EU AI Act Role & Risk Classifier
Work out where your organisation stands under the EU AI Act. First pick your role — provider, deployer, importer, distributor, product manufacturer or GPAI model provider. Then answer a short questionnaire that routes the system to a risk tier: prohibited (Art. 5), high-risk (Annex III or the Annex I product-safety route), limited-risk transparency (Art. 50) or minimal. You get a verdict card, an article-referenced obligations checklist scoped to your role, and the phased timeline — with Markdown/CSV export and a shareable permalink. It is an educational self-assessment, not legal advice, it makes no legal determination, and everything runs in your browser.
Educational self-assessment, not legal advice. This is an educational self-assessment, not legal advice, and it is not a legal determination of your classification or obligations under the EU AI Act. The analysis is a simplified reading of Regulation (EU) 2024/1689 and may not reflect your specific facts, later delegated/implementing acts, harmonised standards or guidance. Confirm your role, risk tier and obligations with qualified counsel and against the official Regulation text before relying on anything here.
Step 1 — Your role
The AI Act assigns different duties to each operator in the value chain. Pick the role that matches what your organisation actually does with the system. You can be more than one role for different systems; assess each separately.
Step 2 — Risk tier
The verdict on the right updates as you answer. Nothing is uploaded — everything runs in your browser.
Article 5 bans a short list of practices, including: harmful subliminal/manipulative or exploitative techniques; social scoring leading to unjustified detrimental treatment; untargeted scraping of facial images from the internet or CCTV to build recognition databases; emotion inference in workplaces or education (save for medical/safety); certain biometric categorisation inferring sensitive traits; some predictive policing of individuals; and real-time remote biometric identification in public for law enforcement outside narrow exceptions.
Annex III lists high-risk use-case areas: biometrics (incl. remote identification, categorisation, emotion recognition where not banned); critical infrastructure safety; education and vocational training (access, scoring, proctoring); employment, worker management and access to self-employment (recruitment, promotion, termination, monitoring); access to essential private and public services and benefits (incl. creditworthiness/credit scoring and life/health insurance risk & pricing); law enforcement; migration, asylum and border control; and administration of justice and democratic processes.
The second high-risk route (Art. 6(1)): the AI is a safety component of — or is itself — a product covered by the EU harmonisation legislation in Annex I (e.g. machinery, medical devices, toys, lifts, radio equipment, vehicles, aviation) AND that product must undergo third-party conformity assessment under those rules.
Article 50 imposes transparency duties on certain systems regardless of risk tier: AI systems that interact directly with people (e.g. chatbots) must disclose they are AI; emotion-recognition and biometric-categorisation systems must inform the people exposed; and generative/“deepfake” systems must mark synthetic audio, image, video or text as artificially generated or manipulated (machine-readable where feasible).
A GPAI model displays significant generality and can competently perform a wide range of distinct tasks (e.g. a large language or multimodal foundation model), whether or not it is later integrated into downstream systems. If so, Chapter V GPAI obligations apply on top of any system-level tier.
A GPAI model is presumed to carry systemic risk when it has high-impact capabilities — the Act uses a training-compute threshold (> 10^25 FLOP) as a presumption, or Commission designation. Such models carry additional Art. 55 duties. Only relevant if the box above is on.
The Act applies where the system is placed on the market or put into service in the EU, or where its output is used in the EU — regardless of where the provider or deployer is established. If there is no EU nexus, the Act may not apply to you (confirm with counsel).
Why this classification
scopeThere is an EU nexus (EU market/service or output used in the EU), so the AI Act applies regardless of where your organisation is established.
classificationOn your answers the system is not prohibited, not high-risk and has no Art. 50 transparency trigger, so no AI-Act-specific product obligations attach. Voluntary codes of conduct (Art. 95) are encouraged, and AI-literacy still applies.
Obligations checklist
Scoped to your role and tier, with the Regulation article references. This is a starting map, not an exhaustive compliance programme — confirm each against the official text with counsel.
