Eu AI Act Report Oliver Schmidt Prietz

EU AI Act latest Commission guidance enforcement decisions [current year]
EU AI Act [relevant sector] specific guidance [current year]

EU AI Act Regulation 2024/1689 consolidated text corrigenda [current year]

# AI Act Compliance Assessment Report
## [System Name] — [Date]

---

**Report Reference:** [reference number]
**Prepared by:** [name, role]
**Organization:** [organization name]
**Date:** [date]
**Status:** [Draft / Final]

---

### 1. Introduction

**1.1 Purpose of Assessment**
This report documents the assessment of [system name] under Regulation (EU) 2024/1689 (EU AI Act). The assessment determines: (a) whether the system qualifies as an AI system under Art. 3(1), (b) the applicable risk classification, (c) the organization's role in the AI value chain, and (d) the resulting legal obligations.

**1.2 Scope**
[Description of assessment scope — what is included and excluded]

**1.3 Methodology**
Assessment based on:
- EU AI Act (Regulation (EU) 2024/1689) — all articles, recitals, and annexes
- Commission Guidelines on AI System Definition (C(2025) 924 final, 6 Feb 2025)
- Commission Guidelines on Prohibited AI Practices (4 Feb 2025)
- [Other applicable Commission guidelines]
- OECD AI Framework (AI system definition alignment)
- ISO 22989:2022 (AI concepts and terminology)
- [Any additional sources consulted, including web search results]

**1.4 Limitations**
- Based on information provided by [client/organization]
- Subject to evolving regulatory interpretation
- Does not constitute legal advice
- [Any specific limitations]

---

### 2. System Description

**2.1 General Information**

| Field | Detail |
|-------|--------|
| System name | [name] |
| Version | [version] |
| Provider/vendor | [name] |
| Technology type | [ML, NLP, CV, etc.] |
| Deployment date | [date or planned] |

**2.2 Technical Description**
[Brief technical description of how the system works]

**2.3 Deployment Context**
[How and where the system is used, who uses it, who is affected]

**2.4 Data Flows**
[What data goes in, what comes out, where data is stored]

---

### 3. Preliminary Check — Scope Exclusions (Art. 2)

| # | Exclusion | Article | Applicable? | Reasoning |
|---|----------|---------|-------------|-----------|
| 1 | Military/defence/national security | Art. 2(3) | [Yes/No] | [reasoning] |
| 2 | Third-country international cooperation | Art. 2(4) | [Yes/No] | [reasoning] |
| 3 | Scientific research exclusively | Art. 2(6) | [Yes/No] | [reasoning] |
| 4 | Pre-market R&D | Art. 2(8) | [Yes/No] | [reasoning] |
| 5 | Personal/household use | Art. 2(10) | [Yes/No] | [reasoning] |
| 6 | Free and open-source | Art. 2(12) | [Yes/No] | [reasoning] |

**Result:** [AI Act applies / Exclusion under Art. 2([x]) applies]

[If open-source: include Checklist I or II analysis]

---

### 4. Scope of Application

**4.1 Material Scope — AI System Determination (Art. 3(1))**

| # | Criterion | Met? | Reasoning |
|---|-----------|------|-----------|
| 1 | Machine-based operation | [Yes/No] | [reasoning] |
| 2 | Degree of autonomy | [Level X] | [reasoning] |
| 3 | Adaptability after deployment | [Yes/No] | [reasoning] |
| 4 | Explicit or implicit goals | [Yes/No] | [reasoning] |
| 5 | Inference capability | [Yes/No] | [reasoning] |
| 6 | Output generation | [Yes/No] | [reasoning] |
| 7 | Environmental influence | [Yes/No] | [reasoning] |

**Determination:** [IS / IS NOT an AI system under Art. 3(1)]
**Confidence:** [High/Medium/Low]

**4.2 Personal Scope — Role Determination**

| Aspect | Determination |
|--------|--------------|
| Primary role | [Provider/Deployer/Importer/Distributor] |
| Legal basis | [Art. 3(x)] |
| Quasi-provider risk | [None/Low/Medium/High] |
| Art. 25 scenario | [N/A or applicable scenario] |

[Detailed reasoning for role determination]

**4.3 Territorial Scope**

| Aspect | Detail |
|--------|--------|
| Provider establishment | [EU/non-EU] |
| Deployer establishment | [EU Member State(s)] |
| AI output used in EU | [Yes/No] |
| Territorial basis | [Art. 2(1)(a)/(b)/(c)] |

