Score Your Own AI System Against the EU AI Act in 45 Minutes
By the end of the 45 minutes you will have a number from 0 to 100 for one AI system, the band it falls in, and the three actions that raise it fastest. You need one system, one person who knows it, and the table below. No tool, no account, no fee.
What you need
- One AI system. If you have several, run the clock once per system; scores do not average well across systems.
- The text of Regulation (EU) 2024/1689 on EUR-Lex for anything you want to check.
- The Commission’s free AI Act compliance checker on the Single Information Platform, for minute 5.
- A copy of the scorecard table in a spreadsheet, or the 12-line Python script at the end.
Minutes 0 to 10: the tier
Answer in order and stop at the first match. The dates are the ones set by the Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026 (EUR-Lex; summary by Gibson Dunn).
| Question | If yes | Obligations apply from |
|---|---|---|
| Is the use listed in Article 5 (social scoring, manipulation, untargeted facial scraping, emotion recognition at work or school, and the practices the Omnibus added)? | Prohibited: stop | 2 February 2025 |
| Is it a safety component of a product under Annex I (machinery, medical devices, toys, lifts)? | High-risk, Annex I route | 2 August 2028 |
| Is its intended purpose in Annex III, and does no Article 6(3) exemption apply? | High-risk, Annex III route | 2 December 2027 |
| Does it talk to people, generate content, or produce deepfakes? | Limited risk, Article 50 transparency | 2 August 2026 (grace to 2 December 2026 for systems already on the market) |
| None of the above | Minimal risk; Article 4 literacy still applies | 2 February 2025 |
Write the tier at the top of your sheet. If you hesitate between two rows, our risk classification guide has the edge cases; spend the five spare minutes there or on the Commission checker.
Minutes 10 to 35: the scorecard
Score each item 0 to 3: 0 not addressed, 1 planned, 2 partly done, 3 done and documented. “Documented” means a file with a date that someone else could read. Be strict; a generous score only delays the work.
| # | Item | Article | Score 0-3 |
|---|---|---|---|
| A. Scope, weight 15 | |||
| A1 | We keep an inventory of every AI system we build or use | Art. 4, 26 | |
| A2 | This system was checked against the Article 5 list and the check is written down | Art. 5 | |
| A3 | The Annex III decision, including any Article 6(3) reasoning, is written down | Art. 6 | |
| B. Documentation and data, weight 20 | |||
| B1 | Technical documentation exists (SME simplified form of Art. 11(1) is fine) | Art. 11, Annex IV | |
| B2 | Training, validation and test data are described: source, scope, known gaps, bias checks | Art. 10 | |
| B3 | Personal data has a lawful basis, and a DPIA exists where Article 35 GDPR requires it | GDPR Art. 6, 35 | |
| C. Risk and accuracy, weight 20 | |||
| C1 | A risk register exists with likelihood, severity, mitigation and owner | Art. 9 | |
| C2 | Accuracy is measured against the intended purpose, with numbers and dates | Art. 15 | |
| C3 | Robustness and security were tested: bad inputs, drift, prompt injection, model theft | Art. 15 | |
| D. Transparency and oversight, weight 20 | |||
| D1 | Instructions for use exist and reach the people who operate the system | Art. 13 | |
| D2 | A named person can override or stop the system, and has done so in a drill | Art. 14 | |
| D3 | People know when they are talking to AI or reading AI output | Art. 50 | |
| E. Quality and monitoring, weight 15 | |||
| E1 | A quality management system exists, proportionate to our size | Art. 17 | |
| E2 | A post-market monitoring plan says what we watch and how often | Art. 72 | |
| E3 | Logs are kept and a serious-incident procedure names who reports within 15 days | Art. 12, 73 | |
| F. Governance and literacy, weight 10 | |||
| F1 | Staff who use the system have had AI literacy training and it is recorded | Art. 4 | |
| F2 | One named person owns AI Act compliance | Art. 17, 26 | |
| F3 | Supplier contracts assign obligations, and we hold the provider’s declaration of conformity where one is due | Art. 25, 47 |
Each domain has three items, so the raw maximum per domain is 9. Weighted domain score = raw ÷ 9 × weight. Total = sum of the six weighted scores, out of 100.
