EU AI Act Risk Classification Checker

What is the EU AI Act?

The EU AI Act (Regulation (EU) 2024/1689) is the European Union's horizontal framework for regulating artificial intelligence. It entered into force on 1 August 2024 and applies obligations in phases through 2027. Rather than banning AI, it sorts AI systems into four risk tiers and attaches obligations proportionate to the harm each tier can cause. The philosophy is simple: the greater the potential impact on people's safety and fundamental rights, the stricter the rules.

The four tiers are Unacceptable (banned outright), High-risk (permitted subject to strict obligations), Limited-risk (transparency duties), and Minimal-risk (voluntary codes of conduct). The checker above maps your answers to this taxonomy.

Who it applies to — including non-EU companies

The AI Act has extraterritorial reach. Article 2 makes it apply to any provider whose AI system is placed on the Union market or whose output is used in the EU, regardless of where the provider is established. A US, UK, or Chinese company whose model serves EU users — directly or through a downstream deployer — is in scope. It also binds deployers (the organisations that actually use a high-risk system) and importers, distributors, and authorised representatives located in the EU.

The August 2026 high-risk deadline

The most consequential date for most teams is 2 August 2026. On that date, the obligations for high-risk AI systems in Articles 9 to 17 became applicable, along with most Annex III high-risk categories (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, and justice). Transparency duties for limited-risk systems (Article 50) and the rules for GPAI providers also apply from this date.

Three earlier dates are already in force: the prohibited-practices ban (Article 5) applied from 2 February 2025, general-purpose AI model obligations and AI literacy duties applied from 2 August 2025. One later date remains: 2 August 2027, when high-risk status applies to AI safety components embedded in products that themselves require third-party conformity assessment under Annex I, section B.

If your system is high-risk and you are not yet compliant with Articles 9 to 15, you are already exposed to enforcement and to fines of up to EUR 15 million or 3% of global turnover.

How risk classification works (the decision tree)

The checker above follows the Act's own decision logic. First it screens for prohibited practices (Article 5) — subliminal manipulation, exploitation of vulnerabilities, social scoring, untargeted facial-image scraping, emotion inference in workplaces and schools, social scoring, and real-time remote biometric identification in public spaces for law enforcement. If any applies, the system is Unacceptable and cannot be placed on the EU market at all.

If nothing is prohibited, it checks the two routes into High-risk status. The first is Annex I: an AI system that is a safety component of a regulated product — a medical device, machinery, a vehicle, a toy, a lift, or another product under Union harmonisation law — where that product itself requires third-party conformity assessment (Article 6(1)). The second is Annex III (Article 6(2)): standalone uses in eight sensitive areas, from biometric identification and critical infrastructure to employment, credit scoring, law enforcement, migration, and the administration of justice.

If the system is not high-risk, the checker asks about transparency (Article 50). Chatbots, deepfakes, AI-generated text, and emotion-recognition or biometric-categorisation systems trigger a lighter-touch regime: inform users they are interacting with AI and label synthetic content. Finally, for general-purpose AI models, it checks the systemic-risk threshold of 10²⁵ FLOPs (Annex XIII, Article 51), which adds model-evaluation and incident-reporting duties on top of the tier. Anything that clears none of these gates is Minimal-risk.

What high-risk obligations actually require (Articles 9 to 15)

A high-risk classification is not a ban — it is a list of engineering and governance duties you must satisfy before placing the system on the market and maintain throughout its life cycle. The core requirements are concentrated in Articles 9 to 15.

• Article 9 — Risk management system. A continuous, iterative process to identify, analyse, evaluate, and mitigate known and reasonably foreseeable risks. It runs across the lifecycle, not just at launch.
• Article 10 — Data and data governance. Training, validation, and testing datasets must be relevant, sufficiently representative, and free of errors to the extent possible. Special care is required for biases.
• Article 11 — Technical documentation. A complete record (Annex IV) covering the system's intended purpose, the data, the model architecture, training and testing, and post-market monitoring, kept before market placement and maintained current.
• Article 12 — Record-keeping (logging). Automatic event-logging capabilities to ensure traceability of the system's operation over time.
• Article 13 — Transparency to deployers. The system must come with clear instructions for use so deployers can interpret output and exercise oversight.
• Article 14 — Human oversight. The system must allow effective human oversight, appropriate to the autonomy and context, so a person can remain in meaningful control.
• Article 15 — Accuracy, robustness, and cybersecurity. The system must achieve appropriate levels of accuracy and be resilient against errors, faults, and attacks throughout its lifecycle.

Beyond Articles 9 to 15, high-risk providers need a quality-management system (Article 17), undergo the appropriate conformity-assessment procedure (Articles 43 to 47), affix the CE marking, register the system in the EU database (Article 49), and run post-market monitoring (Article 72) with a serious-incident reporting duty (Article 73).

Penalties

Enforcement is handled by national market-surveillance authorities and the EU AI Office, and the fines under Article 99 are deliberately large:

• Up to EUR 35 million or 7% of worldwide annual turnover (whichever is higher) for breaching the prohibited-practices rules in Article 5.
• Up to EUR 15 million or 3% of worldwide annual turnover for breaching the high-risk obligations, transparency duties, or GPAI provider obligations.
• Up to EUR 7.5 million or 1% of worldwide annual turnover for supplying incorrect, incomplete, or misleading information to notified bodies or national authorities.

For small and medium-sized enterprises and start-ups, each fine is capped at the lower of the percentage or the fixed amount.

How this checker works

This tool is a deterministic, rule-based classifier. Your answers are mapped to the same decision logic the AI Act itself uses — prohibited practices first, then Annex I and Annex III high-risk triggers, then Article 50 transparency, then the GPAI systemic-risk threshold. There is no machine-learning model, no API call, and no server. Every question and every result is computed locally in your browser by ordinary JavaScript, and your inputs are discarded the moment you close the tab.

The trade-off is that the checker cannot capture every nuance: borderline cases, deployer-specific duties, exemptions for scientific research and military use, and the interaction between the AI Act and sector-specific law all need human judgement. Use the result as a fast first read; then take it to a qualified lawyer or a notified body for a binding assessment.