AI Act Risk Checker: which class does your system fall into?
One or two questions classify your use case: prohibited, high-risk, transparency obligations or minimal. You get the class, the legal basis and the concrete obligations - with the deadlines as amended by the Digital Omnibus.
By Michael Kaiser, founder of ArkeonTech Last updated:
Legal basis: AI Act (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus)
Question 1
Which task does the AI system perform?
No input is transmitted or stored.
The four risk classes of the AI Act
The regulation tiers its obligations by the risk of the use case. Prohibited are practices such as workplace emotion recognition (except for medical or safety reasons), social scoring and biometric categorisation of sensitive traits - in force since 2 February 2025 without transition. High-risk covers, among others, systems for recruitment and HR decisions, the creditworthiness of private individuals and education; after the Digital Omnibus their obligations apply from 2 December 2027. Limited transparency duties hit chatbots and voice assistants as well as deepfakes and AI texts on matters of public interest - Art. 50 applies since 2 August 2026. Everything else is minimal risk and carries no dedicated AI Act obligations.
How the check classifies
What matters is not the tool but the use: the same language model is transparency-obliged as a chatbot, high-risk as an applicant screener and free of duties as an internal drafting aid. The check therefore asks the area of use first and only drills down where the AI Act distinguishes sub-types. The result names the class, the legal basis and the obligation list - for high-risk also the Art. 6(3) exception for systems that do not evaluate people.
What this check does not do
It replaces neither legal advice nor a full review: the borders between permitted, high-risk and prohibited run along technical details a decision tree cannot capture. For borderline cases - individualised pricing, monitoring functions, mixed uses - the result deliberately recommends case review instead of false certainty.
Further reading
Read the article: which obligation applies to which useFrequently asked questions
Staggered: the Art. 5 bans and the Art. 4 literacy duty since 2 February 2025, the Art. 50 transparency duties since 2 August 2026. The Digital Omnibus (Regulation (EU) 2026/1744) moved the obligations for Annex III high-risk systems to 2 December 2027, and for high-risk systems in Annex I products to 2 August 2028.
Up to EUR 35 million or 7% of worldwide annual turnover for prohibited practices, up to EUR 15 million or 3% for breaches of the other obligations. In principle the higher amount applies, for SMEs the lower one (Art. 99(6)).
The check classifies the use case, not the product. ChatGPT as an internal drafting aid is free of duties, as a customer-service bot transparency-obliged, as an applicant screener high-risk - and used for workplace emotion recognition or social scoring it breaches Art. 5.
As deployer you use the system in accordance with the provider's instructions, assign oversight to trained people, keep the logs for at least six months and inform employees and affected persons (Art. 26). The conformity assessment lies with the provider. The obligations apply from 2 December 2027.
It applies wherever the system's output is used in the EU - a Swiss company deploying AI for EU customers falls under it. Companies acting purely domestically are not directly covered.
No. It maps the main lines of the regulation and names the legal basis per result. Borderline cases - individualised pricing, monitoring functions, mixed uses - belong in legal case review.
Matching ArkeonTech service
High-risk does not mean impossible - just documented
We build AI systems so the obligations are designed in from the start: instructions for use, human oversight, logging and the documentation the AI Act requires.