EU AI Act (Regulation (EU) 2024/1689) Applicability test

Assess each AI system and each general purpose AI model separately. A single product can contain multiple AI systems, multiple model suppliers, and multiple intended purposes. If you test the product at too high a level, you will miss obligations that attach only to one component.

Capture intended purpose, target users, decision impact, deployment channel, and whether the output is intended to be used in the Union. That final point matters even when the provider or deployer sits outside the EU.

Check whether the system falls outside the Act because it is used only for military, defence, or national security purposes, or because it is still in pure research and development before being placed on the market or put into service. Document the reason and the evidence. Exclusions should be provable, not assumed.

Check the free and open source position carefully. The broad open source carve out does not apply where the system is high risk or where Article 5 or Article 50 duties are triggered. Teams often over rely on open source language and miss downstream obligations.

Decide whether you are acting as provider, deployer, importer, distributor, authorised representative, or product manufacturer for the specific system. You can hold more than one role in the same supply chain. The provider role can shift if you rebrand, substantially modify, or change intended purpose.

If the system will be placed on the Union market by a provider outside the EU, check whether an authorised representative is required. If the system uses a third party model, split model provider obligations from system provider obligations.

Check prohibited practices first. If Article 5 is triggered, the right answer is stop, redesign, or narrow the use case before launch. If not prohibited, test high risk status under Article 6 and Annex III or the product safety route. Then check transparency under Article 50 and model level duties under Chapter V for GPAI.

Do not treat these as mutually exclusive. A high risk system can also trigger transparency duties. A deployer using a third party GPAI model can still need upstream documentation to satisfy its own system level obligations.

The output of the test should be a one page decision record with links to evidence, not a vague conclusion. It should show the system or model, article triggers considered, outcome, owner, date, sources used, and the next review trigger.

This record should be stored where release, procurement, and governance teams can actually find it. A hidden spreadsheet is not an effective compliance control.