EU AI Act checker: risk class of your AI workflow

Answer the questions for one specific workflow, for example quote preparation or incoming invoice checks. The result is a first orientation under the AI Act, Regulation (EU) 2024/1689.

01Your role
We use a bought-in system from a provider in our processRole: deployer under Art. 3(4). Substantially modifying the system can make you a provider.We develop the system ourselves or have it developed for us, and put it into service under our own nameEven if it only runs inside our company. Role: provider under Art. 3(3) and (11), and deployer as well.
02Prohibited practices (Art. 5)
Influences people with manipulative or deceptive techniques so that they risk significant harmRates people by social behaviour or personality with detrimental consequences (social scoring)Recognises the emotions of employees at work, except for medical or safety reasonsCategorises people biometrically by sensitive traits such as ethnicity, political opinion or sexual orientationBuilds facial recognition databases by untargeted scraping of images from the internet or CCTVNone of these
03Safety component of a product (Art. 6(1))Is the AI system a safety component of a product, such as a machine, a lift or a medical device, or itself such a product, that requires a third-party conformity assessment under EU law?
YesNo
04Use areas in Annex III
Employment: screening applications, decisions on promotion or termination, task allocation based on behaviour, monitoring or evaluating performanceCreditworthiness of natural persons, or risk and pricing in life and health insuranceSafety component in the management and operation of critical infrastructure: digital infrastructure, road traffic, water, gas, heating, electricityRemote biometric identification, biometric categorisation or emotion recognitionAccess to education or assessment in education and trainingPublic benefits, emergency calls, law enforcement, migration, justice or electionsNone of these
05Transparency (Art. 50)
People interact directly with the system, for example in a chat or by email without human reviewThe system generates text, images, audio or video that is published without human editorial controlNone of these

Classification

The classification appears once all questions are answered.

How the check is built

The check follows the structure of the AI Act, Regulation (EU) 2024/1689. It first settles your role: deployers use a system under their own authority, providers develop it or have it developed and place it on the market or put it into service under their own name, including for their own use. It then checks the prohibited practices in Art. 5, the product link in Art. 6(1), the use areas in Annex III with the exception in Art. 6(3), and finally the transparency duties in Art. 50.

Your answers stay in your browser. The result names the category, the main obligations and the dates from which they apply.

Why most operational workflows are not high-risk

Annex III lists areas in which AI decides about people or carries safety: employment, creditworthiness, education, biometrics, critical infrastructure as a safety component, public benefits and law enforcement. An agent that drafts quotes, prepares complaints or checks delivery notes usually belongs to none of them.

The line runs where the same agent judges people. A service agent that classifies tickets is different from one that rates the performance of the handlers. That is why the classification is written down per workflow, not per tool.

What deployers of a high-risk system must do

Art. 26 requires the deployer to use the system according to the provider's instructions, assign human oversight to competent people, check input data for relevance, monitor operation and keep the automatically generated logs for at least six months. Before use at the workplace, workers and their representatives must be informed.

A proper control set covers much of this anyway: permissions, thresholds, checkpoints, logging and escalation. The difference lies in documentation that market surveillance can inspect.

Which dates apply

The prohibitions and the AI literacy rule have applied since 2 February 2025, the obligations for general-purpose AI models since 2 August 2025, and the transparency duties of Art. 50 since 2 August 2026. For the high-risk obligations, Regulation (EU) 2026/1744 set fixed new dates: 2 December 2027 for Annex III and 2 August 2028 for products under Annex I. The guide AI Act timeline lists every date with its source.

Questions

Common questions

Is the check legal advice?

No. It gives a first orientation along the text of the Regulation. The binding classification of a system is for your compliance function or legal counsel.

Are we a deployer or a provider?

Whoever uses a bought-in system from a provider in their own process is a deployer under Art. 3(4). Whoever develops a system or has it developed and puts it into service under their own name is a provider under Art. 3(3) and (11), even if it only runs inside the company, and a deployer as well. A substantial modification of a bought-in system can also trigger the provider role.

Does the AI literacy duty apply to us?

Yes, if you provide or deploy AI systems. Since the amendment by Regulation (EU) 2026/1744, Art. 4 requires measures to support the AI literacy of your staff; it does not require you to guarantee any specific level. Neither the Regulation nor the German KI-MIG sets a separate fine for it.

Are there official checking tools?

Yes. The European Commission offers a detailed Compliance Checker on its AI Act Service Desk, and in Germany the Bundesnetzagentur offers the KI-Compliance-Kompass on its KI-Service-Desk. Our check is shorter and tailored to individual workflows with AI agents.

AI Act check: how does your AI workflow classify under the EU AI Act?

How the check is built

Why most operational workflows are not high-risk

What deployers of a high-risk system must do

Which dates apply

Common questions

Where to go next

Start with one workflow.