EU AI Act Risk Classifier
Answer up to eleven questions about one AI system and get its risk class under the EU AI Act, the obligations that follow for your role with the article behind each one, and the dates that apply after the July 2026 Digital Omnibus amendments. It is a screening aid for deciding where to spend legal time, and it does not replace legal advice. No email required.
Listen to this briefing
The EU AI Act Risk Classifier
Who the Act reaches
The AI Act applies to a provider that places an AI system on the EU market wherever the provider is established, and to a provider or deployer outside the EU when the system's output is used in the EU (Article 2(1)(c)). A Singapore HR platform that screens applicants for a Frankfurt office is in scope. So is a Dubai service whose credit decisions reach EU customers. For organisations in Asia and the Middle East, the output test is the one to check first.
The screening follows the order the Regulation applies its own tests: scope, role, the banned practices in Article 5, the two routes into high-risk under Article 6, the transparency duties in Article 50, and the separate track for general-purpose AI models. It stops as soon as an answer settles the outcome, so most systems need fewer than eleven questions.
Six tests in the Regulation's order, and the highest class wins
- 1ScopeDoes the Act reach the system? Article 2Can stop here: Outside the Act
- 2RoleProvider, deployer, importer or distributor. Article 3
- 3ProhibitedThe banned practices. Article 5Can stop here: Prohibited practice
- 4High-riskAnnex I or Annex III. Article 6
- 5TransparencyDisclosure duties. Article 50
- 6GPAI modelsGeneral-purpose model duties. Articles 51 to 55
The screening stops as soon as an answer settles the outcome. A high-risk system that also talks to people carries the transparency duties as well, but it is classed by the higher of the two.
Every article reference and date on this page was checked against the Official Journal texts of Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 on 25 October 2026. The basis table below links each rule to its source.
Describe the AI system
Answer for the system as it will be used in production. If your organisation holds more than one role for it, run the screening once per role.
Restored your saved answers.
Worked example: A Singapore HR software company licenses a tool to EU clients that ranks job applicants from their CVs and runs a candidate chat assistant.
Question 1
Risk class
Why
What follows for you
Dates that apply
| Date | What applies | Status |
|---|
Points to check
The report records your answers, the risk class, each obligation with its article, the dates with their status, and the sources. Print it or save it as a PDF from there.
This is a screening aid built on your own answers. It is not legal advice and does not establish how a regulator or court would classify the system. The Commission's guidelines on high-risk classification, harmonised standards and national enforcement practice can change the answer. Take the result to qualified counsel before relying on it. Your answers stay in your browser and are not sent to Terence Kok.
Application dates after the Digital Omnibus
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk dates back by sixteen months for Annex III systems and twelve months for Annex I systems. Article 50 and the general application date of 2 August 2026 did not move. Pages written before July 2026 still show the old high-risk date of 2 August 2026.
| Date | What applies | Article |
|---|---|---|
| 1 August 2024 | Entry into force. The AI Act entered into force twenty days after publication on 12 July 2024. | Art. 113, first paragraph |
| 2 February 2025 | Prohibitions and AI literacy. Chapters I and II apply: definitions, AI literacy (Art. 4) and the prohibited practices in Art. 5(1)(a) to (h). | Art. 113(a) |
| 2 August 2025 | GPAI models and governance. Obligations for general-purpose AI model providers, notified bodies, governance and penalties apply (Commission fines on model providers excepted). | Art. 113(b) |
| 27 July 2026 | Digital Omnibus in force. The amending regulation enters into force, three days after publication in the Official Journal on 24 July 2026. The Act’s amendments to sector legislation in Articles 102 to 110 apply from the same day (Art. 113(d)). | Reg. (EU) 2026/1744, Art. 4 |
| 2 August 2026 | General application. The rest of the Act applies, including Article 50 transparency duties and Commission fines on GPAI model providers (Art. 101). | Art. 113, second paragraph |
| 2 December 2026 | New prohibitions and marking grace period ends. Bans on non-consensual intimate content and child sexual abuse material apply. Generative systems already on the market before 2 August 2026 must mark outputs under Art. 50(2). | Art. 113(a) and Art. 111(4) as amended |
| 2 August 2027 | Legacy GPAI models. General-purpose AI models placed on the market before 2 August 2025 must comply. National AI regulatory sandboxes must be operational (Art. 57(1) as amended). | Art. 111(3) |
| 2 December 2027 | Annex III high-risk systems. Chapter III Sections 1 to 3 apply to high-risk systems listed in Annex III. The original date was 2 August 2026. | Art. 113(c)(i) as amended |
| 2 August 2028 | Annex I high-risk systems. Chapter III Sections 1 to 3 apply to high-risk systems in products under Annex I. The original date was 2 August 2027. | Art. 113(c)(ii) as amended |
| 2 August 2030 | Legacy public-sector high-risk systems. High-risk systems already on the market and intended for public authorities must comply. | Art. 111(2) as amended |
Sources for each rule
Each rule the classifier applies is traced to the article that sets it. Where the Omnibus changed a provision, the row cites the amending article as well.
