Rost CAMP

EU AI Act readiness checklist for AWS teams

Answer each question with yes, no or not sure. Every “no” or “not sure” is a gap worth closing, or a question for your counsel.

This is a technical readiness assessment of your cloud environment. It is not legal advice and does not certify compliance. Engage qualified counsel for legal interpretation. Article numbers refer to Regulation (EU) 2024/1689.

Inventory

  • Do you have a list of every AI system you build or use, including Amazon Bedrock and SageMaker endpoints, and AI features inside SaaS tools?
  • For each one, do you know whether you are its provider (you build it or put your name on it) or its deployer (you use it under your authority)?
  • Is there a named owner for each system, and a record of what it is used for?

Risk classification

  • Have you checked every use against the prohibited practices in Art. 5, such as social scoring or emotion recognition at work?
  • Have you checked every use against the high-risk areas in Annex III, such as recruitment, credit scoring or access to essential services (Art. 6)?
  • Have you recorded why each system is, or is not, high-risk?

AI literacy

  • Have the people who operate or rely on these systems had training proportionate to their role (Art. 4)?

Transparency

  • Do users know when they are talking to a chatbot rather than a person (Art. 50)?
  • Is synthetic image, audio or video content, and deepfakes in particular, marked or disclosed as AI-generated (Art. 50)?

Deployer duties for high-risk systems

  • Do you use each high-risk system according to its provider's instructions for use (Art. 26)?
  • Is human oversight assigned to named people with the competence and authority to intervene (Art. 26)?
  • Are the logs the system generates kept for at least six months, in your own AWS accounts, with retention you can prove (Art. 26)?
  • Do you inform the people affected, and workers' representatives before workplace use (Art. 26)?
  • If you are a public body or provide public services, have you done a fundamental-rights impact assessment (Art. 27)?

Evidence on AWS

  • Is Bedrock model invocation logging, or the equivalent for your endpoints, switched on and retained?
  • Can you show which model and version served a given decision, and when it changed?
  • Are CloudTrail and your application logs protected from deletion by the team that runs the system?

When the duties apply

2 February 2025
Prohibited practices and AI literacy apply.
2 August 2025
Obligations for general-purpose AI model providers apply.
2 August 2026
Most remaining obligations apply, including transparency and the Annex III high-risk duties, unless the EU amends the timeline.
2 August 2027
High-risk rules for AI in regulated products (Annex I) apply.

Too many “not sure” answers?

The AI Act deployer readiness assessment turns this checklist into evidence: an inventory, a risk-tier classification and a prioritised gap list for your AWS estate.

See the readiness packages