EU AI Act Risk Classifier

Updated for Regulation (EU) 2026/1744, which moved stand-alone high-risk deadlines to 2 December 2027.

Your role and scope

What is your role for this AI system?

Provider — we develop it or have it developed and sell/release it under our name Deployer — we use someone else's AI system in our business Both

Is the system placed on the EU market, used in the EU, or are its outputs used in the EU?

Yes No

Prohibited practices (Article 5)

High-risk uses

Is it used in any of these areas (Annex III)?

Is it a safety component of, or itself, a product covered by EU product-safety law listed in Annex I (e.g. medical devices, machinery, toys)?

Since the 2026 Omnibus, AI that only assists users or optimises performance, where a failure poses no health or safety risk, is not a safety component.

Yes No

If yes: must that product undergo a third-party (notified body) conformity assessment?

Only then is it high-risk under Article 6(1). Leave blank if you answered No above.

Yes No Not sure

Transparency features (Article 50)

Does it…

Interact directly with people (chatbot, voice assistant, AI agent) Generate synthetic text, images, audio or video Create deepfakes or publish AI-generated text to inform the public Recognise emotions or categorise people by biometrics

Do you provide a general-purpose AI model (a foundation model others build on)?

Yes No

The four risk levels of the AI Act

The EU AI Act sorts AI systems by risk. Prohibited practices have been banned since 2 February 2025. High-risk systems — those listed in Annex III, such as AI in hiring, credit scoring or education, and AI in regulated products — face the heaviest duties. Limited-risk systems, such as chatbots and generative AI, carry transparency duties. Everything else is minimal risk.

What the 2026 AI Omnibus changed

Regulation (EU) 2026/1744 entered into force on 27 July 2026. It moved the start of the stand-alone (Annex III) high-risk rules from 2 August 2026 to 2 December 2027, and the product-embedded (Annex I) rules to 2 August 2028. It did not delay the Article 50 transparency duties, which apply from 2 August 2026, except for a grace period to 2 December 2026 on machine-readable marking for generative systems already on the market. It also added two new prohibited practices — non-consensual sexually explicit imagery of real people and child sexual abuse material — banned from 2 December 2026. Systems that rely on the Article 6(3) "not high-risk" exception must still be registered in the EU database (simplified procedure).

Frequently asked questions

Was the EU AI Act delayed?

Only partly. High-risk deadlines moved to 2027 and 2028, but prohibitions, general-purpose AI duties and transparency duties were not delayed.

Is a customer-service chatbot high-risk?

Usually not. It is typically limited risk: you must tell users they are talking to an AI.

Is AI used to screen CVs high-risk?

Yes. Employment uses are listed in Annex III, so high-risk duties apply from 2 December 2027 unless the narrow Article 6(3) exception applies.

Last verified: 2026-10-11. Sources: official legal texts on EUR-Lex, legislation.gov.uk and the California Privacy Protection Agency; see the law library for each law's sources.