We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Applicability TestEU AI Act

EU AI Act Check whether the Act applies

Work through five checks to find the duties that apply to your AI.

Identify the tool, test exclusions, confirm your role, check risk categories and save the decision.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
5 sections8 primary sources
Overview

Start with the tool's intended use. The checks below separate system risk categories from the rules for general-purpose AI models. Record the relevant application date after you identify each duty.

Section 1

1. Is it an AI system or a model?

An AI system infers how to produce outputs from inputs, for explicit or implicit objectives. It operates with some autonomy, may adapt after deployment, and produces predictions, content, recommendations or decisions that can influence physical or digital environments.

Software that only executes operations using human-defined rules may fall outside that definition. Recital 12 distinguishes inference from simpler software and basic data processing.

A general-purpose AI (GPAI) model can perform many distinct tasks. The model needs further elements, such as an interface, to form an AI system. Assess the model and any application built with it separately.

  • Name the item: system, embedded safety component, reusable model, model inside an application, rules-only software or manual activity.
  • Describe its inputs, objective, autonomy, inference, outputs and effect on people or the environment.
  • For rules-only software, retain the rules and explain why the inference test is not met.
  • For a model, record internal use, API access, downloads, EU supply and integration into applications.
Section 2

2. Does an exclusion apply?

Check Article 2 before assigning duties. Solely scientific research and development has a separate exclusion from pre-market research, testing and development. The pre-market exclusion does not cover real-world testing.

Military, defence and national-security exclusions depend on the exclusive purpose and actual supply or use. Reassess if the system later has a civilian, law-enforcement, public-security or other non-excluded purpose.

  • Write down the exclusion and the facts that satisfy it.
  • Separate research and prototypes from customer pilots, market release, production use and post-release changes.
  • For free and open-source systems, check high-risk status, Article 5 and Article 50 before relying on Article 2(12). GPAI models have their own limited open-source exceptions.
  • For defence or national-security uses, retain the purpose, users, contract and any planned civilian use.
  • If facts are missing, continue the remaining checks and assign the unresolved question for review.
Section 3

3. What is the EU connection and your role?

The Act can cover EU and non-EU organisations supplying systems or GPAI models to the EU market, putting systems into service in the EU, or using systems in the EU. Non-EU providers and deployers can also be covered when outputs are used in the EU.

Assign roles per system and activity. You may be a provider when releasing your own tool, a deployer when using a supplier's tool, or a downstream provider when building an AI system with a model.

  • Record market supply, first use, provider and deployer locations, affected people and where outputs are used.
  • Identify relevant providers, deployers, importers, distributors, representatives, manufacturers and model integrators.
  • For a non-EU GPAI provider, check whether Article 54 requires an EU authorised representative.
  • Use contracts, architecture diagrams, deployment controls and intended-purpose statements to support the role decision.
Section 4

4. Check the four risk categories, then GPAI rules

The Commission explains system risk through four labels: unacceptable, high, limited or transparency, and minimal or no risk. The Act assigns duties through specific uses and articles.

Screen prohibited practices first. Then check high-risk status and transparency duties separately: Article 50 can apply to a high-risk system too. A minimal/no-risk conclusion still leaves relevant duties, including Article 4 measures to support AI literacy and other applicable laws.

GPAI models have a separate framework. A model's systemic-risk status is not a fifth system risk category. Using a supplier's model does not by itself make you its model provider.

The new ban concerning specified non-consensual intimate material and child sexual abuse material applies from 2 December 2026. Record it separately from the original Article 5 prohibitions, which already apply.

  • Unacceptable risk: check Article 5 manipulation, exploitation, social scoring, profiling-only criminal-risk prediction, untargeted face scraping, restricted emotion and biometric uses, and the new content prohibitions. Stop and review any possible match.
  • High risk: check Article 6(1) covered products and safety components, then the exact Annex III use cases in biometrics, infrastructure, education, employment, services, law enforcement, migration, justice and elections.
  • Annex III exception: establish no significant risk of harm and a listed Article 6(3) task condition. Profiling people prevents use of the exception. Keep the assessment and Article 49(2) registration evidence.
  • Limited or transparency risk: check direct AI interaction, synthetic output marking, emotion and biometric notices, deepfake disclosures and covered public-interest text.
  • Minimal or no risk: document why the preceding system rules do not apply. Keep Article 4 and other legal duties in the review.
  • GPAI models: identify the model provider and check documentation, information for integrators, copyright policy, training summary and any extra systemic-risk duties.
Section 5

5. Save the decision and set review triggers

Keep a record another reviewer can follow: facts, role, classification, legal source, evidence, owner and approval.

For high-risk systems, link the decision to risk management, data governance, documentation, logs, instructions, oversight, testing, conformity, registration, monitoring and incident reporting. For GPAI, link model documentation, integrator information, any required representative mandate and systemic-risk evidence.

Use obligation-specific dates. The 2026 amendment retains 2 August 2026 as the general date, but Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) systems. Original prohibitions have applied since 2 February 2025 and GPAI duties since 2 August 2025.

Where do we start?

Identify what the tool does and whether you are assessing an AI system, a reusable model or simpler software. Check inference, autonomy, outputs and the effect on people or the environment.

Can an Annex III system be treated as not high-risk?

Yes, if Article 6(3) is satisfied: no significant risk of harm and at least one listed task condition. The exception is unavailable for an Annex III system that profiles people. Providers must document the assessment before supply or first use and meet the registration requirement.

What evidence should we retain?

Keep the intended use, EU scope facts, exclusions, roles, classification checks, source references, approvals, supporting product records and review triggers.

