- Home
- Suite features
- AI Act risk classification
Is your AI system prohibited, high-risk, or neither? A first pass
An EU AI Act risk classification tool gives each AI system a first tier: prohibited (Art. 5), high-risk (Art. 6, Annex III), transparency (Art. 50) or minimal; general-purpose AI models (Art. 51-56) run on their own track. Regingada's AI Portfolio assigns one tier per row by fixed rules, as a draft, without the Art. 6(3) exception test.
- Art. 5 · prohibited
- Art. 6(2) + Annex III
- Art. 50 · transparency
- Art. 51-56 · GPAI
- Art. 6(3) · not tested
Technology or use: what decides the tier?
The use decides. One language model can power a minimal-risk spam filter, a chatbot with disclosure duties and a high-risk essay grader. Article 6 attaches high-risk status to certain Annex I products and Annex III uses; Article 5 bans ten practices, two from 2 December 2026; Article 50 attaches transparency duties to chatbots, generated content and deepfakes.
Role comes before tier: from 2 December 2027 (Annex III), high-risk providers and deployers owe different duties (Art. 16, 26). Which role is yours, and when Art. 25 changes it: see the AI Act role check.
From the legal notice to a tier chip
Open /suite/#ai-act. Then:
- Confirm the legal notice (first visit only).
- Pick “AI Act” among the welcome cards.
- Answer the quick check. Role (“Unsure” counts as provider), establishment, and at least one of twelve system types; each except “Minors as target group” seeds a German-named row. Closing unsaved returns you to Home.
- Open “AI Portfolio” in the “AI Act · L4” sidebar. Per system: name, role, one of eight Annex III sectors or “None of the above / generic”, characteristics under “Auto-classify”, “+ Add System”.
- Refresh, then read the duties. Despite the portfolio's “recomputed on every add”, “Obligations”, “Annex IV” and “GPAI Cockpit” refresh only on a reload, language switch or change of view. Then click “Obligations”.
What the EU AI Act risk classification tool returns, rule by rule
The rules map the EU AI Act risk categories onto six chips, top to bottom, stopping at the first match.
| Rule, in order | Legal basis | Output |
|---|---|---|
| Social scoring, manipulative techniques or real-time remote biometric ID | Art. 5(1)(a), (c), (h) · since 2 February 2025 | Prohibited (Art. 5) + banner |
| Emotion recognition with “Deployed at workplace” | Art. 5(1)(f) | Prohibited (Art. 5) + banner |
| Training compute ≥ 1025 FLOPs | Art. 51(2): presumed above 1025 · Art. 55 · since 2 August 2025 | GPAI · Systemic Risk |
| General-purpose / foundation model | Art. 3(63), 53 | GPAI |
| Any Annex III sector | Art. 6(2) · from 2 December 2027 | High-Risk |
| Generative, chatbot, deepfake, emotion recognition, biometric categorisation | Art. 50 · since 2 August 2026 | Limited-Risk |
| None of these | No tier-specific duties · Art. 4 AI literacy still applies | Minimal |
Order decides the chip
A general-purpose model in the employment sector reads GPAI. The Act differs: a system built on it for an Annex III use is high-risk in its own right (Art. 6(2)); if you provide both, enter two rows. No manual override.
Two warning banners
A Prohibited row raises “Prohibited practice flagged (Art. 5)”; non-EU profiles with a High-Risk or GPAI row also see “Authorised Representative required (Art. 22 AI Act)”, undated. Art. 54 has applied to GPAI models since 2 August 2025; Art. 22 applies from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744.
What a chip unlocks
Any High-Risk row opens the portfolio-wide Annex IV technical documentation checklist, a GPAI row the GPAI Cockpit; otherwise, a gate message.
Searching for an EU AI Act compliance checker? The portfolio drafts the classification step, it does not check compliance; the duty list is on the EU AI Act compliance software page. Entries stay in your browser's localStorage, with no account (Trust Center).
One hypothetical company, four systems
A hypothetical ed-tech company in Madison, Wisconsin, without an EU office, licenses a course platform to European universities. Quick check: “Provider”, “Established outside the EU”. It replaces the placeholder rows with four systems:
- Essay graderEducation (Annex III.3), chip “Generative output”: High-Risk; grading essays evaluates learning outcomes, point 3(b). The feedback text still triggers the Art. 50 card.
- Proctoring add-onSame sector, chip “Emotion recognition”: High-Risk; proctoring is an Annex III use, point 3(d). Yet Art. 5(1)(f) has banned inferring emotions in education institutions since 2 February 2025, save for medical or safety reasons. The add form has no education chip; whether the feature falls under the ban is a question for a lawyer.
- Course assistantGeneric, chips “Chatbot” and “Generative output”: Limited-Risk, with the Art. 50 card.
- Spam filterGeneric, no chips: Minimal.
