Skip to main content
Arelis AI

Free tool

EU AI Act risk classifier

Answer a few short questions about one AI system. In about two minutes you get its likely risk class, the obligations that follow for your role, and the date each one applies.

  • 6–7 short steps
  • No sign-up
  • Runs in your browser
  • Updated for Regulation (EU) 2026/1744

Step 1 of 6 · Your role

Art. 3, Art. 25

What is your organisation's role for this AI system?

Answer for one AI system at a time. If you build a product on top of someone else's model, for example through an API, and offer or use it under your own name, you are usually the provider of that AI system, though not of the model.

You develop the system, or have it developed, and place it on the market or put it into service under your own name or trademark.

An in-house system: you are its provider and also its deployer.

You use it under your own authority in a professional context, for example a vendor's recruiting tool or chatbot.

You bring a non-EU provider's system onto the EU market, or resell it. Importers and distributors have verification duties for high-risk systems.

This is general information to help you scope your obligations, not legal advice.

Methodology

How the classification works

The AI Act sorts AI systems by what they are used for, not by the technology behind them. The classifier asks the questions in the order the Act applies them, and your role decides which duties are yours.

  • Prohibited

    Art. 5

    Practices banned outright since 2 February 2025: harmful manipulation, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted facial-image scraping, emotion recognition at work or in education, inferring sensitive traits from biometrics, and real-time remote biometric identification for law enforcement outside narrow exceptions. Regulation (EU) 2026/1744 added nudifier applications and child sexual abuse material. Fines reach €35 million or 7% of worldwide annual turnover.

  • High-risk

    Art. 6, Annex I and III

    Two routes. Annex III lists stand-alone uses: biometrics, critical infrastructure, education, employment, essential services such as credit scoring, law enforcement, migration, and justice and elections. Those obligations apply from 2 December 2027. Annex I covers AI that is a safety component of, or is itself, a product needing third-party conformity assessment under EU product law, from 2 August 2028. Article 6(3) exempts Annex III systems that only perform narrow, preparatory or supporting tasks, unless they profile people.

  • Transparency

    Art. 50

    Not a rung on the risk ladder but a layer across it. Chatbots must disclose that they are AI, generated content must be machine-readably marked, and deployers must disclose deep fakes, emotion recognition and AI-written text on matters of public interest. Applies from 2 August 2026; marking for systems already on the market from 2 December 2026.

  • Minimal risk

    Art. 95

    Everything else, which is where most AI systems fall: spam filters, recommendation features, internal productivity tools. No specific AI Act obligations, though AI literacy measures are expected and voluntary codes of conduct are encouraged. An AI inventory and a management system still make sense.

General-purpose AI models

Models sit beside the ladder. If you train a general-purpose model, or significantly modify one, and place it on the market, you have had documentation, copyright and training-content duties since 2 August 2025 (Art. 53), with further duties for models with systemic risk (Art. 55). Using a model through an API does not make you its provider.

Your role changes the duties

Providers build a system and place it on the market or put it into service under their own name; deployers use it under their own authority. Under Article 25 a deployer, importer or distributor becomes the provider of a high-risk system if they put their name on it, substantially modify it, or change its purpose so that it becomes high-risk.

Timeline

When each obligation applies

Dates as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI). Status as of 20 October 2026.

EU AI Act application dates, obligations, references and status
DateWhat appliesReferenceStatus

AI Act enters into force

The regulation is published and the staggered application periods begin.

Art. 113In force

Prohibited practices

Unacceptable-risk AI is banned, including social scoring, manipulative techniques and untargeted facial-image scraping.

Art. 5In force

General-purpose AI models

Providers of general-purpose AI models must meet documentation, copyright and transparency duties. Fine-tuning can make you a provider.

Art. 51–56In force

Transparency obligations

People must be told when they interact with AI, and synthetic audio, image, video and text must be marked. Applies regardless of risk class.

Art. 50In force

Content-marking grace period ends

Systems already on the market must apply machine-readable marking to generated content. The disclosure duty itself applied from August.

Art. 50(2)Upcoming

High-risk systems (Annex III)

Risk management, data governance, technical documentation, human oversight and conformity assessment for stand-alone high-risk AI.

Art. 6–49, Annex IIIUpcoming

High-risk AI in regulated products (Annex I)

High-risk obligations for AI embedded in products covered by EU harmonisation legislation.

Art. 6(1), Annex IUpcoming

Sources

Method, sources and limits

The questions follow the order the Act applies: prohibited practices (Art. 5), high-risk classification through Annex I and Annex III with the Article 6(3) exemption, transparency duties (Art. 50) and general-purpose AI models (Art. 51–55). Your role under Articles 3 and 25 decides which duties are yours and which you should check your supplier meets. Where you answer “Not sure”, the classifier takes the more cautious reading and asks you to confirm.

It classifies one system at a time and assumes the system is within the Act’s scope: it does not test the exclusions in Article 2, such as military use, scientific research or purely personal use. It does not cover other law that applies to the same system, such as the GDPR or sector rules.

This is general information to help you scope your obligations, not legal advice. Results are likely classifications based on your answers.

FAQ

Questions about the classifier

Is my chatbot high-risk?
Usually not. A customer-service or website chatbot is not listed in Annex III, so it is normally not high-risk. It is covered by Article 50: from 2 August 2026, people must be told they are talking to an AI unless that is obvious, and synthetic content it generates must be marked. A chatbot becomes high-risk if it is used for an Annex III purpose, such as screening job applicants or deciding eligibility for public benefits.
Does using GPT or another model through an API make us a GPAI provider?
No. Using a general-purpose AI model through an API does not by itself make you the provider of that model. If you build it into your own product and offer that product under your name, you are usually the provider of that AI system, with whatever obligations its use triggers. You become a provider of a general-purpose AI model when you train one, or significantly modify one, and place it on the market.
What changed with the Digital Omnibus?
Regulation (EU) 2026/1744 moved the Annex III high-risk obligations to 2 December 2027 and the Annex I obligations to 2 August 2028. It narrowed the high-risk scope so that an AI component that only assists a user or optimises performance, without creating a health or safety risk, falls outside it. Article 50 transparency still applies from 2 August 2026, with a grace period to 2 December 2026 for machine-readable marking by systems already on the market. It also added a prohibition on nudifier applications and child sexual abuse material, with a transitional period to the same date.
What if our system is in Annex III but only does a narrow procedural task?
Article 6(3) says an Annex III system is not high-risk if it does not materially influence the outcome of decisions and only performs a narrow procedural task, improves the result of a completed human activity, detects decision-making patterns without replacing proper human review, or performs a preparatory task. The exemption never applies if the system profiles people. If you rely on it, document your assessment before placing the system on the market and be ready to give it to the authorities.
Is this legal advice?
No. This is general information to help you scope your obligations, not legal advice. The classifier gives a likely classification based on your answers. Confirm the result with legal counsel for systems near a boundary, and for anything flagged as prohibited or high-risk.
What should we do after classifying?
Record the system in an AI inventory with its classification, your role and the reasoning behind each answer. Work through the obligations the classifier lists, starting with anything already in force, and re-run the classification whenever the system's purpose, users or model change. An AI management system aligned with ISO/IEC 42001 gives that work a repeatable structure.
Do you store the answers we enter?
No. The classifier runs entirely in your browser and your answers are not sent to us. If you have accepted analytics cookies, we record only that a classification was completed, with the resulting tiers and role.

Classified one system? Govern all of them.

AIMS keeps every AI system's risk class, role, obligations and evidence in one register, aligned with ISO/IEC 42001 and built for the EU AI Act.

Book a demoGet the free ISO 42001 templates