EU AI Act Templates: 65 Documents for Providers + Deployers

Main article: EU AI Act Guide 2026 — risk classes, roles, deadlines and fines. This page answers the follow-up question: which documents do you need per risk tier and role? All articles on the topic are in the EU AI Act hub.

1. Templates by risk class

The AI Act (Regulation (EU) 2024/1689) aligns obligations with risk (recital 26). It starts with an AI inventory classifying each system: guidance in Creating an AI system inventory, a first assessment in the AI inventory quickcheck.

1.1 Prohibited practices (Art. 5) — since 2 February 2025

Art. 5(1)(a) to (h) prohibits, inter alia, manipulative techniques, social scoring (not only by public authorities), emotion recognition in the workplace and real-time remote biometric identification in publicly accessible spaces for law enforcement purposes (with narrow exceptions). From 2 December 2026, points (ba) and (bb) are added: non-consensual intimate deepfakes (point (ba)) and depictions of child sexual abuse as defined in Art. 2(c) and (e) of Directive 2011/93/EU (point (bb)). Term: Prohibited AI practice.

Templates needed: screening note in the inventory, classification decision, use policy with a catalogue of prohibitions. Documenting the check is a practice recommendation.

1.2 High-risk (Annex III + Annex I) — from 2 December 2027 and 2 August 2028 respectively

Annex III names eight areas: biometrics, critical infrastructure, education, employment, essential services (including creditworthiness of natural persons, life and health insurance), law enforcement, migration, administration of justice and democracy. Annex I covers AI as a safety component in, e.g., toys, lifts or medical devices; since 27 July 2026, pure assistance, optimisation or quality-control functions without safety relevance are not safety components (Art. 6(1a)). In depth: High-risk AI under Annex III.

Templates needed: provider set (section 2) and deployer set (section 3), in the kit folders 04 to 07.

1.3 Transparency obligations (Art. 50) — since 2 August 2026

Chatbots disclose that they are AI, synthetic content is marked in a machine-readable format, deployers disclose deepfakes (paragraphs 1 to 4). Providers of generative systems placed on the market before 2 August 2026 must comply with paragraph 2 by 2 December 2026 (Art. 111(4)). More: Transparency obligations under Art. 50.

Templates needed: chatbot notice, marking concept, disclosure rule for deepfakes.

1.4 Other AI systems — Art. 4 applies nonetheless

Spam filters or simple recommender systems trigger no specific obligations. However, providers and deployers take measures to support their staff's AI literacy; a specific level of competence is not owed (Art. 4(1) as amended since 27 July 2026). Art. 4 does not appear in the fine catalogues of Art. 99(3) to (5). Curriculum: AI literacy training curriculum.

Templates needed: AI literacy policy, training record, acceptable use policy. Anyone implementing only Art. 4 does not need a kit: the AI literacy e-learning costs from EUR 490 net.

2. Provider duties (Art. 16) — the core documents

Anyone who develops a high-risk AI system or has one developed and places it on the market or puts it into service under their own name or trademark is a provider. Art. 16 bundles the obligations from Art. 9 to 15, 17, 43 and 47 to 49; Chapter IX adds post-market monitoring (Art. 72) and serious incident reporting (Art. 73):

Three clarifications: Art. 12(3) prescribes fixed minimum logging content only for remote biometric identification (Annex III point 1(a)). Conformity assessment runs as internal control under Annex VI or with a notified body under Annex VII; for Annex III points 2 to 8 internal control applies, for point 1 Annex VII where harmonised standards are not applied, and for Annex I products the sectoral procedure (Art. 43(1) to (3)). SMEs and small mid-cap enterprises may provide the technical documentation using a simplified Commission form (Art. 11(1)).

When: Art. 16 is in Chapter III Section 3 and applies to Annex III systems from 2 December 2027, to Annex I systems from 2 August 2028. Preparing today is a practice recommendation, not an obligation in force.

3. Deployer duties (Art. 26)

Anyone who uses a high-risk AI system under their own authority is a deployer, even without developing it themselves. Applicable to Annex III systems from 2 December 2027, to Annex I systems from 2 August 2028:

• Instructions for use: ensure use in accordance with them (para. 1)
• Human oversight: assign it to persons with competence, training and authority (para. 2)
• Input data: relevant to the intended purpose and sufficiently representative, insofar as under their control (para. 4)
• Incidents: report a serious incident without undue delay, first to the provider, then to the importer or distributor and market surveillance (para. 5); the maximum periods apply to the provider's report: 15 days, 2 days for a widespread infringement or an incident under Art. 3 point (49)(b), 10 days in case of death (Art. 73(2) to (4))
• Logs: retain for at least six months (para. 6)
• Workers: inform workers' representatives and affected workers before putting into service or using the system at the workplace (para. 7)
• DPIA: use the provider information under Art. 13 (para. 9); see GDPR + EU AI Act for AI applications
• Affected persons: inform natural persons where an Annex III system makes or assists in making decisions related to them (para. 11)

Templates: deployer checklist, usage log, appointment of oversight, input data check, information for workers and affected persons, log retention, incident report.

