EU AI Act
EU AI Act Risk Classification Template
A worksheet for one AI system under Regulation (EU) 2024/1689, as amended by the Digital Omnibus (Regulation (EU) 2026/1744). Work through scope, role, the Article 5 prohibitions, the two high-risk routes, the Article 6(3) derogation and Article 50 transparency. Tiers can stack. This is not a conformity assessment and it is not legal advice. Confirm the consolidated text on EUR-Lex before you rely on a date.
Last reviewed
Template only — not legal advice.
When to use
- Before a provider places a system on the Union market or puts it into service there.
- Before a deployer established or located in the Union starts using a system whose tier is not already documented.
- When a team outside the Union needs to decide whether output used in the Union brings the system into scope under Article 2(1)(c).
- When a change of name, trademark, a substantial modification, or a change of intended purpose might make a deployer, distributor or importer the provider under Article 25.
How to use this template
- 1
Complete one copy per AI system. Two intended purposes are two systems, even when they share a model.
- 2
Answer scope and role before the risk tier. If you record the system as out of scope, write the reasoning and stop. Do not leave the later sections half-filled. That stop does not apply to a military, defense or national security use that is not exclusive, or to personal use by a natural person when you are the provider. A provider or a dual-use system must continue to the prohibited-practices and transparency screens.
- 3
Treat any "yes" on the prohibited-practices screen as a stop. Escalate to legal. Do not design around it in this worksheet.
- 4
Record the resulting tier, the date that tier's obligations apply, and the name of the lawyer who reviewed the reasoning.
- 5
Run the worksheet again after a substantial modification or a change of intended purpose. Article 25 can also change who the provider is.
The template
System identification
Classify the system you actually place on the market or put into service, not the model family it was built from. If the intended purpose is still being argued about, the rest of this worksheet is premature.
| Field | Response |
|---|---|
| System nameThe name users and contracts use, not an internal codename, unless that is all there is. | — |
| OwnerThe team accountable for the intended purpose, not the vendor that hosts the model. | — |
| DescriptionWhat it does, in language a non-specialist reviewer can check against the purpose. | — |
| Intended purposeThe use the provider declares. Annex III is tested against this, not against a later informal use. | — |
| UsersWho operates the system under the deployer's authority. | — |
| Affected personsNatural persons the output is about or who are subject to a decision it informs. | — |
| EU nexusWhere the provider is established, where it is placed on the market or put into service, and where the output is used. | — |
| Version and dateThe version this classification applies to. A later version needs its own row, or a new copy. | — |
Scope test, Article 2
Article 2 is about the operator and the market, not about whether the system feels "high risk". A system can be in scope and still land in minimal risk. Tick every inclusion that is true, then check the exclusions. The open-source point is an exclusion with holes, not a free pass.
- Provider placing the system on the market or putting it into service in the Union, regardless of where the provider is established.
- Deployer established or located in the Union.
- Provider or deployer in a third country, where the output of the system is used in the Union (Article 2(1)(c)).
- Importer or distributor of the system.
- Product manufacturer placing on the market, or putting into service, an AI system together with its product under its own name or trademark.
- Exclusion to check: placed on the market, put into service or used exclusively for military, defense or national security purposes. A system also used for civilian or law-enforcement purposes is not excluded. Dual-use systems stay in scope.
- Exclusion to check: developed and put into service solely for scientific research and development.
- Exclusion to check: research, testing and development before the system is placed on the market or put into service. Real-world testing is not excluded.
- Exclusion to check: the obligations of deployers who are natural persons using the system in the course of a purely personal, non-professional activity. This does not exempt the provider of that system. A provider selling consumer AI remains in scope.