Cross-cutting (applies broadly)
- Art. 4AI literacy — ensure staff who operate or use AI on your behalf have a sufficient level of understanding (applies to providers and deployers from ~Feb 2025).
Provider: MINIMAL risk — no AI-Act-specific product obligations
On your answers the system is not prohibited, not high-risk and has no Art. 50 transparency trigger, so no AI-Act-specific product obligations attach. Voluntary codes of conduct are encouraged, and the AI-literacy duty still applies to providers and deployers. Re-assess if the use case or features change. This is not a legal determination.
Not legal advice and not a legal determination. This is a simplified reading of Regulation (EU) 2024/1689 — confirm with qualified counsel and the official text.
The law behind this tool
The EU AI Act is Regulation (EU) 2024/1689. It takes a risk-based approach: a short list of prohibited practices, a regulated high-risk category, transparency obligations for certain systems, and otherwise minimal regulation — plus a separate set of duties for general-purpose AI models.
Regulation (EU) 2024/1689 (EU AI Act)Dates and obligations are phased and summarised. Always confirm against the official Official Journal text and any later delegated/implementing acts and standards.
Save this assessment
The permalink encodes your answers in the link only (base64url, no server). Share it with counsel or your governance team.
Timeline — when obligations apply
The AI Act applies in phases. Dates below are approximate and phased — milestones most relevant to your result are highlighted. Confirm exact dates against the official Regulation text.
- approx. Aug 2024Entry into force
The Regulation entered into force (20 days after its publication in the Official Journal in July 2024). The phased application dates below are counted from this point.
- approx. Feb 2025 (~6 months)Prohibitions + AI-literacy duties apply
The Art. 5 prohibited practices and the Art. 4 AI-literacy obligation (ensuring staff who operate/use AI have sufficient understanding) become applicable, along with the general provisions.
- approx. Aug 2025 (~12 months)GPAI rules + governance + penalties
Obligations for general-purpose AI model providers (Chapter V), the governance framework (AI Office, notifying authorities) and most of the penalty provisions become applicable.
- approx. Aug 2026 (~24 months)Most of the Act — incl. Annex III high-risk
The bulk of the Regulation applies, including the high-risk obligations for Annex III use-case systems and the Art. 50 transparency obligations.
- approx. Aug 2027 (~36 months)Annex I embedded high-risk systems
The high-risk obligations for AI that is a safety component of (or is) a product regulated under the Annex I harmonisation legislation reach their extended application date.
Reminder: this is an educational self-assessment, not legal advice, and not a legal determination of your obligations or the applicable dates. Confirm with qualified counsel and the official Regulation (EU) 2024/1689 text.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.What this tool is
- A free, fully in-browser self-assessment that walks your organisation from its role under the EU AI Act to its risk tier and the headline obligations that follow. Pick your role, answer a short risk questionnaire, and get a verdict card, an article-referenced obligations checklist, the phased timeline, and Markdown/CSV exports. Nothing is uploaded.
- It is an educational self-assessment, NOT legal advice and NOT a legal determination. The disclaimer is repeated throughout, and the tool always tells you to confirm your classification and obligations with qualified counsel and against the official text of Regulation (EU) 2024/1689.
- Step 1 is your role: provider, deployer, importer, distributor, product manufacturer, or general-purpose AI (GPAI) model provider — each carries different duties. Step 2 routes you to a risk tier: prohibited (Art. 5), high-risk (Annex III use cases or the Annex I product-safety route), limited-risk/transparency (Art. 50), or minimal.
- The obligations checklist is scoped to your role × tier with the Regulation article references — e.g. a high-risk provider sees the risk-management system, data governance, technical documentation, logging, human oversight, conformity assessment and CE marking duties; a deployer sees the use-per-instructions, oversight, monitoring and FRIA duties; a GPAI provider sees the Art. 53/55 duties.
- Outputs are shareable: a permalink that encodes your answers in the URL (base64url, no server) and Markdown + CSV records you can hand to counsel or your governance team. Timeline dates are presented as approximate and phased — entry into force (~Aug 2024), prohibitions (~Feb 2025), GPAI (~Aug 2025), most high-risk (~Aug 2026), Annex I embedded high-risk (~Aug 2027).