---

### 5. Intended Purpose (Art. 3(12))

**Provider's documented intended purpose:**
[As stated in provider's documentation]

**Actual deployment context:**
[How the system is actually used]

**Alignment assessment:**
[Match/Deviation — if deviation, assess Art. 25(1)(c) implications]

---

### 6. Risk Classification

**6.1 Prohibited Practices Screening (Art. 5)**

| # | Category | Article | Applicable? | Reasoning |
|---|----------|---------|-------------|-----------|
| 1 | Subliminal/manipulative/deceptive | Art. 5(1)(a) | [No/Possibly/Yes] | [reasoning] |
| 2 | Exploitation of vulnerabilities | Art. 5(1)(b) | [No/Possibly/Yes] | [reasoning] |
| 3 | Social scoring | Art. 5(1)(c) | [No/Possibly/Yes] | [reasoning] |
| 4 | Criminal risk prediction (profiling) | Art. 5(1)(d) | [No/Possibly/Yes] | [reasoning] |
| 5 | Untargeted facial recognition scraping | Art. 5(1)(e) | [No/Possibly/Yes] | [reasoning] |
| 6 | Emotion recognition (workplace/education) | Art. 5(1)(f) | [No/Possibly/Yes] | [reasoning] |
| 7 | Biometric categorization (sensitive) | Art. 5(1)(g) | [No/Possibly/Yes] | [reasoning] |
| 8 | Real-time remote biometric ID (public) | Art. 5(1)(h) | [No/Possibly/Yes] | [reasoning] |

**Result:** [No prohibited practice identified / PROHIBITED — Art. 5(1)([x])]

**6.2 High-Risk Assessment**

**6.2.1 Annex I — Product Safety**
[Assessment against 18 Annex I categories]
**Result:** [Not applicable / Applicable — Annex I Nr. [X]]

**6.2.2 Annex III — Application-Based**

| # | Category | Applicable? | Sub-category | Reasoning |
|---|----------|-------------|-------------|-----------|
| 1 | Biometrics | [Yes/No] | | |
| 2 | Critical infrastructure | [Yes/No] | | |
| 3 | Education & training | [Yes/No] | | |
| 4 | Employment & workers | [Yes/No] | | |
| 5 | Essential services | [Yes/No] | | |
| 6 | Law enforcement | [Yes/No] | | |
| 7 | Migration & border | [Yes/No] | | |
| 8 | Justice & democracy | [Yes/No] | | |

**Result:** [Not applicable / Applicable — Annex III Nr. [X]]

**6.2.3 Art. 6(3) Exception Analysis**
[If Annex III triggered: analyze Art. 6(3) conditions (a)-(d)]
[Profiling re-exception check]
**Result:** [Exception applies — not high-risk / Exception does not apply — HIGH-RISK]

**6.3 GPAI / Systemic Risk Assessment**
[If applicable: GPAI model assessment, FLOP threshold, systemic risk indicators]
**Result:** [Not GPAI / GPAI standard / GPAI with systemic risk]

**6.4 Transparency Obligations (Art. 50)**

| Obligation | Article | Applicable? |
|-----------|---------|-------------|
| Interaction disclosure | Art. 50(1) | [Yes/No] |
| Synthetic content marking | Art. 50(2) | [Yes/No] |
| Emotion recognition disclosure | Art. 50(3) | [Yes/No] |
| Deep fake labeling | Art. 50(4) | [Yes/No] |

---

### 7. Applicable Obligations

[Obligation summary matrix — from a prior obligation-mapping step, or generated here based on the classification and role]

**7.1 Obligation Summary**

| Category | Count | Immediate | Short-term | Ongoing |
|----------|-------|-----------|------------|---------|
| Technical measures | [X] | [Y] | [Z] | [W] |
| Organizational measures | [X] | [Y] | [Z] | [W] |
| Management systems | [X] | — | [Y] | [Z] |
| Impact assessments | [X] | [Y] | — | — |
| **Total** | **[X]** | **[Y]** | **[Z]** | **[W]** |

**7.2 Critical Timeline Obligations**
[List obligations with nearest deadlines]

**7.3 Management Systems Required**
[List required management systems]

---

### 8. Risk Flags & Recommendations

**8.1 Identified Risks Requiring Legal Judgment**
[List any areas where the assessment cannot reach a definitive conclusion]

**8.2 Recommendations**

| # | Recommendation | Priority | Responsible |
|---|---------------|----------|-------------|
| 1 | [recommendation] | [High/Medium/Low] | [role] |
| 2 | [recommendation] | [High/Medium/Low] | [role] |

**8.3 GDPR Cross-References**
[List applicable GDPR obligations and suggested skills]

---

### 9. Conclusion

**Overall Classification:**
[System name] is classified as a **[risk tier]** AI system under the EU AI Act, with the organization acting as **[role]**.

**Compliance Readiness:**
[Assessment of current compliance status — Ready / Partially Ready / Not Ready]

**Key Actions:**
1. [Most important action]
2. [Second most important action]
3. [Third most important action]

---

**Prepared by:** [name]
**Date:** [date]
**Reviewed by:** [name, if applicable]

**Disclaimer:** This assessment is based on the information provided and current interpretation of the EU AI Act (Regulation (EU) 2024/1689) as of the assessment date. It does not constitute legal advice. The regulatory landscape is evolving — Commission guidelines, delegated acts, and harmonized standards may affect this assessment. Periodic reassessment is recommended.