Eu AI Act Classification Oliver Schmidt Prietz

EU AI Act System Classifier

Determine whether a technology qualifies as an AI system under Art. 3(1) AI Act (Regulation (EU) 2024/1689) and classify its risk tier.

Disclaimer (show at session start, do not block)

Important: This skill provides structured AI system classification guidance based on the EU AI Act (Regulation (EU) 2024/1689), Commission guidelines, and the OECD AI framework. It is not legal advice. Final classification decisions should involve qualified legal counsel with AI Act expertise. Effective dates for high-risk obligations reflect the AI Omnibus 2026 postponement (Annex III: 2 December 2027; Annex I: 2 August 2028).

When to Search the Web

On activation — always search for:

EU AI Act Commission guidelines AI system definition 2025 2026
EU AI Act high-risk classification guidelines Art. 6 latest

During Annex III assessment — search for:

EU AI Act Annex III delegated acts modifications [current year]
EU AI Act high-risk classification new categories

For GPAI assessment — search for:

EU AI Office GPAI systemic risk threshold FLOP [current year]
EU AI Office GPAI Code of Practice latest
EU AI Act Art. 51 general purpose AI model classification

For open-source exception — search for:

EU AI Act open source exception Art. 2(12) guidance [current year]
EU AI Act Art. 53(2) GPAI open source partial exemption

Workflow: Ask Questions ONE AT A TIME

Phase 1: Scope Gate

Prior Assessment Context (optional):

"If you have previously run another EU AI Act skill, you may paste the Assessment Context block here. This pre-fills several questions and avoids redundant input."

If context is provided, pre-populate applicable fields and skip questions that are already answered. If any field conflicts with user answers, flag the inconsistency.

Q1 — System Description:

"Please provide a brief description of the AI technology or system you want to classify. Include: what it does, how it works (at a high level), who uses it, and in what context."

Q2 — Scope Exclusion Check (system-description-informed):

Based on the Q1 system description, assess whether any scope exclusion signals are present:

• If the description signals a potential exclusion (military use, personal/household use, pure R&D, pre-market testing, international law enforcement cooperation) → ask a targeted confirmation question for that specific exclusion only. Example: "Your description mentions this is for internal research only — is this system used exclusively for scientific R&D with no deployment to end users? (Art. 2(6))"
• If the description signals an open-source component → ask a targeted question: "You mentioned this uses an open-source model. Is the system itself released under a free and open-source license? (Art. 2(12))"
• If no exclusion signals are present in the description → skip Q2 entirely with a brief note: "Based on your description, no scope exclusions appear to apply. Proceeding with the AI system definition test."
• If genuinely unclear whether an exclusion might apply → present relevant exclusions conversationally (not as a lettered list), focusing only on plausible ones given the system description.

If a military, international law enforcement, personal use, pure R&D, or pre-market exclusion applies: Output exclusion analysis with legal basis → STOP.

If the system is released under a free and open-source license: Run the dedicated open-source checklist from references/scope-exclusions.md.

• For AI systems: Apply Checklist I (Art. 2(12)) — 3-step process, 6 verification questions
• For GPAI models: Apply Checklist II (Art. 53(2)) — 3-step process with parameter accessibility check
• If exemption applies → output analysis → STOP
• If exemption does NOT apply (e.g., high-risk, prohibited, or Art. 50 system) → continue to Phase 2

If no exclusion applies: Continue to Phase 2.

Phase 2: AI System Definition Test (Art. 3(1))

Read references/ai-system-definition.md for the full 7-criteria framework.

Walk through 7 criteria one at a time, providing examples for each:

Criterion 1 — Machine-based operation:

"Is this system operated by machine-based processes (maschinengestütztes System)? This includes any software or hardware that processes information computationally."

Criterion 2 — Degree of autonomy (Autonomiegrad):

"What degree of autonomy does the system exhibit? Use the ISO 22989 scale:

• Level 0: No automation — fully human-controlled
• Level 1: Assistance — system suggests, human decides
• Level 2: Partial automation — some subfunctions automated, human controls overall
• Level 3: Conditional automation — autonomous in specific contexts, human ready to intervene
• Level 4: High automation — operates parts of mission without intervention
• Level 5: Full automation — completes entire mission without intervention
• Level 6: True autonomy — adapts goals without oversight"

Criterion 3 — Adaptability after deployment:

"Can the system adapt its behavior after deployment? Does it learn from new data, user interactions, or environmental feedback? (Note: this includes continuous learning, online learning, and reinforcement from human feedback.)"

