AI Act risk classification tool (free)

Your use case

1 Does the system do any of these banned practices? Art. 5(1)

Tick every one that applies.

Manipulative or deceptive techniques that distort behaviour and cause significant harm Exploits vulnerabilities due to age, disability or a social or economic situation Social scoring that leads to unjustified or unrelated detrimental treatment Predicts a person’s risk of committing a crime from profiling or personality alone Builds facial recognition databases by untargeted scraping of images Infers emotions at work or in education (outside medical or safety reasons) Biometric categorisation that infers race, beliefs, union membership or sexual orientation Real-time remote biometric identification in public spaces for law enforcement Generates intimate images of an identifiable person without consent, or abuse material (from 2 December 2026)

2 Is the AI a product, or a safety component of a product, covered by EU product law such as medical devices, machinery, toys, lifts or vehicles? Art. 6(1), Annex I Yes No Not sure

4 Does it profile people: evaluate or predict their work, economic situation, health, preferences, behaviour or location? Art. 6(3), GDPR Art. 4(4) Yes No

5 Does one of these describe it, with no significant risk of harm to health, safety or fundamental rights? Art. 6(3) A narrow procedural task, such as sorting documents into categories It improves the result of work a person has already completed It detects patterns or deviations in decisions, without replacing the human assessment A preparatory task for an assessment a person makes None of these

6 Does it talk with people directly, or generate text, images, audio or video they will see? Art. 50 It talks with people (a chat or voice agent) It generates content people will see Neither: it works behind the scenes

7 Who puts it into service? Art. 3(3), 3(4) We develop it, or have it developed, and use it under our own name We use a system another company provides

8 Does it process personal data? Yes, including health or other special-category data Yes No

How it decides

The rules the screener applies, in order.

Prohibited (Art. 5). Any ticked practice in question 1 means the use is banned. The bans have applied since 2 February 2025; the points on intimate images and abuse material apply from 2 December 2026.
High-risk through a product (Art. 6(1), Annex I). A product or a safety component of one under Annex I law is high-risk where that law requires a third-party conformity assessment. These rules apply from 2 August 2028.
High-risk through its use (Art. 6(2), Annex III). A use in one of the eight Annex III areas is high-risk from 2 December 2027, unless the exception below applies.
Always high-risk when it profiles (Art. 6(3)). An Annex III system that profiles people is always high-risk, whatever its task.
The exception (Art. 6(3), 6(4), 49(2)). Without profiling, an Annex III system that does a narrow procedural, improving, pattern-checking or preparatory task, with no significant risk of harm, may not be high-risk. The provider documents that assessment before use and registers the system.
Transparency (Art. 50). A system that talks with people tells them it is an AI, at the latest at the first interaction; generated content is marked. From 2 August 2026.
Role (Art. 3). Providers carry the build-side duties (Art. 9 to 15 for high-risk systems); deployers use the system per its instructions, with oversight, logs and monitoring (Art. 26).
GDPR applies on its own. Whatever the AI Act class, personal data brings GDPR: a lawful basis, minimisation, a DPA with processors, and a DPIA where the risk is high. Special-category data needs an Art. 9(2) condition.

What it can’t do

Where a screen stops

It reads your answers, not your systemA use case described as “preparatory” can still shape a decision. The real test is what the system does in practice.
It doesn’t know national lawSector rules (credit, insurance, health, public bodies) add duties the AI Act doesn’t list.
The dates are our readingOf the consolidated text after the Digital Omnibus, read 12 November 2026. Counsel should check them against the Official Journal.

The EU AI Act, article by article The EU AI Act for companies deploying AI agents

Questions

About the screener

Is the result a legal classification?

No. It is a first screen from your answers, to prepare a conversation with your counsel. A classification you can rely on is written down with its reasons, for the specific system and context, and confirmed by your counsel.

Does the tool store or send my answers?

No. It runs entirely in your browser. There is no form submission, no cookie and no analytics on this site.

Why does profiling always make an Annex III system high-risk?

Because Art. 6(3) says so: the exception for narrow, preparatory or improving tasks does not apply where the system performs profiling of natural persons. GDPR Art. 4(4) defines profiling broadly, including predicting a person’s economic situation, health or behaviour.

Our agent only answers customer questions. Which class is that?

Usually not high-risk, but it has the Art. 50 transparency duty from 2 August 2026: people are told they are interacting with an AI. If it handles personal data, GDPR applies in full.

AI Act risk classification tool: a first screen in eight questions.

Your use case

The rules the screener applies, in order.

Where a screen stops

About the screener

Bring one process. Leave with a risk class, a pass bar and a plan.