Sample EU AI Act Review Report for an SME

Management summary

Primer d.o.o. uses AI in five places and in all of them it is a deployer: it uses systems others built. None of the uses is a prohibited practice. Four carry obligations that already apply and take a few days to cover. One, ranking job applications, is a high-risk system and needs its own preparation by 2 December 2027: oversight, logs, informing candidates and a GDPR impact assessment.

Obligation	Applies from	Status	Action
AI literacy (Art. 4)	2 Feb 2025	not in place	#1
Prohibited practices (Art. 5)	2 Feb 2025	checked, no findings	#5 (written confirmation)
Chatbot disclosure (Art. 50)	2 Aug 2026	partial	#2
Labels on realistic AI images (Art. 50)	2 Aug 2026	not in place	#3
Deployer duties for a high-risk system (Art. 26)	2 Dec 2027	in preparation	#5, #6, #7
GDPR interface: processing agreements, notices, impact assessment	in force	partial	#4, #8

First (30 days): adopt the AI-use policy and record who has read it; put the disclosure text on the chatbot; label realistic AI images; replace personal accounts of the general assistant with business ones. Then: prepare the recruitment platform by December 2027, with the supplier and a lawyer.

Scope and method

Sources. Kick-off call (60 minutes; managing director, head of HR, marketing), an anonymous staff survey on AI tool use (27 of 40 answered), terms of use, processing agreements and instructions for use from five suppliers, and a review of the website and social media posts from the last three months.

Shadow use. Management named three tools. The survey found two more: an image generator in marketing and a general assistant that 11 people use with personal accounts. That is why an inventory never rests on the management interview alone.

Classification procedure, the same for every tool:

Is it an AI system? The definition in Article 3(1) and the Commission guidelines on the AI system definition. Plain rules and macros are not.
What is the company's role? Provider, deployer, importer or distributor. We also check Article 25: releasing a system under your own name or modifying it substantially would make you its provider.
Prohibited practices (Article 5). Among others, emotion recognition in the workplace, social scoring, manipulation.
High risk. Annex I (products) and Annex III (areas), exceptions under Article 6(3). Profiling of individuals is always high-risk under Article 6(3).
Transparency (Article 50). Interaction with people, deepfakes, text on matters of public interest.
General-purpose models underneath. The model provider's duties are not yours, but they can shape the contract with the supplier.
GDPR interface. Legal basis, processing agreement, transfers to third countries, Article 22 and impact assessment.

AI tool inventory

ID	Tool and purpose	Supplier, processing	Users	Data	Role	Class
T1	General AI assistant: e-mail, summaries, translation	US provider; business plan plus 11 personal accounts	≈25	occasionally client personal data	deployer	minimal
T2	Website chatbot: questions about orders and deliveries	EU SaaS provider	customers	name, e-mail, order number	deployer	transparency
T3	Candidate ranking in the recruitment platform	EU SaaS provider	HR, 2	CVs, cover letters	deployer	high risk
T4	Image generator for social media and the newsletter	US provider; personal account	marketing, 1	no personal data	deployer	transparency
T5	Invoice data extraction in the accounting software	domestic supplier, processed in the EU	accounting, 6	supplier data, amounts	deployer	minimal

Role and risk class depend on the use, not on the product. The same general assistant used to decide about people would move up a class. That is why every entry in the tool register (annex E) states its purpose and a responsible person.

Assessment per tool

T3Candidate rankinghigh risk · Annex III, point 4(a)

Classification

The system analyses and ranks job applications, which Annex III, point 4(a) names explicitly. The Article 6(3) exception does not apply: the system profiles candidates, and the ranking decides who makes the shortlist.

Prohibited practices

According to its documentation the platform does not analyse video interviews or recognise emotions (Article 5(1)(f)). Ask for written confirmation with question 7 in annex D.

Duties from 2 Dec 2027

use in line with the supplier's instructions (Article 26(1));
human oversight by a trained person with authority to change the ranking (26(2));
relevant input data, to the extent the company controls it (26(4));
monitoring and informing the supplier about risks (26(5));
keeping automatically generated logs for at least six months (26(6));
informing candidates that an AI system is used in the decision (26(11)).

Not required

A fundamental rights impact assessment (Article 27) does not apply to Primer: it is required of public bodies, providers of public services, and for creditworthiness and insurance.

GDPR

Impact assessment (Article 35) because candidates are evaluated systematically; right to human intervention (Article 22); updated privacy notice for candidates.

Residual risk

Biased ranking and rubber-stamping. Action #6 requires the reviewer to check the ranking for at least one in five applications and record the reasons.

T2Website chatbottransparency · Article 50

Classification: A system that interacts directly with people. Making sure people know they are talking to AI is the provider's duty (Article 50(1)); as deployer the company checks that it is switched on and clear.
Finding: The disclosure setting exists but is off. The first message reads "Hello, how can I help?".
Action: Switch disclosure on, use the text from annex C, and a clear hand-over with the word "person" (#2).

T4Image generatortransparency · Article 50

Classification: Realistic images of people, places or events that never existed are deepfakes; the deployer must disclose that they are AI-generated (Article 50). Graphics and obvious illustrations are not covered.
Finding: 14 posts in the last three months, 6 of them realistic photos of "staff" and "customers" without a label. The tool is used with a personal account.
Action: Label from annex C on realistic images; business account; rule in the policy (#3, #4).

