Audit and myths
What “audit” means here
The name of this site uses “audit” in its everyday sense: looking at your own AI use against the text of the law. It is not a conformity assessment, not an assessment with legal effect and not a certification. Only providers (internal control) and notified bodies carry out conformity assessments under the Act (Art. 43).
Myths, corrected
“You need an AI Act certificate.”
No. The only AI Act certificates are issued by notified bodies to providers of some high-risk systems (Annex VII, Art. 44). Most Annex III systems use internal control, and deployers run no conformity assessment. Source: Art. 43, 44, Annex VI and VII of Regulation (EU) 2024/1689.
“High-risk rules apply from 2 August 2026.”
Not any more. Regulation (EU) 2026/1744 moved them to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Content written before July 2026 often shows the old dates.
“The AI Act requires annual AI training.”
No fixed training cycle is in the text. Art. 4 as amended asks providers and deployers to take measures to support AI literacy.
“Companies have already been fined under the AI Act.”
No AI Act fine has been verified in the sources checked. Enforcement started on 2 August 2026; claims of fines in early 2026 predate it.
“The AI Act requires compliance software.”
No provision requires software. Records can be kept in any form; the templates here are tables.
“The lowest fine tier is 1.5 %.”
The Act states up to EUR 7.5 million or 1 % for incorrect or misleading information (Art. 99).
Read the certificate answer
Who may certify, and what to show instead.