Executive self-assessment · Regulation (EU) 2024/1689
EU AI Act & Enterprise Readiness Scanner
Fourteen to fifteen questions, about eight minutes. You receive an indicative readiness score with its coverage, your documented strengths, the questions still open, up to three priorities and a 90-day roadmap built from your answers. It is a structured conversation starter for leadership, not a legal opinion, an audit or a certification.
What this assessment is, and is not
- A focused screen of typical enterprise AI use and governance, not a full classification of each AI system.
- Your role (provider, deployer, importer), the specific system and its intended purpose determine which obligations actually apply.
- "Don't know" is a legitimate answer. It is recorded as a question to clarify, never as a gap or a violation.
Background
What EU AI Act readiness means
EU AI Act readiness describes how well an organisation understands its use of AI systems and has the governance in place to meet the obligations of Regulation (EU) 2024/1689 that apply to its role and systems.
In practice this means knowing which AI is in use, what it is used for, which role the organisation holds (for example provider or deployer), and whether measures such as AI literacy, human oversight, transparency and data governance are documented.
Who this scanner is for
- Executives and managing directors who need a first, structured picture of AI governance.
- Legal, compliance and data protection functions preparing an internal discussion.
- HR, IT and business unit leads who introduce or operate AI tools.
- Organisations that mainly use third-party AI and want to clarify their role and duties.
Dimensions assessed
Eleven scored areas, three context questions and one conditional follow-up. Each scored area carries equal weight.
01 · Art. 6, Annex III
Purpose & classification
Where AI is used and whether uses may fall into high-risk areas.
02 · Art. 5(1)(f)
Prohibited practices
Emotion inference from biometric data in the workplace.
03 · Art. 4
AI literacy
Role-appropriate measures for people using or operating AI.
04 · Art. 26
Human oversight & records
Review of outputs, authority to override, logging.
05 · Art. 50
Transparency
Disclosure of AI interactions and relevant generated content.
06 · GDPR Art. 28, 35
Data governance & vendors
Contract terms, processing agreements, impact assessments.
07 · Good practice
AI inventory
Overview of tools in use, including shadow AI.
08 · Art. 25, 26
Procurement review
Checks on AI features before adoption.
09 · GDPR Art. 5, 32
Sensitive data & access
Classification, access controls and logging for AI use.
10 · Good practice
Ownership & policy
Named owner with mandate and an adopted policy.
11 · Good practice
Implementation readiness
Budget, people and a plan to act.
What the score means
- The score from 0 to 100 reflects documented readiness across the scored areas, based only on your own answers.
- Coverage shows how many scored questions received a known answer. "Don't know" counts as zero in the score and is listed as an open question, not as a gap or violation.
- Flags for potential high-risk or prohibited uses are shown independently of the overall score.
What the score does not mean
- It is not a legal opinion, an audit, a conformity assessment or a certification.
- It does not classify individual AI systems; that requires a system-level review.
- A high score does not confirm compliance, and a low score does not establish a violation.
The 90-day roadmap
Your report turns up to three priorities into a phased starting plan. A typical structure:
Days 1–30
Clarify and inventory
Answer open questions, list AI tools and uses, name an owner, check for potential prohibited or high-risk uses.
Days 31–60
Establish measures
Introduce literacy measures, define human review and logging, review vendor terms and data rules.
Days 61–90
Document and review
Collect evidence, prepare disclosures where relevant, agree a periodic review cycle.
Frequently asked questions
Is the scanner a legal assessment?
No. It is an indicative self-assessment that structures an internal conversation. Specific systems and obligations require individual legal review.
How long does it take?
Fourteen to fifteen questions, depending on your answers. Most people need about eight minutes.
Does the AI Act apply only to AI developers?
No. The regulation sets obligations for different roles, including providers and deployers. Which obligations apply depends on your role and on the specific system and its purpose.
What is AI literacy under Article 4?
Article 4 requires providers and deployers to take measures to ensure a sufficient level of AI literacy among staff dealing with AI systems, taking into account their context. The European Commission has published questions and answers on this topic.
What happens if I answer "Don't know"?
The answer is recorded as an open question. It counts as zero in the score, lowers coverage and appears in your report as something to clarify, not as a gap.
Do I receive the report by email?
No. The report is shown on the page after saving and can be downloaded as a PDF.
Which dates apply?
Application dates differ by provision and may be amended. Please check the official sources below for the current status.
Official sources
This page summarises; the official texts prevail.