Show the 16 rules and their sources ▸
| Rule | Source |
|---|---|
| The Act reaches providers placing systems on the EU market wherever they are established, EU deployers, and non-EU providers and deployers whose output is used in the EU | AI Act, Art. 2(1)(a) to (c) Source → |
| Defence and national security, sole-purpose scientific research, pre-market development and personal non-professional use are excluded | AI Act, Art. 2(3), (6), (8) and (10) Source → |
| Provider, deployer, importer and distributor are defined roles; a deployer, importer or distributor that rebrands, substantially modifies or repurposes a high-risk system becomes its provider | AI Act, Art. 3(3), (4), (6), (7); Art. 25(1) Source → |
| Eight prohibited practices apply from 2 February 2025; two more on intimate content and child sexual abuse material apply from 2 December 2026 | AI Act, Art. 5(1)(a) to (h); Art. 5(1)(ba), (bb) and 5(1a) inserted by Reg. 2026/1744, Art. 1(7); Art. 113(a) as amended Source → |
| A product or safety component under Annex I is high-risk where the product needs third-party conformity assessment; assistance and optimisation features are not safety components unless their failure endangers health and safety | AI Act, Art. 6(1); Art. 6(1a) to (1c) inserted by Reg. 2026/1744, Art. 1(8) Source → |
| Machinery moved from Annex I Section A to Section B, so only Art. 6(1), 60a and 102 to 112 apply directly to it | Reg. 2026/1744, Art. 1(2) and 1(41); Art. 3 (Machinery Regulation, Art. 8) Source → |
| Annex III uses are high-risk unless an Article 6(3) condition applies and the system does not materially influence the decision; a system that profiles individuals is always high-risk | AI Act, Art. 6(2), 6(3); Annex III Source → |
| A provider relying on Article 6(3) documents the assessment and still registers the system | AI Act, Art. 6(4), Art. 49(2); Annex VIII Section B as amended by Reg. 2026/1744, Art. 1(42) Source → |
| High-risk requirements, and provider, deployer, importer and distributor obligations | AI Act, Art. 9 to 17, 22 to 27, 43, 47 to 49, 72, 73, 86 Source → |
| Fundamental rights impact assessment for public bodies, private providers of public services, and credit and insurance deployers | AI Act, Art. 27(1); Art. 27(4) as amended Source → |
| Chatbot disclosure, machine-readable marking, emotion recognition and deep fake disclosure apply from 2 August 2026; generative systems already on the market have until 2 December 2026 to mark outputs | AI Act, Art. 50(1) to (4); Art. 111(4) inserted by Reg. 2026/1744, Art. 1(39) Source → |
| General-purpose AI model providers document, inform downstream providers, keep a copyright policy and publish a training summary; systemic-risk models above 10^25 FLOPs add evaluation, risk mitigation, incident reporting and cybersecurity | AI Act, Art. 51 to 55; Art. 111(3) Source → |
| AI literacy: providers and deployers support the AI literacy of their staff, with no duty to guarantee a specific level | AI Act, Art. 4 as replaced by Reg. 2026/1744, Art. 1(5) Source → |
| High-risk obligations apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I); legacy public-sector systems by 2 August 2030 | AI Act, Art. 113(c) and Art. 111(2) as amended by Reg. 2026/1744, Art. 1(39), (40) Source → |
| Fines of up to EUR 35 million or 7% for prohibited practices and EUR 15 million or 3% for operator and transparency breaches; the lower figure for SMEs and small mid-caps | AI Act, Art. 99(3), (4), (6); Art. 99(6a) inserted by Reg. 2026/1744, Art. 1(38) Source → |
| The Commission’s published timeline matches the amended dates | European Commission, regulatory framework for AI Source → |
| The order of the questions, the choice of which questions to skip, and the grouping of obligations | Screening design by Terence Kok. The Regulation does not prescribe a classification procedure, and the Commission's guidelines on Article 6 should be read alongside the result. |
Reading the result
Classification order
The class is the highest one the system reaches: prohibited, then high-risk, then transparency obligations, then minimal risk. Transparency duties also attach to high-risk systems, so a high-risk chatbot carries both sets.