T1 · T5General assistant and invoice extractionminimal risk

Classification: No specific duties under the Act beyond AI literacy (Article 4). For T5 a person still confirms each booking.
Finding: With T1, staff paste client data into personal accounts; there is no processing agreement for those, and the data may be used to train the provider's models.
Action: Business accounts only, with a processing agreement and training on your data switched off; rule in the policy (#1, #4).

Obligations matrix

Obligation	T1	T2	T3	T4	T5
Literacy, policy and record (Art. 4)
Prohibited-practice check (Art. 5)
AI interaction disclosure (Art. 50)
Deepfake labelling (Art. 50)
Deployer duties, high risk (Art. 26)
Processing agreement and transfers (GDPR)
Notices and impact assessment (GDPR)

missing partial or in preparation in place does not apply

Gaps and actions

#	Gap	Action	Owner	Due	Effort
1	No rules for using AI; no training record	Adopt the policy (annex A), 20-minute briefing, record (annex B)	managing director	15 Oct 2026	1 day
2	Chatbot does not say it is AI	Switch on disclosure with the supplier, text from annex C, hand-over to a person	marketing	3 Oct 2026	1 hour
3	Realistic AI images without a label	Label from annex C; fix 6 past posts	marketing	10 Oct 2026	2 hours, then ongoing
4	Personal accounts (T1, T4); client data without a processing agreement	Business accounts, processing agreement, training on data switched off	IT	31 Oct 2026	2 days
5	No supplier documentation for T3 on oversight, logs and emotion analysis	Supplier questionnaire (annex D)	HR	30 Nov 2026	1 hour + reply
6	No designated reviewer for rankings	Appointment, training, review rule (annex G)	HR	31 Mar 2027	1 day
7	Candidates are not told about AI use	Notice to candidates and updated privacy notice	HR, lawyer	30 Jun 2027	half a day
8	No impact assessment for T3	Impact assessment under GDPR Article 35	DPO, lawyer	30 Jun 2027	2–3 days
9	New tools are introduced without a check	New-tool procedure (annex F), register (annex E)	managing director	31 Dec 2026	half a day

Timeline

Within 30 days

policy and record (#1)
chatbot disclosure (#2)
image labels (#3)
business accounts (#4)

By end of 2026

recruitment supplier's answers (#5)
new-tool procedure and register (#9)
first register update

By 2 Dec 2027

reviewer and review rule (#6)
notice to candidates (#7)
impact assessment (#8)
logs kept at least 6 months

Annexes

AAI-use policyTwo pages, adapted to the company: approved tools, forbidden data, output review, disclosures, responsibilities.

BTraining record and briefingTable (name, date, policy version) and the outline of a 20-minute briefing for staff.

CDisclosure textsChatbot (SL, EN), hand-over to a person, label for images and video.

DSupplier questionnaireTwelve questions on role, instructions for use, logs, data location, training on your data and marking.

EAI tool registerSpreadsheet with all five tools, purpose, owner, class and next review date.

FNew-tool procedureA one-page checklist before anyone starts using a new AI tool.

GHR checklistReviewing rankings, recording reasons, informing candidates, keeping logs. Only where a high-risk area is found.

Annex A · excerpt 1. We use only AI tools listed in the register (annex E). New tools are approved by the managing director under the procedure in annex F.
2. We do not enter clients' personal data, salary data or contracts into AI tools, except tools covered by a processing agreement.
3. A person checks every AI output before it leaves the company or changes a booking.
4. Customers are told when they talk to AI. Realistic AI images are labelled.
5. Everyone who uses AI reads this policy when starting and once a year; HR keeps the record.

Annex D · excerpt from the questionnaire for the recruitment platform 3. Does your system rank or score candidates? Please attach the instructions for use under Article 13.
5. Which logs does the system keep automatically, where, and for how long can we retain them?
6. How can the reviewer change or reject a ranking, and where is that recorded?
7. Does the system analyse candidates' video, voice or facial expressions? Please confirm in writing.
9. Is our data used to train or improve your model?

Annex C · disclosure texts Chatbot (EN): Hi, I am an automated assistant (AI). I can answer questions about orders and deliveries. For anything else, or if you prefer a person, write "person" and a colleague will reply.
Chatbot (SL): Pozdravljeni, sem samodejni pomočnik (umetna inteligenca). Odgovorim na vprašanja o naročilih in dostavi. Za vse drugo ali če želite človeka, napišite "človek" in odgovoril vam bo sodelavec.
Image label: Image generated with AI. · Slika je ustvarjena z umetno inteligenco.

What this report does not cover

It is not legal advice and not a certification. No certificate of "AI Act compliance" exists for companies that use AI. We recommend that your lawyer reviews the documents.
It does not assess the suppliers' own obligations as providers. It lists what to ask them for (annex D).
It does not replace a GDPR impact assessment; it says where one is needed.
It reflects the law on 26 September 2026. When the rules change or a new tool arrives, the register and the report need an update.

Legal basis and sources

Regulation (EU) 2024/1689 on artificial intelligence (EUR-Lex), Articles 3, 4, 5, 6, 25, 26, 27, 50 and Annexes I and III.
Regulation (EU) 2026/1744 (Digital Omnibus): amended dates for high-risk systems.
European Commission guidelines on the AI system definition and on prohibited practices (2025).
Regulation (EU) 2016/679 (GDPR), Articles 13, 14, 22, 28 and 35.

Every AI tool in your company: inventoried, classified, documented.