DAILY

Risk classification

Available Artificial intelligence

The AI Act (Regulation (EU) 2024/1689) classifies AI systems by risk: prohibited practices (Art. 5), high-risk systems (Art. 6 with Annexes I and III), systems with transparency obligations (Art. 50) and all others. This assessment walks through the classification in that order and names the obligations and the application date set by the Omnibus Regulation (EU) 2026/1744. It concerns a specific AI system, not a general-purpose AI model.

Scope

1. Is it an AI system within the meaning of Art. 3(1): a machine-based system that operates with varying levels of autonomy and infers from input how to generate outputs such as predictions, content, recommendations or decisions that can influence physical or virtual environments?

Rule-based software without inference (simple calculations, fixed decision tables) is generally not an AI system under the Commission guidelines on the definition.

Art. 3 Nr. 1 KI-VO Open in the law texts
2. Is the system used exclusively for military, defence or national-security purposes, exclusively for scientific research and development, or by a natural person in a purely personal, non-professional activity?
Art. 2 Abs. 3, 6 und 10 KI-VO Open in the law texts

Prohibited practices (Art. 5)

These practices have been prohibited since 2 February 2025. A single "yes" is enough.

3. Does the system deploy subliminal, manipulative or deceptive techniques to materially distort behaviour and impair the ability to make an informed decision, causing or likely causing significant harm?
Art. 5 Abs. 1 lit. a KI-VO Open in the law texts
4. Does the system exploit vulnerabilities due to age, disability or social or economic situation to materially distort behaviour in a harmful way?
Art. 5 Abs. 1 lit. b KI-VO Open in the law texts
5. Does the system evaluate or classify persons over time based on social behaviour or personal characteristics (social scoring) leading to detrimental treatment in unrelated contexts or disproportionate to the behaviour?
Art. 5 Abs. 1 lit. c KI-VO Open in the law texts
6. Does the system assess or predict the risk of a person committing a criminal offence based solely on profiling or personality traits?
Art. 5 Abs. 1 lit. d KI-VO Open in the law texts
7. Does the system create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage?
Art. 5 Abs. 1 lit. e KI-VO Open in the law texts
8. Does the system infer emotions of persons in the workplace or in education institutions (except for medical or safety reasons)?
Art. 5 Abs. 1 lit. f KI-VO Open in the law texts
9. Does the system categorise persons based on biometric data to deduce race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation?
Art. 5 Abs. 1 lit. g KI-VO Open in the law texts
10. Is the system used for real-time remote biometric identification in publicly accessible spaces for law enforcement (outside the narrow exceptions)?
Art. 5 Abs. 1 lit. h KI-VO Open in the law texts
11. Is the system used to generate or disseminate non-consensual intimate imagery (deepfake nudes) or child sexual abuse material?

Prohibition inserted by Omnibus Regulation (EU) 2026/1744; applies from 2 December 2026.

Art. 5 Abs. 1 lit. i (Omnibus 2026/1744) KI-VO Open in the law texts

High-risk areas (Art. 6, Annexes I and III)

12. Is the system a safety component of a product – or itself a product – covered by the Union harmonisation legislation in Annex I and subject to third-party conformity assessment (e.g. medical devices, machinery, lifts, vehicles, aviation)?
Art. 6 Abs. 1, Anhang I KI-VO Open in the law texts
13. Biometrics: remote biometric identification, biometric categorisation by sensitive attributes, or emotion recognition (where not prohibited)?
Anhang III Nr. 1 KI-VO Open in the law texts
14. Critical infrastructure: safety component in the management or operation of critical digital infrastructure, road traffic, or the supply of water, gas, heating or electricity?
Anhang III Nr. 2 KI-VO Open in the law texts
15. Education: access or admission to institutions, evaluation of learning outcomes, assessing the level of education, or monitoring during tests?
Anhang III Nr. 3 KI-VO Open in the law texts
16. Employment: recruitment or selection (job adverts, filtering applications, evaluating candidates), decisions on terms, promotion or termination, task allocation, or monitoring performance and behaviour?
Anhang III Nr. 4 KI-VO Open in the law texts
17. Essential services: eligibility for public benefits, creditworthiness or credit scoring, risk assessment and pricing in life and health insurance, or triage of emergency calls and services?
Anhang III Nr. 5 KI-VO Open in the law texts
18. Law enforcement: use by or for law-enforcement authorities for risk assessment, polygraphs, evaluating evidence, predicting offences or profiling?
Anhang III Nr. 6 KI-VO Open in the law texts
19. Migration, asylum and border control: risk assessment, examining applications, identifying persons?
Anhang III Nr. 7 KI-VO Open in the law texts
20. Administration of justice and democratic processes: assisting courts in interpreting and applying the law, or influencing elections and referendums?
Anhang III Nr. 8 KI-VO Open in the law texts

Exception under Art. 6(3)

A system in an Annex III area is not high-risk where it poses no significant risk to health, safety or fundamental rights because it only performs one of the following tasks. The exception never applies where the system profiles natural persons.

21. Does the system only perform a narrow procedural task?
Art. 6 Abs. 3 lit. a KI-VO Open in the law texts
22. Does the system only improve the result of a previously completed human activity?
Art. 6 Abs. 3 lit. b KI-VO Open in the law texts
23. Does the system only detect decision-making patterns or deviations without replacing or influencing the human assessment?
Art. 6 Abs. 3 lit. c KI-VO Open in the law texts
24. Does the system only perform a preparatory task to an assessment relevant for the Annex III use cases?
Art. 6 Abs. 3 lit. d KI-VO Open in the law texts
25. Does the system perform profiling of natural persons?

Profiling within the meaning of Art. 4(4) GDPR. A "yes" rules the exception out.

Art. 6 Abs. 3 UAbs. 3 KI-VO Open in the law texts

Transparency obligations (Art. 50)

26. Does the system interact directly with natural persons (e.g. chatbot, voice assistant)?
Art. 50 Abs. 1 KI-VO Open in the law texts
27. Does the system generate synthetic audio, image, video or text content?
Art. 50 Abs. 2 KI-VO Open in the law texts
28. Is an emotion recognition or biometric categorisation system operated (where not prohibited)?
Art. 50 Abs. 3 KI-VO Open in the law texts
29. Does the system generate or disseminate deepfakes or AI-generated text informing the public on matters of public interest?
Art. 50 Abs. 4 KI-VO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.
Menu
Preview · What this means
Dark paper