EU AI Act Risk Classifier

Updated for Regulation (EU) 2026/1744, which moved stand-alone high-risk deadlines to 2 December 2027.

Your role and scope

What is your role for this AI system?

Provider — we develop it or have it developed and sell/release it under our name Deployer — we use someone else's AI system in our business Both

Is the system placed on the EU market, used in the EU, or are its outputs used in the EU?

Yes No

Prohibited practices (Article 5)

Does the system do any of these?

Leave all unticked if none apply.

Social scoring of people that leads to unjustified or disproportionate treatment Subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm Exploiting vulnerabilities due to age, disability or social or economic situation Predicting criminal offences based solely on profiling or personality traits Building facial recognition databases by untargeted scraping of images from the internet or CCTV Emotion recognition in the workplace or in education (except medical or safety reasons) Biometric categorisation to infer race, political opinions, union membership, religion, sex life or sexual orientation Real-time remote biometric identification in public spaces for law enforcement (narrow exceptions) Generating non-consensual intimate imagery or child sexual abuse material (added by the 2026 AI Omnibus)

High-risk uses

Is it used in any of these areas (Annex III)?

Is it a safety component of, or itself, a product covered by EU product-safety law (e.g. medical devices, machinery, toys)?

Yes No

Transparency features (Article 50)

Does it…

Interact directly with people (chatbot, voice assistant, AI agent) Generate synthetic text, images, audio or video Create deepfakes or publish AI-generated text to inform the public Recognise emotions or categorise people by biometrics

Do you provide a general-purpose AI model (a foundation model others build on)?

Yes No

The four risk levels of the AI Act

The EU AI Act sorts AI systems by risk. Prohibited practices have been banned since 2 February 2025. High-risk systems — those listed in Annex III, such as AI in hiring, credit scoring or education, and AI in regulated products — face the heaviest duties. Limited-risk systems, such as chatbots and generative AI, carry transparency duties. Everything else is minimal risk.

What the 2026 AI Omnibus changed

Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the start of the stand-alone (Annex III) high-risk rules from 2 August 2026 to 2 December 2027, and the product-embedded (Annex I) rules to 2 August 2028. It did not delay the Article 50 transparency duties, which apply from 2 August 2026, except for a grace period to 2 December 2026 on machine-readable marking for generative systems already on the market. It also added two new prohibited practices.

Frequently asked questions

Was the EU AI Act delayed?

Only partly. High-risk deadlines moved to 2027 and 2028, but prohibitions, general-purpose AI duties and transparency duties were not delayed.

Is a customer-service chatbot high-risk?

Usually not. It is typically limited risk: you must tell users they are talking to an AI.

Is AI used to screen CVs high-risk?

Yes. Employment uses are listed in Annex III, so high-risk duties apply from 2 December 2027 unless the narrow Article 6(3) exception applies.

Last reviewed 2026-10-09. Sources: official legal texts on EUR-Lex, legislation.gov.uk and the California Privacy Protection Agency.

EU AI Act Risk Classifier

The four risk levels of the AI Act

What the 2026 AI Omnibus changed

Frequently asked questions

More compliance tools