Compliance Scan

The EU AI Act sets rules for organisations that build, sell or use AI. This scan helps you quickly see which rules may apply to your organisation. You don't need any legal knowledge to fill it in.

You'll receive an overview of your organisation's role(s) and applicable EU AI Act requirements. After completing the Compliance Scan, you can continue with our Gap Analysis to find out what your organisation already complies with and what still needs to be done.

Before you start:

Answer on behalf of your organisation, not as an individual employee.
One AI system at a time. If your organisation uses multiple AI tools, such as ChatGPT, Microsoft Copilot or its own AI system/software, complete the scan separately for each one.
Not sure? Choose "I don't know" or ask a colleague who knows the system. Click the ⓘ icons for explanations of unfamiliar terms.

Need extra help? You can also complete the Compliance Scan together with a SimplyComplai advisor. Simply contact us to discuss the possibilities.

1/10

Let's get started

Know your organisation’s AI role

First we need to understand how your organisation uses AI. The EU AI Act sets clear rules for different types of users and applications.

In the next few questions, select the option that best describes your organisation’s situation. The questions will be tailored to your specific situation as you go.

What best describes your organisation’s relationship to the AI system?

Select one answer

Your organisation uses it professionally, for example in its products, services or internal processes. Think of ChatGPT or Copilot, but also AI features in HR or customer service software. Your organisation has developed it, or had it developed, and offers it under its own name. Your organisation has put its own name on, or has changed, an AI system made by someone else. Does your organisation also use this system itself? Then choose ‘Your organisation uses it professionally’ instead. Your organisation has built it into a physical product it makes and sells under its own name. For example a machine, medical device or toy. Your organisation brings it into the EU from a company based outside the EU. Your organisation sells or resells it, but didn’t make or import it. A company outside the EU has formally appointed your organisation to handle its EU AI Act obligations. None of the mentioned options I don't know

Is the software self-learning?

ⓘ

The EU AI Act only applies to software that counts as an "AI system". What sets an AI system apart is that it works out from its input how to produce its output, instead of only executing rules that people wrote in advance. Read Article 3 of the EU AI Act here

› More information

For example by learning from data, recognising patterns, or reasoning from a knowledge base. Think of chatbots, language models (like the ones behind ChatGPT or Copilot), image or speech recognition, or systems that make predictions or recommendations.

Select one answer

Yes No, it only carries out rules that were entirely set by people I don't know

We’ll continue as if the software is an AI system. Not sure? Check with the supplier or IT department how the software works.

Has your organisation changed the AI system in any of these ways?

Select one or more answers

Your organisation has put its own name or brand on it Your organisation uses it for a different purpose than the maker intended Your organisation has made a major change to it

ⓘ

A major change is a change the original maker did not plan for, which affects whether the system still meets the requirements, or changes what it is intended for. The EU AI Act calls this a "substantial modification". See Article 3(23)

None of the mentioned options

Has anyone further down the chain changed your organisation’s AI system in any of these ways?

Select one or more answers

They have put their own name or brand on it They use it for a different purpose than your organisation intended They have made a major change to it

ⓘ

None of the mentioned options

2/10

Deployer

You will now proceed as a Deployer

A deployer uses an AI system under their own responsibility, and not for purely personal and non-professional purposes. A deployer can be a natural or legal person, public authority, agency or other entity.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system.

3/10

Distributor

You will now proceed as a Distributor

A distributor is someone who makes an AI system available on the EU market. However, they do not put their own name or trademark on the system, and they are not responsible for its development or production.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system.

4/10

Importer

You will now proceed as an Importer

An importer is established in the EU and places an AI system with the name or trademark of someone established outside the EU on the market.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system.

5/10

Manufacturer

You will now proceed as a Manufacturer

A manufacturer develops or has an AI system developed. They place the system on the EU market, or put it into service, under their own name or trademark.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system.

Is your organisation’s AI system part of one of these products, especially for safety?

Select one or more answers

Gas appliances, such as boilers or cookers Cable cars and ski lifts Equipment for places with risk of explosion Elevators Lab tests for medical diagnoses Boats and jet skis Machinery Medical devices Personal protective equipment, such as helmets or gloves Pressure equipment, such as pressure vessels or pipes Radio equipment, such as WiFi or Bluetooth devices Toys None of the mentioned options

How does the AI system reach the market along with your organisation’s product?

Select one or more answers

It’s sold together with the product, under your organisation’s name It’s added or activated under your organisation’s name after the product is already on the market None of the mentioned options

6/10

Authorised Representative

You will now proceed as an Authorised Representative

An authorised representative is established in the EU, and has been formally authorised by a provider established outside the EU to carry out obligations under the EU AI Act on their behalf.

The authorised representative has a specific set of responsibilities. Therefore there will be no more questions in the Compliance Scan. In the Gap analysis we will assess how well your organisation meets these requirements.