Role first, then risk — because the Act works that way
The EU AI Act — Regulation (EU) 2024/1689 — does not regulate “AI” as a single thing. It assigns duties by role in the value chain and by the risk a specific system poses. A provider that develops and places a system on the market carries the heaviest high-risk obligations; a deployer that merely uses one carries a lighter, different set; importers and distributors mostly verify that the upstream duties were met. The same system can therefore mean very different things to two organisations. That is why this tool asks your role first, then routes the system to its tier.
The tiers are a ladder. A short list of prohibited practices (Art. 5) may not be placed on the market at all. High-risk systems — the Annex III use cases (biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration, justice) and the Annex I product-safety route — carry the full conformity programme. Limited-risk systems owe only transparency under Art. 50, and everything else is minimal. Layered on top, a general-purpose AI model provider owes the Chapter V duties regardless of any downstream system’s tier. The classifier maps all of this to article references so you can look each one up — but it never substitutes for reading the Regulation with counsel, and it never claims to be the final word.
Frequently asked questions
Is this a legal determination of my EU AI Act obligations?
No. This is an educational self-assessment, not legal advice, and it does not and cannot make a legal determination of your role, your risk tier or your obligations. It is a simplified reading of Regulation (EU) 2024/1689 and may not reflect your specific facts, later delegated or implementing acts, harmonised standards, or official guidance. Confirm everything with qualified counsel and against the official Regulation text before relying on it.
What roles and risk tiers does it cover?
Roles: provider, deployer, importer, distributor, product manufacturer, and general-purpose AI (GPAI) model provider. Risk tiers: prohibited practices (Art. 5 — e.g. social scoring, untargeted facial-image scraping, certain biometric categorisation and manipulative or exploitative systems), high-risk (the Annex III use-case areas — biometrics, critical infrastructure, education, employment, essential services and credit, law enforcement, migration, and justice — plus the Annex I product-safety route), limited-risk transparency obligations (Art. 50 — chatbots disclosing they are AI, and labelling of deepfakes and synthetic content), and minimal. A short questionnaire routes you to the tier.
What obligations does it list?
They are scoped to your role and tier, with article references. A high-risk provider sees the Chapter III duties: risk-management system (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency to deployers (Art. 13), human oversight (Art. 14), accuracy/robustness/cybersecurity (Art. 15), a quality-management system (Art. 17), conformity assessment (Art. 43), the EU declaration of conformity and CE marking (Arts 47–48), registration (Art. 49), post-market monitoring (Art. 72) and incident reporting (Art. 73). A deployer sees the Art. 26–27 duties (use per instructions, human oversight, monitoring, logs, and a Fundamental Rights Impact Assessment where applicable). A GPAI provider sees the Art. 53 duties (technical documentation, information to downstream providers, a copyright policy and a training-content summary), plus Art. 55 systemic-risk duties for the largest models.
When do the obligations start applying?
The Act applies in phases, and the tool presents the dates as approximate. The Regulation entered into force around August 2024; the prohibited practices and the AI-literacy duty apply from around February 2025; the GPAI-model rules from around August 2025; most of the Act, including the Annex III high-risk obligations, from around August 2026; and the Annex I embedded high-risk obligations reach their extended date around August 2027. Always confirm the exact dates against the official Regulation text, as they are phased and subject to later acts and guidance.
Does anything I enter leave my browser?
No. The whole tool is client-side React with static data — there are no network calls, no account and no analytics on your inputs. The shareable permalink encodes your answers directly in the URL using base64url, so the link itself carries the state with no server involved, and the Markdown and CSV records are generated and downloaded locally.
Does it invent statistics or legal conclusions?
No, deliberately. Every obligation, article reference, risk tier and timeline date is grounded in the public text of Regulation (EU) 2024/1689. The tool invents no statistics and reaches no legal conclusion — it structures the public framework and repeatedly points you to counsel and the official text.