- Open-source check: a free and open-source license does not take a system out of the Act when the system is prohibited, high-risk, or subject to Article 50.
| Field | Response |
|---|---|
| In scope? (yes / no)Yes if any inclusion applies and no exclusion actually covers this system. | — |
| ReasoningName the Article 2 limb, or the exclusion, in a sentence a reviewer can check. | — |
Role determination
Role follows what the organization does with this system, not what the contract calls it. More than one row can apply across a corporate group. The definitions below paraphrase Article 3; use the consolidated regulation for the wording you would defend.
| Role | Definition (paraphrase of Article 3) | Applies? | Evidence |
|---|---|---|---|
| Provider | A person that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, whether or not for payment. | — | — |
| Deployer | A person using an AI system under its own authority, other than in a purely personal non-professional activity. | — | — |
| Importer | A person established or located in the Union that places on the Union market a system bearing the name or trademark of a person established outside the Union. | — | — |
| Distributor | A person in the supply chain, other than the provider or the importer, that makes a system available on the Union market. | — | — |
| Authorized representative | A person established or located in the Union that a provider established outside the Union has mandated in writing to carry out obligations on its behalf. | — | — |
| Product manufacturer | A manufacturer that places on the market or puts into service an AI system together with a product covered by Union harmonization legislation, under its own name or trademark. | — | — |
Article 25: a deployer, distributor or importer becomes the provider of a high-risk system if it puts its own name or trademark on the system, makes a substantial modification, or changes the intended purpose so that the system becomes high-risk. If any of those is true, the provider row above is "yes" and the evidence cell should say which limb.
Prohibited practices screen, Article 5
The Article 5 prohibitions have applied since February 2, 2025. The questions are a screen, shorter than the article. Any "yes" means stop and escalate to legal — do not continue to the high-risk tests in order to "balance" a prohibition. A "no" is not itself a legal opinion; the article is more specific than the question, and the narrow exceptions (especially for real-time remote biometric identification) are in the regulation, not in this row.
| Practice | Screen question | Yes/No | Notes |
|---|---|---|---|
| (a) Subliminal, manipulative or deceptive techniques | Does the system deploy subliminal techniques beyond a person's consciousness, or purposefully manipulative or deceptive techniques, with the objective or the effect of materially distorting a person's or a group's behavior by appreciably impairing the ability to make an informed decision, thereby causing a decision the person would not otherwise have taken, in a manner that causes or is reasonably likely to cause significant harm to that person, another person, or a group of persons? | — | — |
| (b) Exploiting vulnerabilities | Does it exploit vulnerabilities due to age, disability, or a specific social or economic situation, with the objective or the effect of materially distorting behavior, in a manner that causes or is reasonably likely to cause significant harm to that person or another person? | — | — |
| (c) Social scoring | Does it evaluate or classify people over time from their social behavior or personal characteristics in a way that leads to detrimental or unfavorable treatment? | — | — |
| (d) Criminal-offense risk from profiling | Does it assess the risk that a person will commit a criminal offense based solely on profiling, or solely on assessing personality traits and characteristics? | — | — |
| (e) Untargeted facial-image scraping | Does it create or expand facial-recognition databases by untargeted scraping of facial images from the internet or from CCTV footage? | — | — |
| (f) Emotion recognition at work or in education | Does it infer emotions of people in a workplace or in an education institution, other than for medical or safety reasons? | — | — |
| (g) Biometric categorization of sensitive attributes | Does it categorize people from biometric data in order to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation? | — | — |
| (h) Real-time remote biometric identification | Is it real-time remote biometric identification in publicly accessible spaces for law enforcement? Narrow exceptions exist in Article 5; this cell is not those exceptions. | — | — |
| Non-consensual intimate content and child sexual abuse material | Does the system generate or manipulate images, video, audio or similar material that is non-consensual intimate content of an identifiable person, or child sexual abuse material? Regulation (EU) 2026/1744 adds this prohibition in Article 5(1)(ba). Article 5(1a) sets the provider and deployer conditions. For a provider, the prohibition applies where that generation or manipulation is the intended purpose, or a reasonably foreseeable and reproducible outcome. It applies from December 2, 2026, not from February 2, 2025. | — | — |
Any Yes: stop. Do not ship, pilot or "limit to internal use" while the question is open. Escalate to legal with the version, the intended purpose and the evidence that produced the Yes.
