EU AI Act risk classification places each AI system in one of four tiers: prohibited practice, high risk, limited risk (transparency obligations) or minimal risk. The tier, combined with your organisation role (provider, deployer, importer or distributor), determines the obligations. This tool applies the rules of Articles 5, 6 and 50 and Annexes I and III to your answers and shows an indicative result.
How to use
- Name the system and say whether it is an AI system or a general-purpose model.
- Choose your organisation role and the link between the system and the European Union.
- Tick any prohibited practices, high-risk areas and conditions for the Article 6(3) exception.
- Tick the transparency triggers and read the tier, the role and the indicative obligations.
- Export as DOCX or PDF and keep the classification next to your AI inventory.
What each field asks for
| Field | What to enter |
|---|---|
| System or use case name | How the system is known inside the organisation. |
| Is it an AI system? | A machine-based system that infers from its inputs how to generate predictions, content, recommendations or decisions. |
| Is it a general-purpose AI model you place on the market? | A model able to perform a wide range of distinct tasks and be integrated into other systems. |
| What is your organisation role? | The Act allocates obligations according to the role in the value chain. |
| Are you a public body or do you provide a public service? | It changes the duty to assess the impact on fundamental rights. |
| Link with the European Union | Tick all that apply. With no link to the EU, the Act does not apply. |
| Exclusions | Tick only if the use is exclusively one of these. |
| Does the system do any of these? | Practices prohibited by Article 5. Leave empty if none applies. |
| Is it a safety component of a regulated product (Annex I)? | E.g. machinery, medical devices, toys, when they require third-party conformity assessment. |
| High-risk areas (Annex III) | Tick the areas where the system is used. |
| Conditions for the Article 6(3) exception | Only for Annex III systems that do not materially influence the outcome of decisions. |
| Does the system profile natural persons? | With profiling, the exception cannot be used. |
| Transparency triggers (Article 50) | Tick what the system does. |
Example
A fictional bank, Aurora Bank, uses a credit scoring model bought from a vendor in the EU, and the model profiles customers. The tool ticks the essential services area of Annex III and, because there is profiling, the exception does not apply: the result is high risk, with the bank acting as deployer. It lists nine indicative obligations, including human oversight by trained people, keeping the logs, a fundamental rights impact assessment (FRIA), a DPIA and AI literacy.
When to use
- When you record a new AI use case in the organisation inventory.
- Before buying or procuring an AI system from a vendor.
- When an existing system changes purpose, audience or market.
- To prepare the conversation with legal counsel about what the Act requires for each system.
Frequently asked questions
What are the EU AI Act risk tiers?
There are four: prohibited practices (Article 5), high-risk systems (Article 6 and Annexes I and III), systems with transparency obligations (Article 50) and minimal risk. General-purpose AI models have their own rules, which add to those of the system.
What is the difference between a provider and a deployer?
The provider develops the system and places it on the market or puts it into service under its own name. The deployer uses the system under its authority in a professional context. Anyone who puts their own brand on a high-risk system or substantially modifies it is treated as a provider.
Is every Annex III system high-risk?
No. Article 6(3) provides an exception for systems that do not materially influence the decision, for example when they only perform a narrow procedural or preparatory task. The exception never applies when the system profiles natural persons, and it must be documented.
When do the obligations apply?
The Act applies in phases, and its timelines were amended after publication. That is why the tool shows no dates: check the official text and the European Commission communications for the date currently in force for each obligation before you plan.
Is the result legal advice?
No. It is an indicative classification based on your answers, meant to organise the analysis. Borderline cases, such as the definition of an AI system or the Annex III exception, need validation by qualified counsel.
Which DPCert certification covers the EU AI Act?
RAIF (Responsible AI Foundation), the entry-level certification, covers principles and frameworks, including the EU AI Act risk tiers. RAIP (Responsible AI Practitioner) goes deeper into the regulatory landscape and risk and impact assessment.