iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Classify an AI system by its intended purpose, deployment context and likely effect on health, safety and fundamental rights—not by the model’s name alone. Start by confirming that the complete product or service is an AI system, then check prohibited practices, the two high-risk routes, transparency triggers and any separate general-purpose AI obligations. Finally, document the result and your organisation’s role as provider, deployer, importer or distributor.
The EU AI Act classification in one view
The Act uses a risk-based structure. In practice, your system will fall into one of four broad levels:
| Level | How it is identified | What it means |
|---|---|---|
| Prohibited risk | The system performs a practice expressly banned by the Act. | Do not place it on the market, put it into service or use it within the prohibition. |
| High risk | It follows an Annex I product-safety route or its intended use is listed in Annex III. | Extensive controls apply, including risk management, documentation, human oversight, testing and registration requirements. |
| Transparency risk | People may interact with AI or encounter generated or manipulated content without realising it. | Disclosure, labelling or detectability duties can apply even when the system is otherwise lawful. |
| Minimal or no risk | The system does not meet a prohibited, high-risk or specific transparency trigger. | The AI Act adds fewer direct controls, although other privacy, consumer, employment, product-safety or sector rules may still apply. |
A single organisation can have different classifications for different systems, and one product can contain several components with different duties. Classification follows the system’s use and context.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteStep 1: Confirm that you are assessing an AI system
Use the complete product or service, not just the model
The Act covers a machine-based system that can operate with varying levels of autonomy, may adapt after deployment, and infers from inputs how to generate predictions, content, recommendations or decisions that influence physical or virtual environments.
A foundation model or other model is often only a component. Assess the complete product or service: the model, interface, prompts or workflow, connected data, decision rules, human review and the setting in which customers or staff use it. A general chatbot model embedded in a recruitment tool, for example, must be assessed in the recruitment workflow rather than by its model label alone.
Write an intended-purpose statement
Before assigning a category, record a precise intended purpose. Include:
- What the system does and what output it produces.
- Who operates it and who is affected by the output.
- Where it is deployed, such as a workplace, school, hospital, bank, border-control setting or public website.
- Whether the output recommends, ranks, predicts, generates content or makes a decision.
- Whether a human can meaningfully review, override or correct the result.
- What could happen if the output is wrong, manipulated or unavailable.
Do not describe the purpose only as “uses AI” or “automates administration.” The classification depends on the function and consequences of the particular deployment.
Recommended Free Tools
Step 2: Check prohibited practices first
Prohibition is a stop condition. Check it before deciding whether the system is high risk or merely subject to transparency rules. Most prohibitions applied from February 2025. An additional prohibition covering non-consensual sexually explicit material and child sexual-abuse material takes effect in December 2026.
| Practice to screen for | What to examine in your system |
|---|---|
| Harmful manipulation or deception | Whether the system covertly steers people in a way that can cause serious harm. |
| Harmful exploitation of vulnerabilities | Whether it targets vulnerability linked to factors such as age or a disadvantaged situation to produce harmful behavioural change. |
| Social scoring | Whether people are evaluated or treated differently using broad social-behaviour scores unrelated to the legitimate context. |
| Certain individual criminal-risk prediction | Whether the system predicts an individual’s criminal risk in a way covered by the Act’s restriction. |
| Untargeted scraping for facial-recognition databases | Whether images are indiscriminately collected from the internet or CCTV to build or expand facial-recognition databases. |
| Workplace or education emotion recognition | Whether the system infers emotions in employment or education settings. The Act states exceptions, so document the exact use rather than assuming every emotion-related feature is banned. |
| Biometric categorisation by protected characteristics | Whether biometric data is used to assign people to categories based on protected characteristics. |
| Non-consensual sexually explicit or child sexual-abuse material | Check the additional prohibition and its December 2026 effective date when the system can generate or manipulate this material. |
If a feature could fit one of these descriptions, pause deployment and obtain a documented legal assessment. Calling the feature “personalisation,” “safety scoring” or “content generation” does not remove the need to test the underlying behaviour.
Step 3: Test the two high-risk routes
After eliminating prohibited uses, test both routes independently. A system is high risk if either route applies.
Rank #2
Route A: Annex I product-safety legislation
The first route covers an AI system that is a safety component of a product, or is itself a product, covered by specified Union harmonisation legislation listed in Annex I. The relevant question is not whether the product is marketed as “AI,” but whether the AI function is part of a regulated product-safety framework and falls within the applicable legislation.
