EU AI Act Risk Classifier — free tool

1 What is your role with the AI system?

The Act applies mainly to providers (who build or place a system on the market) and deployers (who use one), where the system is used in the EU or affects people in the EU.

ProviderWe build, substantially modify, or put an AI system on the market / into service under our name. DeployerWe use an AI system in our work (e.g. an internal assistant), in the EU or affecting people in the EU. BothWe build it and we deploy it ourselves. Neither / no EU nexusNo AI system involved, or no connection to the EU market or people in the EU.

2 Does it do any of these? tick all that apply

These are prohibited practices under Article 5. If any apply, the use is banned in the EU regardless of anything else.

Social scoringEvaluating or classifying people over time leading to detrimental treatment. Subliminal or manipulative techniquesMaterially distorting behaviour in a way likely to cause harm. Exploiting vulnerabilitiesTargeting age, disability, or social/economic situation to distort behaviour. Untargeted facial scrapingBuilding face-recognition databases by scraping the internet or CCTV. Emotion recognition at work or schoolInferring emotions in the workplace or education (save narrow medical/safety uses). Sensitive biometric categorisationInferring race, political views, religion, sexual orientation, etc. from biometrics. Real-time remote biometric ID in publicBy law enforcement in publicly accessible spaces (narrow exceptions only). Predictive policing of individualsAssessing the risk of someone committing a crime based solely on profiling. AI nudification / AI-generated CSAM (banned from 2 Dec 2026)Two new prohibitions added by the Digital Omnibus.

3 Is it used in a sensitive, high-stakes area?

High-risk systems carry the heaviest obligations. Pick the closest match.

Yes — an Annex III areaBiometrics, critical infrastructure, education/exam scoring, employment & recruitment, access to essential services or credit scoring, law enforcement, migration/border, or justice & democratic processes. Yes — a safety component of a regulated productPart of a product (machinery, medical device, vehicle, lift…) that already needs third-party conformity assessment. (Annex I) In one of those areas, but only a narrow taskIt performs a preparatory or procedural task and doesn’t materially influence the decision/outcome. (Art. 6(3) exception) No — none of thesee.g. internal knowledge search, document Q&A, drafting support.

4 Which of these are true? tick all that apply

These trigger transparency duties under Article 50, and the GPAI rules for model providers.

It interacts directly with peopleA chatbot or assistant users talk to. It generates or edits contentImage, audio, video or text — including deepfakes and synthetic media. Emotion recognition or biometric categorisationIn a permitted context (otherwise see question 2). We provide a general-purpose AI modelWe train or place a foundation/LLM model on the market ourselves.

About this tool

Good to know

How accurate is this classification?

It’s an informed starting point, not a legal determination. The tool follows the Act’s structure — prohibited practices (Art. 5), high-risk areas (Annex I and III), and transparency duties (Art. 50) — but it can’t weigh every nuance of your specific system. Treat the result as a map, then verify against the consolidated text and qualified counsel.

Why don’t the dates match the “August 2026” deadline I’ve seen?

Because two different things get called “the August 2026 deadline.” The Digital Omnibus on AI — Regulation (EU) 2026/1744, in force since 27 July 2026 — moved the headline high-risk obligations to later, fixed dates: stand-alone high-risk systems (Annex III) to 2 December 2027 and high-risk systems embedded in regulated products (Annex I) to 2 August 2028. But 2 August 2026 was a real date, and it has passed — the Article 50 transparency duties have applied since then to providers and deployers (telling people they are interacting with AI; marking AI-generated content), and the Commission’s enforcement powers over general-purpose AI model providers are active. Prohibited practices (since Feb 2025) and GPAI duties (since Aug 2025) already apply.

Does this tool send my answers anywhere?

No. The entire classification runs in your browser with JavaScript. Nothing you select is uploaded, logged, or sent to a third party — which is the same principle RAGSuite is built on.

Take it further

Want this guaranteed in your own infrastructure?

Get a copy of these results by email and see RAGSuite running on a setup like yours — citation-backed, self-hosted, EU-ready.

Good to know

Want this guaranteed in your own infrastructure?

Evidence is easier when the system is yours.