  • Decision: name, version, intended purpose, EU connection, roles, exclusions, prohibition check, high-risk analysis, transparency duties, GPAI duties, sources, reviewer and approver.
  • Attachments: architecture, model documentation, supplier contract, instructions, notices, oversight procedure, logs, applicable impact assessments, registration and change history.
  • Review after a new EU release, user group, purpose, substantial modification, supplier or model update, biometric or employment use, public-authority deployment or generated-content feature.
  • Explain negative conclusions too: why the item is not an AI system, why an exclusion applies, or why high-risk or Article 50 duties do not apply.
  • Keep the version of the law used, the amendment's 27 July 2026 entry into force, and each duty's application date.
Get help

Review your applicability decision

Sorena can help you check the facts, identify missing evidence and assign the next actions.

Research workflow
Ask Research Copilot

Ask about the five checks, risk categories or the evidence for your use case.

Explore next step
Talk to Sorena
Discuss your AI Act review

Review your use case, evidence and next steps with Sorena.

Explore next step
Primary sources

References and citations

Regulation (EU) 2024/1689 (EU AI Act)
eur-lex.europa.eu6 citations
Referenced sections
  • Primary legal source for AI system definition, scope, exclusions, operator roles, prohibited practices, high-risk classification, transparency duties, GPAI duties, registration, documentation, and evidence requirements.
  • Supports the AI system definition in Article 3(1), Recital 12's distinction from simpler software, and Recital 97's distinction between GPAI models and AI systems.
  • Supports exclusions for military, defence, national-security, and certain scientific research and development contexts, including limits when systems are later used for non-excluded purposes.
Show 3 more
  • Supports Article 2 scope and the operator-role structure used to route provider, deployer, importer, distributor, and GPAI obligations.
  • Primary support for Articles 5, 6, 50, 53, 55, and Annex III classification logic.
  • Primary support for keeping classification, technical, registration, monitoring, and GPAI documentation tied to the applicable obligation.
"laying down harmonised rules on artificial intelligence"
More quoted passages
"infers, from the input it receives"
"military, defence or national security purposes"
"placing on the market, putting into service and use"
"High-risk AI systems referred to in Article 6(2)"
"documentation of the assessment"
European Commission - AI Act regulatory framework
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission overview used for the risk-based framework, prohibited and high-risk examples, transparency category, and GPAI explanation.
  • Explains the Commission's risk-based categories and notes that GPAI models can become the basis for AI systems in the EU.
  • Supports the four risk levels, examples of prohibited and high-risk uses, transparency requirements, and GPAI rule overview.
"risk-based rules for AI developers and deployers"
More quoted passages
"The AI Act defines 4 levels of risk"
European Commission - Navigating the AI Act
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission Q&A used for territorial scope, actor coverage inside and outside the EU, exclusions, high-risk examples, transparency requirements, and GPAI summary.
  • Commission Q&A confirms that research, development, and prototyping before market release and systems exclusively designed for military, defence, or national security purposes are exempt.
  • Explains that the framework applies to actors inside and outside the EU that place AI systems or GPAI models on the EU market, put AI systems into service, or use them in the EU.
"inside and outside the EU"
More quoted passages
"There are certain exemptions to the regulation."
AI Act Service Desk - Article 49 registration
ai-act-service-desk.ec.europa.eu2 citations
Referenced sections
  • Official AI Act Explorer page used for high-risk and Article 6(3) registration evidence.
  • Supports evidence for registering high-risk AI systems and certain not-high-risk Article 6(3) classifications in the EU database.
"Before placing on the market"
More quoted passages
"register themselves and their system"
AI Act Service Desk - Article 54 authorised representatives for GPAI model providers
ai-act-service-desk.ec.europa.eu2 citations
Referenced sections
  • Official AI Act Explorer page used for third-country GPAI model provider authorised-representative checks and document retention evidence.
  • Supports the check for third-country GPAI model providers appointing an EU authorised representative and maintaining technical documentation access.
"providers established in third countries"
More quoted passages
"appoint an authorised representative"
European Commission - Guidelines for providers of general-purpose AI models
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission guidance page used for GPAI provider scope and obligations interpretation.
  • Supports scope checks for GPAI model providers and the Commission's interpretation of GPAI provider obligations.
"general-purpose AI models"
More quoted passages
"scope of the obligations for providers"
Regulation (EU) 2026/1744 - amended Article 4 AI literacy
eur-lex.europa.eu2 citations
Referenced sections
  • Binding amendment used for AI literacy evidence where staff or other persons operate or use AI systems on behalf of providers or deployers.
  • Supports measures to develop AI literacy for staff and other persons operating or using AI systems on behalf of providers or deployers, taking account of context and affected persons.
"take measures to support the development of AI literacy"
Regulation (EU) 2026/1744 - Digital Omnibus on AI
eur-lex.europa.eu2 citations
Referenced sections
  • Binding amendment used for the new prohibited-practice screen and the revised high-risk application dates.
  • Supports the new prohibited-practice category, its 2 December 2026 application date, and the revised Annex III and Article 6(1) high-risk application dates.

Related guides

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

Show all related guides (34)

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.

Are you the provider or the deployer? | EU AI Act

Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.

Do you need a notified body? | EU AI Act

Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.

Does this tool count as AI? | EU AI Act

Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.

How do you monitor AI after release? | EU AI Act

Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.

Is this industry use high-risk? | EU AI Act

See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.

What belongs in the technical file? | EU AI Act

See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.

What must general-purpose model providers do? | EU AI Act

Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.