EU AI Act High-Risk Compliance Pack

Five working instruments. One workbook.

Role Determination establishes which obligations attach to each system — and therefore which of the other components apply. The FRIA Template, Human Oversight Design, Annex IV Checklist, and Vendor Questionnaire then produce the evidence. Yellow cells are yours; every derived cell is a formula.

Three scope questions (S1–S3) test whether the Act applies at all: the Article 3(1) AI system definition, the EU nexus under Article 2, and the exclusions. Five role questions (R1–R5) then map each system to provider, deployer, importer, distributor, or provider by operation of Article 25 — roles are cumulative, and R5 is the trap question that catches customised and white-labelled tools. The output per system: scope result, role(s) held, and exactly which Pack components to complete. The Reasoning / Evidence column is your audit trail. A worked example ships in row 7.

A three-question trigger test first establishes whether Article 27 applies to you at all. Sections A–F then map one-to-one to Article 27(1)(a)–(f), each field carrying a guidance note describing what a complete answer contains. The Section D risk table rates each identified risk by likelihood and severity with the rating derived automatically. A sign-off block enforces separation of preparer, independent reviewer, and approving executive, and field F3 records the Article 27(3) notification to the market surveillance authority.

HO-01 to HO-07 cover the Article 14 oversight capabilities — understanding capacities and limitations, automation-bias awareness, output interpretation, the authority to disregard or override, the stop mechanism, and the two-person rule for biometric identification. HO-08 to HO-12 cover the Article 26 deployer duties — use per instructions, competent and authorised overseers, input data control, monitoring and incident escalation, and six-month log retention. For each: what a complete design looks like, your concrete measure, a named owner, a status, and where the evidence lives. This tab is designed to defeat the sentence “a human reviews the output.”

For providers: every item that must exist before a high-risk system is placed on the market — general description, elements and development process including data governance and cybersecurity, monitoring and control, performance metrics, the risk management system, lifecycle changes, harmonised standards, the EU declaration of conformity, and post-market monitoring — each with a status and location field. For deployers, importers, and distributors: a verification question per item, the specific thing to ask your vendor. Items a vendor refuses to evidence become findings in the Vendor Questionnaire.

The questions a deployer sends each AI vendor, covering identity and representation, classification and registration, conformity assessment and CE marking, technical documentation, risk management and data governance, end-user transparency against the 2 August 2026 deadline, human oversight support, accuracy and cybersecurity, post-market monitoring, GPAI dependencies, and contract and support — each with a “why it matters” column written to be sent as-is. Record the response, assess it, and assign follow-ups; the counter at the top gives the per-vendor summary line. One copy per vendor: duplicate the tab.

The Article 99–101 fine tiers and the full application timeline as amended by the Digital Omnibus, with an in-force status and a live days-remaining count per milestone. Deliberately presentation-ready: it is the page that goes into the leadership deck when someone asks why this programme is funded. Also included as a printable PDF one-pager.