Identify the product, the Union legislation that covers it and the AI function’s safety role. Keep the product classification and the AI classification together in your compliance file.
Route B: Annex III intended uses
The second route is based on intended use in one of the sensitive areas listed in Annex III:
| Annex III area | Questions for classification |
|---|---|
| Critical infrastructure | Could failure or inaccurate output affect the management or safety of critical infrastructure? |
| Education and vocational training | Does the system assess, select, admit, allocate or otherwise materially affect learners? |
| Employment, worker management and access to self-employment | Does it recruit, select, evaluate, allocate work or influence employment decisions? |
| Essential private and public services and benefits | Does it affect access to an essential service, benefit or related eligibility decision? |
| Biometrics | Does it identify, categorise or otherwise process biometric information for an Annex III use? |
| Law enforcement | Is it used for a law-enforcement purpose covered by Annex III? |
| Migration, asylum and border control | Does it support a listed migration, asylum or border-control decision or procedure? |
| Justice and democratic processes | Does it assist a listed judicial, electoral or democratic-process activity? |
Use the intended purpose and deployment facts, not a vendor’s marketing category. The European Commission’s 2026 classification material includes practical examples, but that material is identified as draft pending formal adoption. Treat examples as guidance and verify the final consolidated law and any amendments before relying on them.
Assess the effect on people
For every possible Annex III match, identify the affected persons and the decision pathway. A system that drafts internal notes may have a different classification from one that ranks applicants, determines access to a benefit or recommends an enforcement action. Record whether the output merely assists a professional or materially influences the outcome; do not assume that human involvement automatically removes high-risk status.
Step 4: Check transparency obligations
A system can be lawful and not high risk yet still have transparency duties. Article 50 obligations apply from 2 August 2026.
Rank #3
Human interaction with AI
Chatbots and social-companion systems generally need to inform people that they are interacting with AI. Put the disclosure where the interaction starts and where a reasonable user can see it; do not bury it in a general privacy policy. Document which interface displays the notice and when it appears.
Generated and manipulated content
Providers and deployers may need to make generated or manipulated content detectable. Deepfakes and certain text published to inform the public on matters of public interest require visible labelling under the applicable transparency rules. Determine whether your workflow creates, edits, distributes or republishes such content, and retain the labelling or provenance mechanism as evidence.
Transparency is not a substitute for high-risk controls
Adding a chatbot notice does not change a system’s intended purpose. A recruitment, benefits or law-enforcement tool can require both high-risk controls and transparency measures. Run the transparency test after, not instead of, the prohibited-practice and high-risk tests.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 5: Assess general-purpose AI separately
General-purpose AI obligations are a separate layer from application-level classification. The fact that a model is general purpose does not by itself decide whether an application built with it is prohibited, high risk or transparency risk.
The Commission says GPAI rules became effective in August 2025. They include obligations concerning transparency and copyright. Providers of models with systemic risk must assess and mitigate those risks. The Commission also provides a code of practice and a training-content summary template.
For a GPAI assessment, record whether your organisation provides the model, integrates another provider’s model into an application or deploys the resulting service. Keep the model-level analysis separate from the use-case analysis, then connect the two in your technical and governance documentation.
Step 6: Record the classification and your legal role
Minimum classification record
Your file should allow another reviewer to reproduce the decision. Include:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- The system name, version, components and deployment date.
- The intended purpose, users, affected persons and operating environment.
- Inputs, outputs, adaptation behaviour and the degree of autonomy.
- The prohibited-practice screening result and reasons for any exclusions.
- The Annex I product and legislation analysis, if relevant.
- The Annex III area analysis, including the exact intended-use entry considered.
- The transparency analysis for human interaction, generated content, deepfakes and public-interest text.
- Any GPAI or systemic-risk assessment.
- The conclusion, evidence reviewed, assumptions, reviewer, approval date and next review trigger.
Identify the organisation’s role
| Role | Why it matters |
|---|---|
| Provider | The organisation that develops an AI system or has it developed and places it on the market or puts it into service under its name or trademark. |
| Deployer | The organisation that uses an AI system under its authority, except where the use is a personal non-professional activity. |
| Importer | An organisation that places on the Union market an AI system bearing the name or trademark of an entity outside the Union. |
| Distributor | An organisation in the supply chain that makes an AI system available in the Union without being the provider or importer. |
The same group can occupy more than one role for different systems or transactions. Duties differ by role, so name the responsible entity in the classification record rather than referring only to the product team.
