Key questions (ask first)
Use during AI system intake review, conformity assessment planning, or scoping deployer/provider obligations under EU AI Act (Regulation 2024/1689) — classifies risk tier, picks the Article 43 route, and tracks per-role obligations. Cites Articles. Not legal advice.
Article-cited operational compliance for Regulation (EU) 2024/1689. Three decisions, not executive AI strategy, not a legal substitute. Cite Articles + Annexes for every output; engage outside counsel for novel cases (GPAI determination, Art. 6(2) carve-out, "substantial modification").
Key questions (ask first)
Does it fall under Article 5 (prohibited)? Annex III (high-risk)? What org role (provider/deployer/importer/distributor)? Is it a GPAI model (Arts 51-55, stricter above 10²⁵ FLOPs)? For high-risk: Article 9 risk management + Article 27 FRIA done? Which Article 43 Module?
1. Risk classification (exactly one of four tiers)
| Tier | Source | Obligations |
|---|---|---|
| Prohibited | Art. 5 (social scoring, workplace/education emotion recognition, subliminal manipulation, real-time public biometrics) | Cannot place/use (up to €35M / 7% turnover) |
| High-risk | Art. 6 + Annex III (8 cats: biometrics, critical infra, education, employment, essential services, law enforcement, migration, justice) | Arts 8-17 (provider) + Art. 26 (deployer); conformity assessment; CE marking |
| Limited-risk | Art. 50 (chatbots, deepfakes) | Transparency disclosures |
| Minimal-risk | Default (spam filters, game AI) | None (voluntary codes, Art. 95) |
| Art. 6(3) carve-outs (NOT high-risk if): narrow procedural task / improves prior human activity / detects patterns without replacing human assessment / preparatory task. Caveat: profiling of natural persons is always high-risk. |
2. Conformity assessment + Annex IV docs (Art. 43)
- Module A (Annex VI) — internal control / self-assessment; most Annex III systems with harmonised standards.
- Module H (Annex VII) — full QMS + notified body; required for biometrics (Art. 43(1)). Annex IV technical documentation: general description · system elements (architecture, training data, validation) · monitoring/control · Art. 9 risk management · post-market changes · harmonised standards · EU declaration of conformity (Art. 47) · post-market monitoring (Art. 72). Then affix CE marking (Art. 48), register in EU database (Art. 71).
3. Per-role obligations
| Role | Articles | Key obligations |
|---|---|---|
| Provider (3(3)) | 8-17, 47, 49, 72 | Conformity, CE marking, risk mgmt, data governance, post-market monitoring, serious-incident reporting (Art. 73) |
| Deployer (3(4)) | 26 | Use per instructions, human oversight, input data quality, record-keeping, inform workers (26(7)), FRIA if public/essential (Art. 27) |
| Importer (3(6)) | 23 | Verify conformity + CE + docs |
| Distributor (3(7)) | 24 | Verify CE + docs before making available |
| Authorized rep (22) | 22 | Non-EU providers must appoint; liable for provider obligations |
| Art. 25: a deployer who substantially modifies a high-risk system, or places it under their own name, becomes a provider. |
Workflows
Intake review (~2h): document characteristics → classify → if high-risk plan conformity → identify roles → cross-check GDPR DPIA (if personal data) + ISO 42001 evidence → output classification memo + conformity plan + obligation list. Annex IV build (2-4wk): planner checklist → assemble docs (reuse ISO 42001 / 27001 evidence) → Art. 9 lifecycle → sign declaration AFTER assessment → CE mark → EU DB registration. Pre-deployment audit: confirm classification, conformity (if high-risk), Art. 50 transparency, Art. 72 monitoring live, Art. 73 incident reporting documented, deployer FRIA + workers informed, GPAI obligations. Annual refresh: re-classify (Art. 5 list expands via delegated acts), re-run obligations (Title III phases 2025→2027), verify monitoring + incident capacity, update Annex IV (Art. 11 ongoing).
Output standard
Bottom line (classification + most-significant obligation) · Article citation (don't paraphrase without cite) · the decision · evidence (Article + Annex refs + confidence) · how to act (3 steps, owner + deadline) · the call for compliance officer/legal (risk-class disputes, novel cases, GPAI threshold).
Last updated: October 13, 2026
Files (2)
- Jurisdiction
- 🇪🇺 European Union
- Practice area
- Regulatory
- License
- MIT
- Author
- aashutosh396
Test Key questions (ask first)
Ask a legal question — get an answer generated live from this skill’s instructions.
Sign in to test this skill.