High-risk test, route 1 — Article 6(1) and Annex I
Route 1 is a product-safety test, not a sector test. Both limbs have to be true: the system is itself a product, or a safety component of a product, covered by Union harmonization legislation listed in Annex I, and that product is required to undergo a third-party conformity assessment because of health and safety risks. Under Article 6(1), as amended by Regulation (EU) 2026/1744, a third-party assessment required solely for risks unrelated to health and safety — for example certain radio-spectrum or interference risks — does not make the AI system high-risk. The same amendment narrowed the safety-component test: AI that performs a non-safety function — user assistance, performance optimization, service efficiency, automation or convenience, or quality control — is not automatically a safety component unless its failure creates a health or safety danger. Annex I is two lists. Section A is the New Legislative Framework acts, and medical devices sit there. Section B is the other Union harmonization legislation, for example vehicles, aviation, marine equipment and rail. Machinery sits in Section B after Regulation (EU) 2026/1744. Where the product legislation sits in Section A, the direct Annex I obligations apply from August 2, 2028. They do not apply on the original August 2026 or August 2027 dates. A Section B product can still be high-risk under Article 6(1). Under Article 2(2), as amended by the same regulation, the Act's direct provider and deployer obligations and conformity procedures do not apply as such. Only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57, 58 and 59 apply only insofar as the requirements for high-risk AI systems have been integrated into that legislation. Those requirements reach the product through the sectoral act.
| Field | Response |
|---|---|
| Which Annex I legislation, if any, covers the product?Name the instrument. "Regulated product" is not an answer. | — |
| Which section of Annex I lists that legislation? (Section A / Section B)Section A is the New Legislative Framework acts. Medical devices sit in Section A. Section B is the other Union harmonization legislation, for example vehicles, aviation, marine equipment and rail. Machinery sits in Section B after Regulation (EU) 2026/1744. | — |
| Is the AI system the product, or a safety component of the product?If neither, route 1 does not make it high-risk. | — |
| Does that product require a third-party conformity assessment?Under the Annex I legislation, for placing on the market or putting into service. | — |
| Why is third-party conformity assessment required — for health and safety risks, or for other reasons?Under Article 6(1), as amended by Regulation (EU) 2026/1744, an assessment required solely for risks unrelated to health and safety (for example certain radio-spectrum or interference risks) does not make the AI system high-risk. | — |
| Route 1 result (high-risk / not high-risk) and whyHigh-risk or not is the Article 6(1) answer. A Section B product can still be high-risk. That classification does not switch on the direct provider and deployer obligations. | — |
| If the legislation is in Section B, what does Article 2(2) leave in place?If the legislation is in Section A, write "not this route." If it is in Section B, the system can still be high-risk under Article 6(1). Record that the AI Act's direct provider and deployer obligations and conformity procedures do not apply as such. Only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57, 58 and 59 apply only insofar as the requirements for high-risk AI systems have been integrated into that legislation. Compliance runs through the sectoral act. | — |
Under Article 6(1), as amended by Regulation (EU) 2026/1744, a third-party conformity assessment required solely for risks unrelated to health and safety — for example certain radio-spectrum or interference risks — does not make the AI system high-risk. The Digital Omnibus also narrowed what counts as a safety component. AI that performs a non-safety function — user assistance, performance optimization, service efficiency, automation or convenience, or quality control — is not automatically a safety component. It is a safety component when its failure creates a danger to health or safety. Re-open older classifications that treated every embedded model, or every third-party assessment, as high-risk.
