What Auditors and Regulators Will Ask Under the EU AI Act

Who this hub is for

The eight question groups reviewers may test

Evidence routing map

Do not duplicate evidence work. Route each review question into the correct EU AI Compass page, then keep the evidence link in the AI system inventory.

Detailed reviewer questions and evidence records

1. Which AI systems exist?

The first test is traceability. A reviewer may ask for a list of AI systems, but the useful record is more specific: system name, owner, provider, intended purpose, affected persons, input data, outputs, business process, geography, status, and evidence location.

Evidence to prepare: AI system inventory, system owner, vendor, deployment status, use-case description, EU exposure, affected user groups, and next review date.

2. What is your role and classification rationale?

Article 6 treats AI systems as high-risk where they meet the safety-component/product route in Article 6(1) or are listed in Annex III, subject to the non-high-risk route and profiling override in Article 6(3). A reviewer may test whether the organisation stored the actual classification logic, not just a “high-risk: yes/no” value.

Evidence to prepare: role decision, intended-purpose note, Article 6 route, Annex III category, non-high-risk rationale if used, profiling check, unresolved classification log, and sign-off owner.

3. What did the provider or vendor hand over?

For deployers, provider evidence matters because Article 26 requires use in accordance with the instructions for use. Vendor due diligence should therefore focus on the deployer-facing handoff: what the system is intended to do, its limitations, oversight requirements, logging features, input-data assumptions, update process, and incident contact route.

Evidence to prepare: instructions for use, vendor evidence pack, limitation register, technical support route, model or system update notice process, incident handoff path, and procurement sign-off record.

4. Who oversees the system?

Article 26 requires deployers of high-risk AI systems to assign human oversight to natural persons with necessary competence, training, authority, and support. A policy line saying “humans remain accountable” is weak evidence if no named owner can intervene.

Evidence to prepare: oversight owner, competence/training record, escalation route, stop/pause authority, review schedule, operating procedure, and exception log.

5. What logs and operating evidence exist?

Article 26 requires deployers to keep automatically generated logs to the extent those logs are under their control, for at least six months unless other Union or national law provides otherwise. If logs include personal data, the retention model needs privacy, security, access-control, and purpose-limitation review.

Evidence to prepare: log source, log owner, retention period, access control, privacy review, export method, incident preservation rule, and evidence sample.

6. What Article 50 notices or labels apply?

Article 50 is not limited to high-risk AI systems. It covers specified transparency scenarios, including direct interaction with AI systems, provider-side machine-readable marking for synthetic content, deployer notices for emotion recognition or biometric categorisation, deepfake disclosure, and certain AI-generated or manipulated public-interest text.

Evidence to prepare: Article 50 trigger register, notice wording, placement evidence, screenshot or channel proof, exception rationale, accessibility check, approval owner, and review date.

7. Is FRIA or DPIA routing needed?

Article 27 requires specified deployers to perform a fundamental rights impact assessment before deploying certain high-risk AI systems. It also states that the FRIA complements a DPIA where relevant obligations are already met through data-protection assessment. That is a coordination point, not a reason to collapse the two records into one vague “impact assessment.”

Evidence to prepare: FRIA routing note, DPIA screening record, affected groups, use frequency, risk and mitigation record, privacy/legal owner, and update trigger.

8. What happens if risk or serious incident occurs?

Article 26 requires deployers to inform the provider or distributor and the relevant market surveillance authority where use may present risk, suspend use where required, and inform the provider first where a serious incident is identified. If the provider cannot be reached, Article 73 applies mutatis mutandis.

Evidence to prepare: risk escalation workflow, serious incident triage criteria, provider/importer/distributor contacts, market surveillance authority route, suspension authority, timeline log, and communications record.