Criterion 4 — Explicit or implicit goals:

"Does the system have defined goals — either explicitly programmed (e.g., 'classify images') or implicitly learned through training data (e.g., learned optimization objectives)?"

Criterion 5 — Inference capability:

"Does the system derive outputs through inference — i.e., making predictions, drawing conclusions, or generating recommendations beyond simple deterministic rules? This distinguishes AI from traditional rule-based software."

Criterion 6 — Output generation:

"What outputs does the system generate? This includes:

• Predictions (e.g., risk scores, forecasts)
• Content (e.g., text, images, audio, video)
• Recommendations (e.g., product suggestions, decision support)
• Decisions (e.g., automated approvals, classifications)"

Criterion 7 — Environmental influence:

"Does the system's output influence physical or virtual environments? Examples: controlling physical devices, modifying user interfaces, filtering content, triggering automated processes."

AI System Determination Output:

After all 7 criteria, output:

### AI System Definition Analysis (Art. 3(1))

| # | Criterion | Met? | Reasoning |
|---|-----------|------|-----------|
| 1 | Machine-based operation | [Yes/No] | [brief reasoning] |
| 2 | Degree of autonomy | [Level X] | [brief reasoning] |
| 3 | Adaptability after deployment | [Yes/No] | [brief reasoning] |
| 4 | Explicit or implicit goals | [Yes/No] | [brief reasoning] |
| 5 | Inference capability | [Yes/No] | [brief reasoning] |
| 6 | Output generation | [Yes/No] | [brief reasoning] |
| 7 | Environmental influence | [Yes/No] | [brief reasoning] |

**Determination:** [This system IS / IS NOT an AI system under Art. 3(1) AI Act]
**Confidence:** [High / Medium / Low — explain if not High]

If NOT an AI system → output determination with reasoning → STOP. If YES → continue to Phase 3.

Phase 3: Risk Classification

Read the relevant reference files for each step.

Step 1: Prohibited Practice Screening (Art. 5) — Analyst-Driven Pre-Filtering

Read references/prohibited-practices.md.

"I will now screen against the 8 categories of prohibited AI practices under Art. 5."

Internal relevance scoring (do not show this step to the user):

Based on the Q1 system description, silently categorize each of the 8 prohibited practices as:

• Not applicable — system description clearly does not involve this practice
• Possibly relevant — system description has some signals worth examining
• Likely relevant — system description strongly suggests this practice may apply

Present findings as a single assessment table (all 8 shown for transparency):

After presenting the table, ask: "Do any flagged items need discussion, or should I explore any I marked 'Not applicable'?"

Deep-dive only on items marked "Possibly relevant" or "Likely relevant," or on any items the user asks about, using references/prohibited-practices.md for detailed edge cases, boundary analysis, gray zone scenarios, and multi-category interactions.

If ANY prohibition is flagged:

WARNING — PROHIBITED AI PRACTICE DETECTED

Art. 5(1)([x]) AI Act: [description]

This AI system falls within the scope of a PROHIBITED practice.
Deployment, placing on market, or putting into service is PROHIBITED.

Legal basis: Art. 5(1)([x]), Recital [XX]
Penalty: Art. 99(3) — up to EUR 35,000,000 or 7% of total worldwide annual turnover

IMMEDIATE ACTION REQUIRED: Consult qualified legal counsel.

→ STOP (unless user wants to explore exceptions listed in Art. 5).

Step 2: High-Risk Check — Annex I (Product Safety)

Read references/high-risk-annexes.md.

"Is this AI system a safety component of a product, or is it itself a product, covered by the EU harmonization legislation listed in Annex I?"

Screen all 18 Annex I product categories. If YES → high-risk under Art. 6(1).

Step 3: High-Risk Check — Annex III (Application-Based) — Auto-Pre-Screen

For sector-specific Annex III analysis, read references/sector-guidance.md. For worked classification examples, see references/case-studies.md.

Auto-assessment (internal — based on Q1 system description):

Using sector, use case, and deployment context signals from the system description, automatically map the system to relevant Annex III categories. Categorize each as:

• Relevant — system description clearly signals this category (e.g., HR screening tool → Employment)
• Potentially relevant — indirect signals warrant closer examination
• Not applicable — no signals in description connect to this category

Present auto-assessment table (all 8 categories shown for transparency):

"Based on your system description, here is my initial Annex III relevance assessment:"

"Do you agree with this assessment, or should I re-examine any categories?"

User confirms or overrides. If the system description contradicts a user override (e.g., user says "Not applicable" for Employment but system processes CVs), flag the contradiction and assess fully regardless.