High-risk test, route 2 — Article 6(2) and Annex III
Route 2 follows the intended purpose. If that purpose falls in one of the eight areas, the system is high-risk unless the Article 6(3) derogation in the next section applies. Annex III obligations apply from December 2, 2027, not from August 2, 2026. Each row is one Annex III point or lettered subpoint, paraphrased. The rows are the annex's subject matter, not an exhaustive product list.
| Area | Examples | Does the intended purpose fall here? | Notes |
|---|---|---|---|
| 1(a). Biometrics | Remote biometric identification, where that use is permitted by law. Confirming that a person is who they claim to be, and nothing more, is not this subpoint. | — | — |
| 1(b). Biometrics | Biometric categorization according to sensitive or protected attributes or characteristics, where that use is permitted by law. | — | — |
| 1(c). Biometrics | Emotion recognition, where that use is permitted by law. | — | — |
| 2. Critical infrastructure | Safety components in the management and operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity. | — | — |
| 3(a). Education and vocational training | Determining access or admission, or assigning people to educational or vocational institutions. | — | — |
| 3(b). Education and vocational training | Evaluating learning outcomes, including when those outcomes are used to steer the learning process. | — | — |
| 3(c). Education and vocational training | Assessing the level of education a person will receive or will be able to access. | — | — |
| 3(d). Education and vocational training | Monitoring and detecting prohibited behavior of students during tests. | — | — |
| 4(a). Employment, workers management and access to self-employment | Recruitment or selection, including targeted job advertisements, analyzing and filtering applications, and evaluating candidates. | — | — |
| 4(b). Employment, workers management and access to self-employment | Decisions affecting the terms of a work relationship, promotion or termination; allocating tasks based on individual behavior or personal traits or characteristics; or monitoring and evaluating performance and behavior. | — | — |
| 5(a). Access to essential private and public services and benefits | A public authority, or someone acting for one, evaluating eligibility for essential public assistance benefits and services, including healthcare, or granting, reducing, revoking or reclaiming them. | — | — |
| 5(b). Access to essential private and public services and benefits | Evaluating creditworthiness or establishing a credit score. Detecting financial fraud is not this subpoint. | — | — |
| 5(c). Access to essential private and public services and benefits | Risk assessment and pricing for a person in life or health insurance. | — | — |
| 5(d). Access to essential private and public services and benefits | Evaluating or classifying emergency calls; dispatching, or prioritizing the dispatch of, emergency first response services, including by police, firefighters or medical aid; or emergency healthcare patient triage. | — | — |
| 6(a). Law enforcement | Where the use is permitted: assessing the risk that a person becomes a victim of a crime. | — | — |
| 6(b). Law enforcement | Where the use is permitted: polygraphs and similar tools. | — | — |
| 6(c). Law enforcement | Where the use is permitted: evaluating the reliability of evidence. | — | — |
| 6(d). Law enforcement | Where the use is permitted: assessing the risk of offending or reoffending on a basis other than profiling alone, or assessing personality traits, characteristics or past criminal behavior of a person or a group. | — | — |
| 6(e). Law enforcement | Where the use is permitted: profiling in the detection, investigation or prosecution of criminal offenses. | — | — |
| 7(a). Migration, asylum and border control | Where the use is permitted: polygraphs and similar tools. | — | — |
| 7(b). Migration, asylum and border control | Where permitted: assessing a risk posed by a person who intends to enter or has entered the territory of a Member State, including a security risk, a risk of irregular migration, or a health risk. | — | — |
| 7(c). Migration, asylum and border control | Where the use is permitted: assisting the examination of applications for asylum, visas or residence permits, and related complaints, including the reliability of evidence. | — | — |
| 7(d). Migration, asylum and border control | Where the use is permitted: detecting, recognizing or identifying people. Verification of a travel document is not this subpoint. | — | — |
| 8(a). Administration of justice and democratic processes | Assisting a judicial authority, or a body doing alternative dispute resolution, in researching and interpreting facts and the law and applying the law to a set of facts. | — | — |
| 8(b). Administration of justice and democratic processes | Influencing the outcome of an election or referendum, or voting behavior. Systems whose output people are not directly exposed to are not this subpoint, such as tools used to organize, optimize or structure a political campaign administratively or logistically. | — | — |
Article 6(3) derogation
An Annex III system is not high-risk where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making, and any of conditions (a) to (d) below is fulfilled. More than one may apply. The derogation is never available if the system performs profiling of natural persons: an Annex III system that profiles natural persons is always high-risk. It does not apply to route 1 (Annex I). A provider that relies on it has to be able to show the assessment, not merely tick a box.
