The whole regulation turns on one question: which category your system lands in. The answer decides whether you have no duties, a couple, or a conformity process ahead of you.
Most explainers set out the four risk tiers and leave you to work out where you belong. That is the hard part, and it is the part they skip.
The tool below asks six questions and gives you the category, the date it applies from, and what is actually required. No email, no account, nothing stored. Your answers never leave your browser.
The categories are neither equal in size nor equally likely. In brief:
Three limits worth knowing, because they are where most misclassifications happen.
Borderline cases. The line between supporting a decision and making one is not sharp, and that is exactly where the Annex III assessment gets hard. Drafting a job advert is not high risk. Ranking the applicants is. Shortlisting three candidates for interview sits somewhere between, and that somewhere needs a specific assessment.
The Article 6(3) exemption. A system that formally falls within Annex III is nonetheless not high risk if it does not pose a significant risk to health, safety or fundamental rights. The criteria are narrow, the assessment has to be documented, and the system still has to be registered in the EU database. The tool does not ask about this — it would take more questions than the rest of the tree combined.
Everything that is not the AI Act. Data protection law applies from the first time personal data goes into a tool. Advertising law applies whoever wrote the copy. Employment and equality law already apply today, without waiting for anything new. For most organisations that is where the practical legal risk sits.
The same content the tool shows, as a reference. Same source, so the two cannot fall out of step.
The AI Act binds providers and deployers outside the EU only where the system is placed on the EU market or its output is used in the Union. If nothing you build or produce reaches the EU, it does not apply to you.
Article 2(1)(a) and (c).
Training a model from scratch, or substantially modifying one, can make you the provider of a general-purpose AI model with its own duties: technical documentation, information to downstream providers, a copyright policy, and a public summary of training data on the Commission's mandatory template. This is a separate track that has applied since 2 August 2025, and the AI Office has been able to fine providers since 2 August 2026.
Chapter V, in particular Article 53. Models on the market before 2 August 2025 have until 2 August 2027.
Reselling an unchanged system leaves you with limited verification duties. But three things move you to the provider side with everything that entails: putting your own name or trademark on a high-risk system, substantially modifying it, or changing its intended purpose so that it becomes high-risk. White-labelling is the most common of the three, and it usually happens without anyone treating it as a legal decision.
Article 24 for distributors, Article 25 for when the role shifts.
At least one of the practices you ticked is banned under Article 5. The prohibitions have applied since 2 February 2025 and were untouched by the deferral. There is no conformity assessment that makes the use lawful. Stop, and get a specific legal assessment before anything resumes — several prohibitions have narrow exceptions, and that is not an assessment a tool can make for you.
Article 5. Penalties up to 35 million euros or 7 per cent of global annual turnover. Two further prohibitions — non-consensual intimate imagery and child sexual abuse material — apply from 2 December 2026.
The system falls within Annex III. The requirements moved from August 2026 to 2 December 2027, but their content is unchanged. If you use the system, Article 26 reaches you: follow the instructions for use, assign named people with the competence and real authority to oversee it, watch the input data, monitor operation, suspend on risk, keep the logs for at least six months, and inform both worker representatives and the people affected by the decisions. If you supply the system, the list is considerably longer.
Article 6(2) and Annex III. Deployer duties in Article 26.
The system is embedded in a product that is already regulated. The AI requirements then follow the product's own conformity route, and the deadline is 2 August 2028 — a year later than originally set. In practice the AI part belongs in the same conformity assessment as the rest of the product, not in a separate track.
Article 6(1) and Annex I.
The system is not high-risk, but it creates content or talks to people, which brings Article 50 into play. Those rules took effect on 2 August 2026 and enforcement began the same day. This is the part of the regulation that reaches ordinary organisations first. Exactly what you have to do depends on the content type — use the decision tree.
Article 50.
The system falls outside the prohibitions, the high-risk categories and the transparency duties. That covers the large majority of AI in ordinary use: search, sorting, forecasting, internal recommendations, spam filters. The regulation asks nothing of you here beyond the literacy duty, and merely encourages voluntary codes of conduct.
None of Chapters II, III or IV applies.
That is the most common place to end up for an organisation using generative AI for content or customer conversations, and it is the only tier that asks anything of you today. The next step is working out what actually has to be disclosed — which depends on the content type, and for text on whether anyone carried out a genuine editorial review.
The decision tree on the labelling page walks you through it and hands you wording to paste. Editorial responsibility sets out the workflow that removes the duty entirely for published text.