7/10

Provider

You will now proceed as a Provider

A provider develops/modifies an AI system, or has it developed or modified, in order to place it on the EU market under their own name or trademark. It doesn't matter whether this is for payment or not.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system.

8/10

Provider (Dual Role)

You will now proceed as a Provider-Deployer with a dual role

Your organisation uses an AI system under its own authority, which makes it a deployer. Because your organisation has also changed the system, it additionally takes on the obligations of a provider.

The next questions help determine which responsibilities are relevant to your organisation, and to assess the risk profile of the AI system. Because the provider obligations are more comprehensive, the rest of this scan treats your organisation as a provider.

9/10

Compliance Questions

Where is the AI system offered or used?

Select one or more answers

Your organisation offers it, or puts it into use, in the EU (even if it is based outside the EU) Its results are used in the EU None of the mentioned options

Where does your organisation use the AI system?

Select one or more answers

Your organisation is based, or operates, in the EU Its results are used in the EU None of the mentioned options

Is the AI system a General Purpose AI model?

ⓘ

A General Purpose AI model can perform a wide range of tasks and can be built into many different AI systems. For example, the large language models behind ChatGPT, Claude or Gemini. (See Article 3(63))

Yes No N/A

Do any of the following apply to your organisation’s AI model?

Select one or more answers

Its capabilities have been assessed as "high impact", for example because it was trained with a very large amount of computing power The European Commission has decided that your organisation’s AI model has high impact None of the mentioned options

What is your organisation’s AI system used for?

Select one answer

Only for military, defence, or national security purposes For policing or judicial cooperation with the EU, by a government or international organisation outside of the EU Only for research and development, before it is offered or used It is released as free and open-source software Only for personal use, not for work None of the mentioned options

Does your organisation’s AI system do any of the following?

Select one or more answers

Sorting people into groups based on sensitive traits (such as ethnicity, religion or sexual orientation), using their face, fingerprints or other bodily features Taking advantage of people's age, disability or financial situation in a way that can harm them Building or expanding facial recognition databases by collecting images from the internet or security cameras Influencing people's behaviour in hidden or misleading ways that can harm them Predicting whether someone will commit a crime, based only on their profile or personality Recognising people from a distance in real time in public spaces, for police purposes Recognising people's emotions at work or at school (except for medical or safety reasons) Scoring people on their behaviour or personality, leading to unfair treatment None of the mentioned options

Is your organisation’s AI system part of one of these products or systems, especially for safety?

Select one or more answers

Aircraft and civil aviation Aviation security Trains and rail systems Ship equipment Cars, vans, trucks, and their trailers Motor bikes, scooters, three-wheelers and quad bikes Tractors and other vehicles for farming or forestry None of the mentioned options

Is your organisation’s AI system part of one of these products, especially for safety?

Select one or more answers

Does EU law require that an independent organisation checks the product or AI system before it is released on the market?

ⓘ

This independent check is called a "conformity assessment" and is carried out by a "notified body". The EU safety law that applies to the product states whether this check is required.

Yes No N/A

Is your organisation’s AI system used for one of these areas?

Select one or more answers

Courts, justice departments, or elections Recognition based on bodily features Critical infrastructure, such as energy, water, traffic, or digital networks Education, for example admissions, grading, or exam supervision Work and HR, for example recruitment, promotion, or monitoring staff Access to essential services, such as benefits, loans, insurance, or emergency services Policing and law enforcement Migration, asylum, and border control None of the mentioned options

Could your organisation’s AI system seriously harm someone's health, safety, or basic rights?

› More information

Choose No if your organisation’s system only does one of these:

Carrying out a small, limited task
Improving the result of work that a human has already finished
Spotting patterns or deviations from earlier decisions, without replacing human judgement, and with a human reviewing the final result.
Performing preparatory work for a decision in one of the areas from the previous question

Always choose Yes if your organisation’s AI system builds profiles of people, for example to evaluate their behaviour, preferences, or reliability.

Yes No N/A

Is your organisation a government body, or a private organisation that provides public services?

Yes No N/A

Does your organisation’s AI system do any of the following?

Select one or more answers

Talks or chats with people, for example a chatbot or voice assistant Creates images, audio, video, or text None of the mentioned options

Does your organisation’s AI system do any of the following?

Select one or more answers

Recognises people's emotions, or sorts people into groups based on their face, voice or other bodily features Writes or edits texts that your organisation publishes to inform the public about matters of public interest Creates or edits images, audio or video that look real but aren't (deepfakes) None of the mentioned options

10/10

End of the Scan

You're almost there!

You've completed the AI Compliance Scan.
Great job! You're one step closer to understanding the obligations for your organisation’s AI system.

Click the ‘Next’ button to see which compliance requirements apply to your organisation.

Final step

Your information

Please provide your details to receive your results and report.

Name *

Organisation

Email *

Your results

EU AI Act Gap Analysis

Processing your assessment...