4. FRIA — Fundamental Rights Impact Assessment (Art. 27)

The fundamental rights impact assessment concerns only deployers that are bodies governed by public law or private entities providing public services, and deployers under Annex III point 5(b) (creditworthiness of natural persons) and (c) (life and health insurance). Critical infrastructure (point 2) is excluded; HR use alone does not trigger a FRIA. To be carried out before first use, for Annex III systems from 2 December 2027.

Content under para. 1(a) to (f): deployment process, period and frequency, affected groups, risks of harm, human oversight, measures including complaint mechanisms. The result goes to the market surveillance authority (para. 3); a DPIA can be incorporated (para. 4). Template: FRIA template for Annex III, 4.

Germany: The fine provision has existed since 29 July 2026: infringements of Art. 27 are administrative offences with fines of up to EUR 50,000 (§ 15(1) nos. 3 to 5, (3) KI-MIG); no fines are imposed on public authorities and other public bodies (§ 17(2) KI-MIG); the obligation itself applies to Annex III systems from 2 December 2027. Austria: As at 17 August 2026, no market surveillance authority under Art. 70 AI Act has been designated.

5. GPAI — Art. 53-55

For providers of general-purpose AI models, a separate regime applies, supervised by the AI Office:

• Art. 53, since 2 August 2025: technical documentation (Annex XI), information for downstream providers (Annex XII), copyright policy, public summary of the training content; relief for open-source models without systemic risk
• Art. 55: for systemic risk, presumed at more than 10^25 FLOP of training compute (Art. 51(2)), alongside classification by Commission decision under Annex XIII (Art. 51(1)), additionally model evaluation with adversarial testing, risk mitigation, incident reporting, cybersecurity
• Code of practice: voluntary; providers may rely on it until a harmonised standard exists (Art. 53(4))
• Sanctions, legacy models: Commission fines of up to EUR 15 million or 3% since 2 August 2026 (Art. 101); models placed on the market before 2 August 2025 by 2 August 2027 (Art. 111(3))

Obligations in detail: GPAI provider obligations; documentation: GPAI Compliance Template Art. 53-55.

6. Overview table of the 65 documents

The EU AI Act kit contains 65 templates (47 Word, 17 Excel, 1 PowerPoint) in 12 folders. The kit page lists the individual files.

For GPAI model providers, the kit contains only the code of practice template, no templates under Annex XI and XII. Packages: Basic EUR 990 (59 documents, without folder 10), Plus EUR 1,390 (all 65 with the training pack), Complete EUR 1,690 (additionally the e-learning as HTML and SCORM 1.2/2004). Net and one-off, version for Germany or Austria, 12 months of legal-status updates, for businesses only: EU AI Act Kit.

7. Deadlines 2025–2030

• 2 February 2025: prohibitions under Art. 5(1)(a) to (h), AI literacy under Art. 4
• 2 August 2025: GPAI obligations, governance, penalty rules (excluding Art. 101); deadline for designating the national authorities (Art. 70(2))
• 2 August 2026: general date of application, including Art. 50 and Art. 101
• 2 December 2026: prohibitions Art. 5(1)(ba) and (bb); end of the transitional period for Art. 50(2) for legacy systems
• 2 August 2027: deadline for GPAI models placed on the market before 2 August 2025
• 2 December 2027: high-risk obligations for Annex III systems
• 2 August 2028: high-risk obligations for Annex I systems
• 2 August 2030: high-risk systems for public authorities placed on the market before Chapter III began to apply (Art. 111(2))

The postponement is based on Regulation (EU) 2026/1744, in force since 27 July 2026. Supervision in Germany: since 29 July 2026 the Federal Network Agency (Bundesnetzagentur) (§ 2(1) KI-MIG), unless sectoral authorities such as BaFin are competent. As at 17 August 2026, Austria has not designated an authority under Art. 70; the RTR AI service point advises without supervisory powers. Separately, in Austria the Data Protection Authority is the market surveillance authority under Art. 74(8) AI Act for high-risk systems in, inter alia, law enforcement, border management, justice and democracy; this is not a designation under Art. 70. Order of implementation: 12-month roadmap; all dates: Compliance deadlines calendar.