- An Annex III system that profiles individuals is high-risk whatever its role in the decision
- The Article 6(3) derogation still leaves the provider with a documented assessment and an EU database registration
- Answer for the intended purpose the provider states, which is what the Act classifies
- If one answer is contested, run the screening both ways and record the difference
Role and obligations
Providers carry the Chapter III requirements and the conformity assessment. Deployers carry use, oversight, logging and disclosure duties. Importers and distributors verify what the provider did.
- An enterprise that puts its own brand on a vendor's high-risk system, or repurposes a general tool for hiring or credit, becomes the provider under Article 25
- A provider outside the EU needs an authorised representative in the EU before the system is made available
- Write the role into the contract with your vendor or customer
- Ask a vendor relying on Article 6(3) for its documented assessment
Dates after the Omnibus
The result lists only the dates that touch your system and marks each one as applying now or upcoming, measured against today's date in your browser.
- Annex III obligations now apply from 2 December 2027, but the conformity work for a system released then has to start well before
- A high-risk system already on the market before its date falls under the Act after a significant design change, and public-sector systems must comply by 2 August 2030
- Put the dates in the result on the AI risk register next to the system
- Re-run the screening when the Commission publishes further guidance or amendments
About this tool
This classifier was built by Terence Kok, a certified ISO/IEC 42001 Lead Auditor and AIGP, who has unified AI governance across three national regulatory environments under a single standard. The rules were checked against the AI Act and the Digital Omnibus on AI as published in the Official Journal.
See the full certification list →Once you know the class, the Agent Risk Assessment Matrix sets the oversight tier and controls for each AI agent. The ISO 42001 AIMS Readiness Checklist tests the management system that a high-risk provider's quality management system can build on. The Board AI Oversight Checklist tests whether the board could answer for the result.
EU AI Act readiness
The screening tells you which obligations to plan for. Building the inventory, assigning roles with vendors and preparing the evidence for conformity assessment is work I do directly with clients.
Book a private session
A common question about the AI Act is whether it applies to a company with no office in Europe. It often does, through the output test in Article 2(1)(c). The dates moved in July 2026, and a lot of what is still published online shows the old August 2026 deadline for high-risk systems, so I checked every date here against the Official Journal. Use the result to decide where your legal budget goes first.
Last updated 25 Oct 2026
More in Board and governance
- Board AI Oversight ChecklistIs our board actually overseeing AI, or just receiving updates about it?
- Technology Risk Board PackCould our bank answer the questions MAS put to DBS in 2023?
- ISO 42001 AIMS Readiness ChecklistHow far are we from passing an ISO/IEC 42001 audit?
- ISO/IEC 42001 Clause Readiness CalculatorWhich clauses would an auditor grade as a nonconformity, and are we ready to book Stage 1?
- Oversight Ceiling CalculatorHow much AI output can go out unreviewed before our quality promise breaks?
- Public Sector Algorithmic Impact AssessmentWhat impact level is this government AI system, and which safeguards does that level require?
- AI Trust, Risk and Governance DashboardAre our live systems fair, traceable and secure?
