EU AI Act
EU AI Act risk classification for providers and deployers
State the role, the use case and whether the system affects people. You get an indicative risk class and the registers, oversight and evidence to prepare.
An indicative aid for compliance work. It is not legal advice, a filing with an authority, or a certification.
The classes this tool distinguishes
Regulation (EU) 2024/1689 prohibits some practices, including social scoring and specific forms of real-time remote biometric identification. If the use case sits there, the result is “prohibited practice”: a policy does not cure it.
Annex III lists high-risk systems: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and justice. Providers and deployers have different duties, but both must show how the system is used.
Some systems are not high-risk but must be transparent to people, such as chatbots and synthetic content. Article 4 also requires literacy for anyone who operates or uses AI systems on behalf of the organisation.
What changes for the organisation that buys or uses a system
A deployer cannot stop at the vendor contract. You need instructions for use, human oversight, logs and — when the system is high-risk and affects rights — a fundamental-rights impact assessment in the cases the regulation requires.
An internal copilot at minimal risk still belongs in an inventory: system name, owner, data used and the uses that are off limits. Without that record, article 4 is a sentence, not a control.
From the result to a system register
Turn each outcome into a record: role, use case, class, owner, evidence and review date. Then attach it to controls already open for NIS2 or ISO/IEC 27001, instead of starting a parallel register.
FAQ
Does this officially classify my system under the AI Act?
No. It is a reading of role and use case. The class depends on the regulation, the annexes and how the system is actually used.
Does being a deployer mean there are no duties?
No. Whoever puts a high-risk system into service has its own duties: oversight, monitoring, logs and, where required, a fundamental-rights impact assessment.
Is an internal chatbot always minimal risk?
Not always. If it produces content for people, check transparency. If it decides on hiring, credit or access to services, it can fall into high risk.
What is article 4 AI literacy?
It is the measure that gives people who use or oversee the system skills fit for the context. Prove it with roles, training and limits of use, not with a generic slide.