| Field | Response |
|---|---|
| Does the system perform profiling of natural persons?If yes, stop. Article 6(3) cannot be used. | — |
| Could the system pose a significant risk of harm to health, safety or fundamental rights, including by materially influencing the outcome of a decision?If yes, the derogation is not available even if a task below also fits. | — |
- (a) It performs a narrow procedural task.
- (b) It improves the result of a human activity that was already completed.
- (c) It detects decision-making patterns, or deviations from prior patterns, without replacing the human assessment or influencing it without a proper human review.
- (d) It performs a preparatory task to an assessment that is relevant for an Annex III purpose.
| Field | Response |
|---|---|
| Which of conditions (a)-(d) apply? Record each one and why.Any one of them is enough, together with the finding of no significant risk of harm. More than one may apply. If none of them fits, the derogation does not. | — |
| Where is the Article 6(4) assessment documented, and was that done before placing on the market or putting into service? | — |
| Article 49(2) registrationThe Digital Omnibus keeps a simplified registration duty for systems the provider has assessed as not high-risk. Record where that registration will live, and that the assessment can be given to authorities on request. | — |
Transparency, Article 50
Article 50 has applied since August 2, 2026. It is not a high-risk classification. A high-risk system can also carry these duties, and a system that is not high-risk can still carry them. Systems that were already on the market before August 2, 2026 have until December 2, 2026 to meet the machine-readable marking duty for synthetic content.
- The system is intended to interact directly with natural persons. They must be told they are interacting with an AI system, unless it is obvious to a reasonably well-informed person.
- The system generates synthetic audio, image, video or text. Outputs must be marked in a machine-readable way and be detectable as artificial. Systems on the market before August 2, 2026 have until December 2, 2026 for that marking.
- The deployer operates an emotion-recognition system or a biometric categorization system. Exposed persons must be informed.
- The deployer generates or manipulates image, audio or video content constituting a deepfake. The content must be disclosed as artificially generated or manipulated.
- The deployer generates or manipulates text published with the purpose of informing the public on matters of public interest. The text must be disclosed as artificially generated or manipulated, unless it has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication.
General-purpose AI dependency
Chapter V obligations on providers of general-purpose AI models have applied since August 2, 2025. Using a general-purpose model does not, by itself, make the downstream system high-risk. Classification of this system still follows its intended purpose. What the model does change is the evidence the downstream provider should already have in hand.
| Field | Response |
|---|---|
| Is this system built on a general-purpose AI model?Yes, no, or partly (name the component). | — |
| Which model, which provider, and which version? | — |
| Is our organization the provider of that general-purpose model?If yes, Chapter V applies to us for the model, separate from the tier of this system. | — |
| Has the upstream provider supplied the technical documentation and information Article 53 requires it to give downstream providers?Record what you received and what is still missing. A missing pack is a vendor gap, not a reason to skip the downstream classification. | — |
| Is the upstream model a systemic-risk model?That status adds obligations for the model provider. It does not reclassify this system. | — |
Using a general-purpose model does not by itself make the system high-risk. Finish the Article 5, Annex I, Annex III and Article 50 sections from the intended purpose of this system.
AI literacy, Article 4
Article 4 has applied since February 2, 2025. The Digital Omnibus softened the duty. Read the consolidated article before you design the program.