Non-EU, with two High-Risk rows, the company sees the representative banner; as “Provider” it gets 23 of the 38 obligation cards. The grader's licensed language model stays unticked: the general-purpose chip is for models you place on the market.
Where the rules are coarser than the Act
- No Art. 6(3) test: every Annex III sector yields High-Risk, narrow procedural tasks included.
- GPAI outranks the sector: a row with a general-purpose chip never reads High-Risk, even for an Annex III use.
- Sectors work at area level, Annex III at use level: an HR chatbot answering holiday questions matches no use; enter it as generic.
- Four of the ten Art. 5 practices have a chip; Art. 5(1)(b), (d), (e), (g), (ba) and (bb) have none, so an intimate-imagery generator ticked “Deepfakes” reads Limited-Risk. Real-time biometric ID is flagged whatever the purpose, though Art. 5(1)(h) concerns law enforcement.
- “Emotion recognition” turns Prohibited with “Deployed at workplace”, even for the medical or safety uses Art. 5(1)(f) exempts, but not in the education sector. In the generic sector it and “Biometric categorisation” read Limited-Risk, though Annex III point 1(b), (c) lists both as high-risk from 2 December 2027: pick the biometrics sector.
- The Annex I, minors and EU-use chips change nothing; only the quick-check Annex I option seeds a High-Risk row, and territorial scope (Art. 2) is not tested.
- One pooled profile: the duty list, its task ticks and the Annex IV checklist cover the whole portfolio; no card says which system triggered it. Rows cannot be edited, only removed (✕) and re-added.
- Per-system roles are display only; duties follow the quick-check role, which has no importer or distributor option. The representative banner and card also reach non-EU deployers, though only providers must appoint (Art. 54 now; high-risk dates above); an “Unsure” establishment hides both.
- Not a full AI system inventory: no field for intended purpose, owner or vendor; keep those in your own register.
- Some suite texts keep the original high-risk date (law as of 11 June 2026); check the AI Act timeline.
Frequently asked questions
Is my AI system high-risk under the EU AI Act?
Yes, if it is a product, or a safety component of one, under Annex I legislation requiring third-party conformity assessment (Art. 6(1)), or if its intended purpose matches an Annex III use (Art. 6(2)) and Art. 6(3) does not take it out. The duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I), Regulation (EU) 2026/1744.
What are the four risk categories of the EU AI Act?
Four in the usual summary, not in the Act's own terms: unacceptable risk (Art. 5), high risk (Art. 6, Annexes I and III), transparency risk (Art. 50) and minimal risk, without tier-specific duties. Art. 4 AI literacy still covers every AI system. General-purpose AI models follow their own track (Art. 51-56).
What are the eight Annex III high-risk areas?
Biometrics; critical infrastructure; education and vocational training; employment and workers' management; access to essential private and public services, including credit scoring (model case BonitätsCheck); law enforcement; migration, asylum and border control; and the administration of justice and democratic processes. Each area lists specific uses; the intended purpose must match one.
Is CV screening or recruiting AI high-risk?
In most cases, yes. Annex III point 4(a) lists systems for recruiting or selecting natural persons, including filtering applications and evaluating candidates. Ranking or scoring applicants will usually be profiling (Art. 3(52) AI Act with Art. 4(4) GDPR), which closes the Art. 6(3) route; duties apply from 2 December 2027. Model case: TalentSync.
Which AI practices are prohibited under Article 5?
Ten, as amended. Eight since 2 February 2025 (Art. 5(1)(a)-(h)): harmful manipulation, exploiting vulnerabilities, social scoring, crime prediction based solely on profiling, untargeted facial-image scraping, emotion recognition at work and in education, biometric categorisation by sensitive traits, and real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions. Regulation (EU) 2026/1744 adds two from 2 December 2026 (Art. 5(1)(ba), (bb)): AI generating non-consensual intimate imagery of identifiable people or child sexual abuse material.
Who decides whether the high-risk exception applies?
Not the software: an EU AI Act risk classification tool reads ticked boxes, the Act reads facts. The provider makes the Art. 6(3) assessment and documents it before placing the system on the market (Art. 6(4)); market surveillance authorities can review it (Art. 80). On that, the Art. 5 thresholds and the Art. 3(1) definition, the law firm Theo Funk can advise under a separate mandate.
In the suite, “Engagement Packages” → “Request Conformity Gap Report” drafts an email to the firm in your mail program: role, establishment, system count, tiers, no system names; you send it. For the representative role, use the service below, not the suite's mandate card.
A GPAI model from outside the EU? Art. 54 has required an authorised representative since 2 August 2025 (from 2 August 2027 for models already on the market then, Art. 111(3); not for open-source models without systemic risk, Art. 54(6)). For high-risk systems you provide, Art. 22 follows from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) under Regulation (EU) 2026/1744. Regingada UG (haftungsbeschränkt) can be appointed under its own written mandate: authorised representative service · fees. Representation, not legal advice.