Minutes 35 to 45: the band and the three actions
| Band | Score | What it means | Next 30 days |
|---|---|---|---|
| Ready | 85 to 100 | Documentation exists and is maintained | Schedule the Annex VI checks if high-risk; otherwise an annual review |
| Substantially there | 70 to 84 | Core work done, targeted gaps | Close the lowest-scoring domain |
| Partly there | 50 to 69 | Real gaps in one or more domains | A remediation plan with owners; do not ship a high-risk system yet |
| Early | 30 to 49 | Work has started | Prioritise B, C and D, in that order |
| Not started | 0 to 29 | Awareness only | Run the inventory (A1) this week; book the literacy sessions (F1) |
Then the rule for the three actions: take the domain with the lowest weighted percentage, and list its items scored 0 or 1. Those are actions one to three. Ties go to B, then C, then D, because documentation and risk work feed everything else.
For a high-risk system, the band tells you how far you are from the Annex VI checks in our conformity assessment checklist. For a minimal-risk system, a score above 70 is already more than the law asks; keep A1, D3 and F1 at 3 and move on.
The arithmetic in 12 lines
# scorecard.py — paste your 18 scores, get the total and the weakest domain
WEIGHTS = {"A": 15, "B": 20, "C": 20, "D": 20, "E": 15, "F": 10}
SCORES = { # 0..3 per item, in order A1..A3, B1..B3, ...
"A": [3, 2, 1], "B": [1, 1, 2], "C": [2, 1, 0],
"D": [2, 3, 3], "E": [1, 0, 1], "F": [2, 3, 1],
}
weighted = {d: sum(s) / 9 * WEIGHTS[d] for d, s in SCORES.items()}
total = sum(weighted.values())
weakest = min(weighted, key=lambda d: weighted[d] / WEIGHTS[d])
for d in WEIGHTS:
print(f"Domain {d}: {weighted[d]:5.1f} / {WEIGHTS[d]}")
print(f"Total {total:.0f}/100 — weakest domain {weakest}")The example scores print a total of 55 and point at domain E: a “partly there” system whose next three actions are the post-market plan, the incident procedure and the QMS.
Play the auditor with a local model
Before you trust your own scores, let a model argue with them. This runs on a 16 GB laptop:
ollama run qwen2.5-coder:7b "I scored my AI system on an EU AI Act scorecard. For each item where I \
gave myself 3, ask me one question an auditor would ask to see the evidence. Items: [paste your 3s]. \
Be specific: name the document, the date and the person you would expect to see."If you cannot answer a question in one sentence with a file name, lower the score to 2. In our own runs this step moved two or three items per system.
Honest limits
- This is a self-assessment. For Annex III systems the legal act is the conformity assessment under Article 43; the scorecard tells you when you are ready to start it, not that you passed it.
- The weights are ours, calibrated on small-company deployments. A biometric or a credit-scoring system should weight C and D higher.
- A score measures documentation and process. It does not measure whether the system is fair or accurate; C2 and C3 do, and only if you actually ran the tests.
Next steps
- Turn the band into the procedure: Article 43 conformity assessment checklist.
- Raise F1 this month: Article 4 AI literacy training plan.
- Raise D2: Human oversight, Article 14. The whole map is on our EU AI Act hub.
- Grab the template: Conformity assessment checklist (Article 43).
- Grab the template: AI literacy training plan (Article 4).
Work with us
We run this scorecard with clients as the first hour of any engagement, and we hand over the sheet whether or not the engagement continues. If you would like that hour, get in touch or read how our consulting works.