EU AI Act risk classifier

The four risk tiers

The Act (Regulation (EU) 2024/1689) is risk-based. The more a system can affect people, the more it has to do before it goes live.

• Prohibited (Article 5). A short list of uses that are banned outright, such as social scoring, untargeted facial-image scraping, and emotion recognition at work. No safeguards make them lawful.
• High risk (Article 6 and Annex III). Systems used in areas like biometrics, employment, education, credit and insurance, or critical infrastructure. They carry the full regime: risk management, data governance, technical documentation, human oversight, conformity assessment, and post-market monitoring.
• Limited risk (Article 50). Systems that interact with people or generate content. The main duty is transparency: tell people they are dealing with AI, and label synthetic media.
• Minimal risk. Everything else. No system-specific obligations, though the AI literacy duty (Article 4) and any voluntary codes still apply.

General-purpose AI is a separate track

If you train or substantially modify a general-purpose (foundation) model, you carry the GPAI duties in Articles 53 and 55 on top of whatever tier your applications fall into. That is why the questionnaire asks about it directly.

The deadlines that matter

• 2 February 2025: the prohibited-practice ban and the AI literacy duty already apply.
• 2 August 2025: GPAI model obligations, governance, and penalties apply.
• 2 August 2026: the Article 50 transparency duties apply. This date did not move.
• 2 December 2027: the Annex III high-risk duties apply. A political agreement of 7 May 2026, the digital omnibus, pushed this back from the original 2 August 2026.
• 2 August 2028: the extended deadline for high-risk systems that are safety components of products under existing EU product law (Annex I), also moved by the omnibus from 2 August 2027.

The original dates come from the Regulation itself; the high-risk deadlines above reflect the May 2026 omnibus, which still needs formal adoption. They can move again through Commission guidance or amendments, so the tool links to the official page and can email you if that page changes. For the detail, see our note on the postponed high-risk deadline.

This is a starting point, not legal advice

The classifier mirrors the structure of the Act so you can see where you likely sit and what work it implies. Edge cases, exemptions, and the precise scope of Annex III are matters for qualified counsel. Use the result to scope the conversation, not to replace it.

EU AI Act questions, answered

Related reading: the five questions that decide your risk tier and the SME fine rule most EU AI Act coverage misses.