What are the four risk categories of the EU AI Act?

The Act sorts AI by risk into four tiers: Prohibited (Art 5 — banned outright), High-risk (Art 6 with Annex I or Annex III — heavy compliance duties), Limited-risk (Art 50 — transparency disclosures only), and Minimal-risk (everything else — no mandatory duties). General-purpose AI models sit on a separate parallel track under Articles 51–55.

Is my chatbot high-risk under the EU AI Act?

Usually no. A customer-service chatbot is normally limited-risk: under Art 50(1) you must tell users they are talking to an AI, but there are no Annex III duties. It only becomes high-risk if it is used in a listed area such as recruitment, credit scoring or essential services — then the Art 9–15 obligations apply.

When do the high-risk AI obligations apply?

Most high-risk obligations apply from 2 August 2026 (Art 113) for Annex III systems. High-risk AI that is a safety component of an Annex I regulated product has until 2 August 2027. The Art 5 prohibitions and the Art 4 AI-literacy duty have applied since 2 February 2025, and GPAI-model rules since 2 August 2025.

What AI practices are prohibited under Article 5?

Eight categories: subliminal or manipulative techniques, exploiting vulnerabilities, social scoring, predicting crime from profiling alone, untargeted facial-image scraping, emotion inference at work or school, biometric categorisation of sensitive traits, and real-time remote biometric identification in public for law enforcement. These have been banned since 2 February 2025.

Does the EU AI Act apply to a company outside the EU?

Yes, it can. Under Art 2 the Act applies extraterritorially when the output of an AI system is used in the EU, regardless of where the provider or deployer sits. A Sri Lankan software team building an AI feature for an EU client, or whose system's results reach EU users, falls within scope.

What is a general-purpose AI (GPAI) model and how is it treated?

A GPAI model (such as a large language model) is trained on broad data and adaptable to many tasks. It carries its own duties under Art 53 — technical documentation, a training-data summary and a copyright policy. If training compute exceeds 10²⁵ FLOPs it is presumed to pose systemic risk, adding Art 55 duties: model evaluation, adversarial testing, incident reporting and cybersecurity.

Can an Annex III system avoid being high-risk?

Sometimes. Art 6(3) lets a provider treat an Annex III system as not high-risk if it does not pose a significant risk to health, safety or fundamental rights — for example, when it only performs a narrow procedural task. You must document and register that assessment, and it never applies to systems that profile individuals.

Is this tool legal advice?

No. It is a free triage that maps your answers to the published text of Regulation (EU) 2024/1689 and cites the relevant articles. It does not certify compliance or replace a lawyer. Use the copyable summary as a starting point for discussion with qualified counsel, and verify each citation against EUR-Lex.

EU AI Act · Compliance

EU AI Act Risk Classifier — Is My AI System High-Risk?

Answer six questions and find out instantly whether your AI is prohibited, high-risk, limited-risk or minimal-risk under Regulation (EU) 2024/1689 — with the exact articles, the obligations for your role, and the compliance deadline. Free, no signup, every branch cited.

By Induwara Ashinsana— Executive Director, Ryzera TechnologiesUpdated Jun 26, 2026

How it works

The classifier encodes the decision logic of the EU AI Act — Regulation (EU) 2024/1689, in force since 1 August 2024 — as a strict, ordered decision tree. The primary risk tier is decided on a first-match-wins basis, while general-purpose AI (GPAI) and transparency duties are evaluated as parallel overlays that can stack on top of whatever tier your system lands in. There is no arithmetic: the only “computation” is ordered branching and set membership, so the result is fully deterministic and reproducible from the cited articles.

