T·01
Practical classification examples
Five real systems worked end to end — from the question, to the classification, to the actions each one triggers.
- 54
- pages, A4, printable
- 16
- chapters on the law
- 6
- working tools — four new in v2.2
- 02.12.2027
- the high-risk date the calendar runs to
Part I
What is inside: the law, in sixteen chapters
Six groups, each with the articles it walks through. Every chapter ends with the mistakes people actually make and a how-to for the record you have to produce.
- 01
Foundations and the four tiers
What the Act is, who it binds — including providers outside the EU whose output lands here — the Article 3 definitions, and how every system sorts into one of four risk tiers.
Art. 2Art. 3 - 02
Classification, worked properly
The questions in order, the Article 6(3) filter, and the profiling override that makes an Annex III system high-risk regardless of the filter. Ends with the mistakes people actually make.
Art. 6Annex III - 03
The seven pillars and your role
Articles 8–15 pillar by pillar, then the value chain: provider, deployer, importer, distributor — and how placing a system under your own name makes you the provider.
Art. 8–15Art. 23–26 - 04
QMS, conformity and CE marking
Article 17 as a standing system rather than a project, then the route to market in order: assess conformity, declare it, affix CE, register in the EU database.
Art. 17Art. 43Art. 47Art. 49 - 05
After launch, and transparency
Post-market monitoring and the incident clock that starts at awareness, then the Article 50 duties that reach far beyond high-risk — chatbots, generated content, deepfakes.
Art. 72Art. 73Art. 50 - 06
GPAI, literacy, enforcement and rights
Model-provider duties and what changes when you fine-tune, Article 4 literacy, who enforces and what it costs, the rights of people on the receiving end, sandboxes, and the GDPR overlap.
Art. 4Art. 53Art. 86Art. 99
Part II
Six working tools — fill-in material, not further reading
The thing you complete, not the thing you read. Four of the six are the headline addition in v2.2.
T·02
Building your Annex IV technical file
The most substantial high-risk deliverable, split into four sections with one owner each.
T·03New in v2.2
FRIA walkthrough and template
Who must run an Article 27 assessment, how to run it, and a fill-in template — plus why the DPIA cannot be copy-pasted into it.
T·04New in v2.2
AI system inventory template
The register everything else keys off. One row per system: bought, built, or embedded in something you already licence.
T·05New in v2.2
Serious-incident report form
Pre-fill sections 1–3 today so the clock never beats you. Deadlines run from awareness, not from confirmation.
T·06New in v2.2
12-month compliance calendar
Quarter by quarter, to arrive comfortably ahead of the 02.12.2027 high-risk date.
Why this one
Why start with the handbook
Plain English, not legalese
Every article is translated into language a busy team can act on — with practical examples rather than recitals.
Re-timed for the Omnibus
Standalone high-risk obligations apply from 02.12.2027 and Annex I product-embedded from 02.08.2028, deferred by Regulation (EU) 2026/1744. Article 50 transparency was not deferred — it has applied since 02.08.2026.
Six tools, not just reading
Part II is fill-in material: an inventory, a FRIA template, an incident form and a 12-month calendar. Four of the six are new in v2.2.
Deployer-first
Most EU organisations are deployers, not providers. The handbook leads with the Article 26 duties.
Mapped to the regulation
Every claim is anchored to a specific article, recital or annex — so your file points back to the source.
A path from reading to a register
When you are ready to stop tracking by hand, the Veritome toolkit picks up where the handbook leaves off.
Straight answers
Handbook: frequently asked questions
Who is this handbook for?
Anyone responsible for AI compliance in an EU organisation — compliance, legal, risk and product leads — whether you deploy third-party AI tools or build your own systems.
Is the EU AI Act handbook really free?
Yes. We ask for your name and work email so we can send occasional compliance updates; you can unsubscribe at any time. There is no account and no card.
How long is it, and what is inside?
54 pages. Part I is 16 chapters on the law; Part II is 6 ready-to-use working tools; the reference section closes with a complete compliance checklist, an FAQ, a glossary and the primary sources.
What changed in version 2.2?
Every chapter was deepened with article walk-throughs, step-by-step how-tos and common-mistakes notes, and four new working tools were added: a FRIA walkthrough and template, an AI system inventory, a serious-incident report form and a 12-month compliance calendar. The dates throughout are re-timed for the Digital Omnibus.
How is this different from the Veritome toolkit?
The handbook is the reading. The toolkit is the doing: it guides you through classification, derives the exact obligations that apply to each system, and assembles documentation from your live records — with you and your counsel making the decisions.
When does the EU AI Act apply?
In stages. Prohibited practices have been banned since 02.02.2025 and GPAI obligations have applied since 02.08.2025. Article 50 transparency has applied since 02.08.2026. Standalone Annex III high-risk obligations apply from 02.12.2027, and high-risk AI embedded in Annex I products from 02.08.2028 — both deferred by Regulation (EU) 2026/1744, in force since 27.07.2026.
Where to next
- Free tracker (Excel)The working half: register, classification, obligations and the incident clock in one file.
- EU AI Act guideThe regulation on one page — roles, tiers, dates, penalties.
- Article 50 guideThe transparency duties in force, with a free notice generator.
- Compliance guidesDeployer checklist, provider obligations, Annex IV, FRIA, oversight, GPAI.
- Free obligation checkWhich obligations reach one system, from its role and area.
- AcademyArticle 4 AI-literacy courses with a record of completion.
Looking for the download? The form is at the top of the page.