What high-risk classification requires you to plan
For a high-risk system, plan the compliance work before placing it on the market or putting it into service. The Act’s high-risk framework covers:
- A documented risk-management system covering the system’s lifecycle.
- Data governance and appropriate examination of training, validation and testing data.
- Automatic recording and retention of relevant logs.
- Technical documentation sufficient to demonstrate compliance.
- Clear instructions for use and information needed by deployers.
- Human oversight that can detect, interpret and address limitations or unexpected behaviour.
- Appropriate levels of robustness, accuracy and cybersecurity.
- Conformity assessment through the applicable route.
- Registration in the EU database where required.
These are not items to add after launch. Map each control to the intended purpose, affected people, provider or deployer role and the evidence that proves the control works.
Application dates and transition planning
| Date | Requirement or milestone | Planning implication |
|---|---|---|
| February 2025 | Most prohibited-practice rules began applying. | Screen existing and planned systems immediately; do not wait for a high-risk assessment. |
| August 2025 | General-purpose AI rules became effective according to the European Commission. | Separate model-level GPAI obligations from the application’s use-case classification. |
| 2 August 2026 | Article 50 transparency obligations apply. | Review chatbot notices, social-companion disclosures, content detectability and labelling before this date; it is now the applicable date. |
| December 2026 | The additional prohibition on non-consensual sexually explicit or child sexual-abuse material takes effect. | Review generation, editing and moderation features before the prohibition becomes applicable. |
| 2 December 2027 | Annex III high-risk rules are scheduled to apply. | Complete use-case mapping, controls and documentation well before deployment or the transition deadline. |
| 2 August 2028 | Annex I product-embedded high-risk rules are scheduled to apply. | Coordinate AI conformity work with the product-safety assessment and release cycle. |
These dates are subject to the consolidated law and amendments. Check the current legal text and Commission implementation material when fixing a compliance deadline.
Free tools Windows power users keep installed
One-click scans. No signup required.
A practical classification procedure
- Describe the complete system. List the model, interface, data flows, connected tools, human review and deployment environment.
- Write the intended purpose. Name the users, affected people, output and consequence of error.
- Screen prohibited practices. Stop if a listed manipulation, exploitation, scoring, biometric, scraping, emotion-recognition or criminal-risk use applies.
- Check Annex I. Determine whether the system is a safety component of, or product covered by, specified Union harmonisation legislation.
- Check Annex III. Compare the actual intended use with critical infrastructure, education, employment, essential services, biometrics, law enforcement, migration, justice and democratic-process entries.
- Check transparency. Test for AI interaction, generated or manipulated content, deepfakes and public-interest text.
- Assess GPAI. Determine whether model-level transparency, copyright or systemic-risk obligations apply separately.
- Assign the role. Identify provider, deployer, importer and distributor responsibilities for each organisation involved.
- Document and approve. Record the evidence, decision, assumptions, date, reviewer and next review event.
- Monitor change. Reclassify after a new purpose, user group, data source, model capability, autonomy level or deployment setting.
Common classification mistakes
Classifying the model instead of the use
A model name cannot tell you whether the deployed service affects employment, essential services or public safety. Assess the complete workflow and its consequences.
Best Value
Starting with “high risk” and ignoring prohibitions
A prohibited practice is not made acceptable by adding documentation or human review. The prohibited-practice screen comes first.
Treating a disclosure as full compliance
Informing users that they are speaking with a chatbot addresses a transparency question only. It does not resolve a high-risk or prohibited-use issue.
Assuming a human in the loop removes risk
Record what the human can actually see, challenge and override. A nominal approval step is not the same as effective oversight, and it does not erase the system’s intended purpose.
Using draft examples as final law
Commission classification material identified as draft for 2026 can help with practical interpretation, but confirm the formally adopted text before making a binding determination.
Failing to revisit the decision
Classification can change when a system is connected to a new data source, offered to a new group, used in a new sector or given authority to trigger actions. Set a review event for each material change.
Decision outcome
Your final record should state one of these outcomes for the specific deployment: prohibited; high risk through Annex I; high risk through Annex III; subject to transparency obligations; GPAI obligations at the model layer; or minimal/no risk under the AI Act’s risk framework. More than one outcome can apply—for example, a high-risk employment system can also require transparency, while a provider can have GPAI duties in addition to application-level duties.
The defensible classification is the one supported by a precise intended-purpose statement, a documented prohibition screen, both high-risk route checks, a transparency review, a separate GPAI assessment and a clearly assigned organisational role.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