Prohibited (Art 5). If the system performs any of the eight banned practices — social scoring, untargeted facial scraping, real-time remote biometric identification for law enforcement, emotion inference at work or school, and the rest — it is prohibited. It has been unlawful to place such a system on the market since 2 February 2025, so the tree short-circuits here and no obligation checklist is produced.
High-risk (Art 6 + Annex I / Annex III). If the AI is a safety component of an Annex I regulated product, or its intended use falls in any of the eight Annex III areas (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice), it is high-risk. Providers then carry the Art 9–15 duties — risk management, data governance, technical documentation, logging, transparency, human oversight and accuracy — plus conformity assessment and CE marking (Art 43, 48) and EU-database registration (Art 49). Deployers, importers and distributors carry the lighter duties of Art 26, 23 and 24 respectively.
Limited-risk (Art 50). If the system is not high-risk but interacts with people, generates synthetic content, performs emotion recognition or biometric categorisation, or produces deepfakes, it is limited-risk: you must disclose the AI interaction, label synthetic and deepfake content in a machine-readable way, and notify people of emotion recognition.
Minimal-risk. Everything else carries no mandatory obligations. The cross-cutting AI-literacy duty (Art 4, in force since 2 February 2025) and the voluntary codes of conduct (Art 95) are surfaced as recommendations.

The GPAI overlay (Art 51–55) attaches whenever you flag a general-purpose model: Art 53 documentation, a training-data summary and a copyright policy. Where training compute exceeds 10²⁵ FLOPs, the model is presumed to carry systemic risk (Art 51(2)), adding the Art 55 duties of model evaluation, adversarial testing, incident reporting and cybersecurity. Each result is double-checked: the same answers are re-run through an independent priority-table path, and the three worked examples below are encoded as a regression set so the tier logic cannot silently drift.

Worked examples

CV-screening recruitment AI (provider)

Sri Lankan vendor selling to an EU client

Role = Provider; no Art 5 practice ticked → not prohibited.
Not a GPAI model → no GPAI overlay.
Intended use = Employment / HR → Annex III §4 ticked.
First high-risk match wins → HIGH-RISK.
Duties: Art 9–15 + conformity assessment (Art 43, 48) + registration (Art 49).
Deadline: 2 August 2026 (Art 113). Art 6(3) self-exemption unlikely for ranking applicants.

Customer-support chatbot (deployer)

AI assistant on an e-commerce site

Role = Deployer; no Art 5 practice → not prohibited.
Not GPAI, not an Annex I product, no Annex III area → not high-risk.
Transparency: interacts directly with people → Art 50(1) trigger.
Result → LIMITED-RISK.
Duty: tell users they are interacting with an AI, unless it is obvious (Art 50(1)).
Deadline: 2 August 2026. AI-literacy (Art 4) surfaced as good practice.

Government social-scoring system (edge case)

Tests that the tree short-circuits at branch 1

Art 5 ticked: social scoring of citizens → Art 5(1)(c).
Even with law-enforcement and biometric answers also ticked…
…the first branch matches and wins → PROHIBITED.
Banned since 2 February 2025; no obligation checklist — the practice itself is unlawful.
Confirms later high-risk and transparency answers cannot rescue a banned system.

Frequently asked questions

Sources & references

Article references, the Annex III areas and the Article 113 dates on this page were last cross-checked against the official EUR-Lex text on 2026-06-26. Dates and citations are a dated static snapshot — always confirm against the live Regulation, which prevails. This is informational triage, not legal advice.

Related tools

LiveAI

AI Resume ATS Checker

Paste a resume and a job description to see an ATS score, missing keywords, format issues parsers struggle with, and section gaps. Scoring follows Workday, Greenhouse, and Lever guidance plus Jobscan's 2024 threshold. Runs in your browser, no signup.

Open tool

LiveAI

AI Image Detector

Check whether an image is AI-generated by reading its provenance metadata — C2PA Content Credentials, IPTC DigitalSourceType, and known generator signatures (Firefly, DALL·E, Midjourney, Stable Diffusion). Runs entirely in your browser; the image never leaves your device.

Open tool

LiveAI

AI Grammar Checker

Paste any English paragraph and get a corrected version side-by-side with the original — each edit highlighted and labelled. LanguageTool engine server-side, deterministic rule baseline cross-check. No upload, no API key, no signup.

Open tool

Rate this tool

Be the first to rate

Comments & feedback

Spotted a bug or want an improvement? Tell us — our team reviews every comment, and good ideas get built. Comments are public and anonymous.

Found a misclassification, edge case, or want to suggest an improvement?

Email me at [email protected] — most fixes ship within 24 hours.