Article 4, as amended by Regulation (EU) 2026/1744, requires providers and deployers to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf. It expressly does not require guaranteeing any individual's level of AI literacy. Record the measure you actually run (who it covers, and when it was last given). Do not paste a superseded sentence from an old briefing into the training policy.
Classification result and sign-off
Tiers stack. A system can be high-risk and still carry Article 50 duties. Write every tier that applies, the date each set of obligations applies, and the reasoning in enough detail that a reviewer who was not in the room can follow it. For an Annex I system, name the section. Section A means the direct AI Act provider and deployer obligations and conformity procedures, from August 2, 2028. Section B means the system can still be high-risk under Article 6(1), but those direct duties do not apply as such: compliance runs through the sectoral act under Article 2(2). Do not list the direct provider and deployer obligations as if they applied to a Section B system. Re-run this worksheet on a substantial modification or a change of intended purpose.
| Field | Entry |
|---|---|
| Resulting tier — Prohibited, High-risk (Annex I, Section A — direct duties), High-risk (Annex I, Section B — sectoral route), High-risk (Annex III), Not high-risk under Article 6(3), Transparency obligations (Article 50), Minimal risk. More than one can apply. | — |
| Applicable date | — |
| Key reasoning | — |
| Obligations triggered | — |
| Next review date | — |
| Prepared by | — |
| Reviewed by (legal) | — |
| Approved by | — |
| Date | — |
Re-run this classification when the intended purpose changes or the system is substantially modified. Last reviewed against the consolidated regulation on 2026-09-26. Primary texts: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744, both on EUR-Lex.
Frequently asked questions
When do the high-risk obligations apply?
Not on August 2, 2026. After Regulation (EU) 2026/1744, Annex III high-risk obligations apply from December 2, 2027 and Annex I high-risk obligations from August 2, 2028. Other duties are already in force: the Article 5 prohibitions and Article 4 since February 2, 2025, general-purpose model obligations in Chapter V since August 2, 2025, and Article 50 transparency since August 2, 2026. The prohibition on generating non-consensual intimate imagery or child sexual abuse material applies from December 2, 2026. A calendar that still says high-risk duties landed in August 2026 is out of date.
Does the EU AI Act apply to a US company?
It can. Article 2 does not require the provider to be established in the Union. It covers a provider that places a system on the Union market or puts it into service there, a deployer established or located in the Union, and a provider or deployer in a third country where the output is used in the Union. A US company whose system is used by people in the Union, or whose output is used there, has a scope question to answer on this worksheet. Establishment outside the Union is not itself an answer.
What if our system is in an Annex III area but only does a narrow procedural task?
Article 6(3) can take an Annex III system out of the high-risk tier where it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making, and any of conditions (a) to (d) is fulfilled: a narrow procedural task, improving the result of a completed human activity, detecting decision-making patterns without replacing or influencing the human assessment without proper review, or a preparatory task. More than one of those conditions may apply. The derogation is unavailable if the system profiles natural persons — that system is always high-risk. The provider has to document that assessment before placing the system on the market or putting it into service (Article 6(4)), register it under Article 49(2) — the Digital Omnibus kept a simplified registration for this self-assessment — and produce the documentation to authorities on request.
Is this template a conformity assessment?
No. It records a classification and the reasoning behind it. A conformity assessment is a separate process a provider of a high-risk system carries out before placing that system on the market or putting it into service, under the Act's own procedure. Filling in this worksheet does not complete that process, and it does not make a system or an organization anything the Act would recognize as assessed.
This template is not legal advice.
As of September 14, 2026. We are not lawyers and this is not legal advice. It is the responsibility of consumers of this data that they verify the applicability and current ratified statutes and legal precedence with a qualified attorney licensed in the state or country they are researching.
From a worksheet to a readiness assessment
A template records the decision. A readiness assessment is where that decision gets tested against the way the organization actually ships.