Eu AI Act Classification

EU AI Act Risk Classification

Classify AI systems under Regulation (EU) 2024/1689 and determine obligations by role.

Important: This skill provides compliance workflow support, not legal advice. Always cite specific EU AI Act articles. Where facts are incomplete, state assumptions explicitly and ask targeted follow-up questions.

Classification Workflow

Follow this decision tree strictly in order. Stop at the first match.

Step 1 — Scope Check

Confirm the AI system falls within scope:

• Is it placed on the market or put into service in the EU?
• Who is the provider, deployer, importer, distributor, or authorized representative?
• Does a territorial or subject-matter exclusion apply (military, national security, pure research)?

If out of scope, document why and stop.

Step 2 — Gate 1: Prohibited Practices (Article 5)

Check every Article 5 category. If any match → PROHIBITED. Stop unless a narrow law enforcement exception applies.

Categories (check all ten: the original eight, plus Art. 5(1)(ba) non-consensual intimate material and (bb) CSAM, both applying from 2 December 2026):

1. Manipulation/deception causing significant harm
2. Exploitation of vulnerabilities (age, disability, socio-economic)
3. Social scoring with disproportionate/unrelated adverse treatment
4. Individual predictive policing based solely on profiling
5. Untargeted facial image scraping for recognition databases
6. Emotion recognition in workplace/education (narrow exceptions)
7. Biometric categorisation inferring sensitive characteristics
8. Real-time remote biometric identification in public spaces for law enforcement (narrow exceptions)
9. Non-consensual intimate material: generating or manipulating realistic intimate or sexually explicit depictions of an identifiable person without their explicit consent (Art. 5(1)(ba), from 2 Dec 2026)
10. Child sexual abuse material within the meaning of Directive 2011/93/EU, subject to the national "without right" defence (Art. 5(1)(bb), from 2 Dec 2026)

→ For the complete checklist with examples and edge cases, read references/prohibited-practices.md.

Step 3 — Gate 2: High-Risk (Annex I + Annex III)

Annex I path: Is the AI a product or safety component under EU harmonisation legislation (e.g., MDR, IVDR) subject to third-party conformity assessment? → HIGH-RISK

Annex I Section A vs Section B. For products covered by Section B, Regulation (EU) 2024/1689 applies only to the extent set out in its Article 2(2), so the full Chapter III regime does not attach. Regulation (EU) 2026/1744 moved the Machinery Regulation (EU) 2023/1230 from Section A to Section B with effect from 27 July 2026, so AI-enabled machinery now follows the sectoral route. Note that Article 2(2) was itself rewritten by the same act: for Section B products only Article 6(1), the new Article 60a and Articles 102 to 112 apply, with Articles 57 to 59 applying only in so far as the high-risk requirements have been integrated into that sectoral legislation.

The safety-component gateway narrowed on 27 July 2026. Before concluding HIGH-RISK on the Annex I path, apply the new Article 6(1a) to (1c) and the amended Article 3(14):

• Article 3(14) now ties "safety component" to intended purpose: a component fulfils a safety function where its intended purpose is to prevent or mitigate risks to the health and safety of persons or property. Mere integration into a regulated product does not make it one.
• Article 6(1a): systems used solely for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation, convenience or quality control do not qualify as safety components.
• Article 6(1b): despite 1a, a system whose failure or malfunctioning would endanger health and safety does qualify.
• Article 6(1c): a product required to undergo third-party conformity assessment solely for risks other than health and safety, for example radio spectrum or electromagnetic interference, does not satisfy Article 6(1)(b).

Practical effect: several systems that previously classified as high-risk by virtue of sitting inside a regulated product now fall outside Article 6(1). Document which limb you relied on.

Annex III path: Does the intended purpose fall within one of the eight high-risk use-case categories?

→ For all categories with examples and edge cases, read references/high-risk-annex-iii.md.

Article 6(3) exception: Even if an Annex III use case matches, a system is NOT high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision making, and one of these conditions is met:

• it performs a narrow procedural task,
• it improves the result of a previously completed human activity,
• it detects decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment without proper human review, or
• it performs a preparatory task for an assessment relevant for the purposes of the use cases listed in Annex III.

Profiling override, check this FIRST: notwithstanding those conditions, an Annex III system is always high-risk where it performs profiling of natural persons (Art. 6(3), third subparagraph). If the system profiles people, the exception is unavailable and the analysis stops here.

If claiming this exception, document the reasoning thoroughly (Art. 6(4)), and note the Art. 49(2) registration duty for systems relying on it.

Step 4 — GPAI Models (Articles 51–56)

Independent of system-level risk. A minimal-risk app can use a GPAI model with its own obligations. Downstream providers/deployers must still verify vendor evidence and ensure documentation is sufficient for their specific use case and risk profile.

Check:

• Is a general-purpose AI model involved (broad capability, not narrow-purpose)?
• Who is the GPAI model provider vs. downstream provider?
• Does the model meet systemic risk thresholds (compute-based criteria or designation by the Commission)?

→ For GPAI obligations and systemic risk details, read references/gpai-obligations.md.