How the check works
The AI Act (Regulation (EU) 2024/1689) regulates AI by what a system is used for, not by the technology. The check follows the order of the Regulation:
- Scope. Is there a link to the EU (Art. 2(1)), and does an exclusion apply, such as military use, scientific research, pre-market development or purely personal use (Art. 2(3) to 2(10))? Open-source systems are out of scope unless they are prohibited, high-risk or covered by Article 50 (Art. 2(12)).
- Role. Provider, deployer, importer or distributor (Art. 3). A deployer that rebrands, substantially modifies or repurposes a high-risk system becomes its provider (Art. 25).
- Prohibited practices (Art. 5), banned since 2 February 2025, plus the new prohibitions on AI generating non-consensual intimate imagery and child sexual abuse material from 2 December 2026.
- High-risk. AI in products under Annex I that need third-party conformity assessment (Art. 6(1)), or an Annex III use (Art. 6(2)), unless the Article 6(3) exception applies. A system that profiles people is always high-risk.
- Transparency (Art. 50): chatbots, generated content, emotion recognition, deepfakes and AI-generated public-interest text.
- General-purpose AI models (Art. 51 to 55), with extra duties for models with systemic risk.
Every obligation in the result comes with its article and the date it applies from, so you can see what applies now and what to plan for. AI literacy (Art. 4) applies to every provider and deployer.
The dates after the Digital Omnibus
| Date | What applies | Reference |
|---|---|---|
| 2 February 2025 | Prohibited practices; AI literacy | Art. 4, 5, 113(a) |
| 2 August 2025 | General-purpose AI models (models placed on the market earlier: by 2 August 2027) | Art. 53, 55, 111(3), 113(b) |
| 2 August 2026 | General date of application, including Article 50 transparency | Art. 50, 113 |
| 2 December 2026 | New prohibitions; content marking for generative AI placed on the market before 2 August 2026 | Art. 111(4), 113(a) as amended |
| 2 December 2027 | High-risk obligations for Annex III uses | Art. 113(c)(i) as amended |
| 2 August 2028 | High-risk obligations for AI in Annex I products | Art. 113(c)(ii) as amended |
More detail in the EU AI Act timeline. Subscribe to every date, with reminders, in the EU compliance deadlines calendar.
What this check is not
It is a structured self-assessment from your answers, not a legal opinion or a conformity assessment. Borderline cases, especially the Article 6(3) exception and whether a product falls under Annex I, depend on details the questions cannot capture; check them against the Commission's guidelines and, where needed, with a lawyer. National authorities and the AI Office may issue further guidance.
The same rules are available to AI assistants as the ai_act_scope_check tool of the ClevSec MCP server.
Frequently Asked Questions
Does the AI Act apply if we only use tools like ChatGPT or Copilot at work?
Yes, as a deployer, but usually lightly. You must take measures to support the AI literacy of the staff who use them (Art. 4), avoid prohibited practices (Art. 5) and, from 2 August 2026, disclose deepfakes and AI-generated text you publish on matters of public interest (Art. 50(4)). The duties for general-purpose AI models fall on the model provider. If you use the tool for an Annex III purpose, such as screening job applicants, the high-risk deployer duties apply from 2 December 2027.
When do the AI Act high-risk obligations apply?
After the Digital Omnibus (Regulation (EU) 2026/1744): from 2 December 2027 for the Annex III uses, such as recruitment, credit scoring, education and essential services, and from 2 August 2028 for AI in products covered by Annex I, such as machinery, toys and medical devices. They were originally due in August 2026 and August 2027.
Is a CV screening or recruitment tool high-risk?
Almost always. Recruiting and selecting people, in particular placing targeted job ads, filtering applications and evaluating candidates, is listed in Annex III point 4. The Article 6(3) exception for narrow or preparatory tasks never applies to a system that profiles people, and ranking or scoring candidates usually involves profiling.
What is the difference between a provider and a deployer?
The provider develops an AI system, or has it developed, and places it on the market or puts it into service under its own name, including for its own use (Art. 3(3)). The deployer uses a system under its authority (Art. 3(4)). Providers carry most obligations. A deployer becomes the provider of a high-risk system if it puts its name on it, substantially modifies it, or changes its purpose so that it becomes high-risk (Art. 25(1)).
Is our customer service chatbot high-risk?
Usually not. A chatbot that answers questions is normally a transparency case: since 2 August 2026 its provider must make sure people are told they are dealing with an AI system, unless that is obvious (Art. 50(1)). It becomes high-risk only if it is used for an Annex III purpose, for example deciding on eligibility for public benefits or on credit.
Is my data stored?
No. The check runs in your browser and sends nothing to any server. Take a screenshot or note your result before you leave the page.
Related
EU AI Act Timeline
What applies when after the Digital Omnibus.
AI Agent Risk Calculator
Score one agent's security risk and missing controls.
AI Agents and the GDPR
Legal basis, Article 22, DPIAs and transparency.
GDPR DPIA Helper
Screen the processing; the DPIA can feed a FRIA.
Sources
- Regulation (EU) 2024/1689 (AI Act), Articles 2 to 6, 16, 22 to 27, 49 to 55, 72, 73, 99, 101, 111, 113 and Annexes I and III, EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), OJ L 24.7.2026, EUR-Lex
Disclaimer: This is a self-assessment for informational purposes only, based solely on your answers. It does not constitute legal, regulatory or professional advice and is not a conformity assessment. Created by ClevSec, an independent studio that builds free compliance tools and guides from the official EU texts. About us
Last updated: November 2026