifacts, post-market monitoring records, incident handling logs, and proof that governance decisions are actually executed.
Key Takeaways
Article 17 compliance is a management system discipline, not a single project milestone. Teams that treat this checklist as a living operating model will be better prepared for both August 2026 applicability and ongoing supervisory scrutiny.