How to Classify Your AI System Under the EU AI Act

Classification is the first decision in EU AI Act compliance, and the one everything else hangs on — your obligations, your deadline, and how much work you actually owe. Get it right and most systems land in the minimal tier with little to do. Get it wrong and you either over-engineer compliance for a spam filter or miss a high-risk recruitment tool.

There is a reliable order to it. Work the steps below in sequence for each system, classify by what it does, and write down each answer. Under the EU AI Act, Regulation (EU) 2024/1689, the same six steps settle every case.

Step 1 — Define the intended purpose

Before anything else, write the system's intended purpose — the use for which it is supplied, including the specific context and conditions of use (Article 3(12)). Classification is driven by use, not by the underlying technology or brand: the same large language model can power a minimal-risk drafting assistant or a high-risk hiring screener. A sharp, honest purpose statement makes every later step fall out cleanly; a vague one ("general productivity") hides the obligation.

Step 2 — Screen for prohibited practices (Article 5)

Next, check Article 5, the unacceptable-risk tier, in force since 2 February 2025. If the intended purpose is a prohibited practice, you stop here — you cannot make it compliant, you must not deploy it. The bans include social scoring, manipulative or vulnerability-exploiting techniques, untargeted facial-image scraping, and emotion recognition in the workplace and in education (Article 5(1)(f)). A breach here is the top penalty tier: €35,000,000 or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)).

Step 3 — Check the high-risk routes (Article 6 + Annex III, and the product route)

There are two ways into high-risk:

• The Annex III route (Article 6(2)): the intended purpose falls within one of the eight Annex III areas — biometrics; critical infrastructure; education; employment and worker management; access to essential private and public services (including creditworthiness and life/health-insurance pricing); law enforcement; migration, asylum and border control; administration of justice and democratic processes.
• The product route (Article 6(1)): the system is a safety component of, or is itself, a product covered by the Annex I sectoral legislation (medical devices, machinery, vehicles, etc.) and that product already requires third-party conformity assessment.

If neither route applies, skip to Step 5.

---

Step 4 — Apply the Article 6(3) filter

An Annex III system can still escape high-risk status. Article 6(3) exempts it where it poses no significant risk of harm because it meets any one of four conditions: a narrow procedural task; improving a previously completed human activity; detecting decision-making patterns or deviations without replacing or influencing the human assessment; or a preparatory task. One condition is enough — but a system that profiles natural persons is always high-risk and cannot use the exemption. Document the assessment (Article 6(4)) and note that an exempt Annex III system still registers under Article 49(2).

Step 5 — Check limited-risk transparency (Article 50)

If the system is not high-risk, check Article 50. Transparency duties bite on systems that interact with people (chatbots must disclose they are AI), generate synthetic audio/image/video/text (machine-readable marking), perform emotion recognition or biometric categorisation, or produce deepfakes. Most Article 50 duties apply from 2 August 2026; the content-marking duty applies from 2 December 2026. These are obligations, not a separate risk tier — a system can be otherwise minimal and still owe an Article 50 notice.

Step 6 — Otherwise, minimal risk

If the use is not prohibited, not high-risk, and not caught by Article 50, the system is minimal risk: no mandatory AI Act obligations beyond Article 4 AI literacy (in force since 2 February 2025, applying to all AI). Most business AI lands here. Record it as minimal with the reason — minimal is a conclusion, not an assumption.

Then fix your role

Risk tier tells you which obligations exist; your role tells you whose they are.

The Article 25 "flip" matters: a deployer becomes a provider if it puts its name or trademark on a high-risk system, substantially modifies one, or changes the intended purpose of a non-high-risk system so that it becomes high-risk. Fine-tune a model and ship it as your feature, and you have likely become its provider.

Document each step. The classification record — purpose, prohibited screen, Annex III result, the 6(3) reasoning, the Article 50 check, the role — is your evidence of diligence when a market-surveillance authority asks.

Worked example: Marea Software, ~18 employees, ~€2.4M turnover

Marea, a Valencia SaaS firm, runs three systems. (1) A customer-support chatbot built on a general-purpose model: not prohibited, not Annex III → limited-risk, owes an Article 50(1) disclosure; Marea uses it as supplied, so it is the deployer. (2) Internal coding and analytics assistants: not prohibited, not Annex III, no Article 50 trigger → minimal-risk; only Article 4 literacy applies. (3) A planned "candidate pre-screening" feature for its own hiring, scoring applicants — Annex III point 4, profiling, no 6(3) escape → high-risk; and because Marea would build and ship it under its name, it would be the provider (Article 16). Marea parks feature 3, documents the other two, and trains staff under Article 4.

How Confir helps

Confir walks each system through exactly this sequence — intended purpose, Article 5 screen, Annex III and the product route, the Article 6(3) filter, Article 50, then the Article 16/26 role with the Article 25 flip — and records the cited reason at every step. The engine is deterministic and rule-based: the same intake always returns the same classification, role, and obligation list, with the rule that fired shown in plain English.

Frequently asked questions

Where do I start when classifying an AI system?

With the intended purpose under Article 3(12) — the specific use, context and conditions for which the system is supplied. Classification follows use, not technology, so a clear purpose statement drives every later step. The same model can be minimal-risk in one use and high-risk in another.

What order should the classification steps follow?

Define the intended purpose, screen Article 5 for prohibited use, check Annex III (Article 6(2)) and the Article 6(1) product route, apply the Article 6(3) exemption filter, check Article 50 transparency, and otherwise conclude minimal risk. Then fix your role as provider (Article 16) or deployer (Article 26).

How do I know if I'm a provider or a deployer?

You are a provider (Article 16) if you develop and place a system on the market under your own name; a deployer (Article 26) if you use a third-party system under your authority. Article 25 flips a deployer into a provider if it rebrands, substantially modifies, or repurposes a system into a high-risk use.

What if my system is not in Annex III?

Then it is not high-risk via that route. Check whether Article 6(1) applies (a safety component of an Annex I product), then Article 50 transparency. If none of these catch it, the system is minimal-risk, with no mandatory obligations beyond Article 4 AI literacy.

Why document each classification step?

Because the record is your evidence of diligence. A market-surveillance authority can ask what AI you run and how you classified it; a written trail — purpose, prohibited screen, Annex III result, the 6(3) reasoning, role — answers that and prevents both over-scoping and missed high-risk systems.

When do high-risk obligations actually start?

Stand-alone Annex III high-risk obligations apply from 2 December 2027 under the Digital Omnibus, and product-embedded ones from 2 August 2028. The Digital Omnibus has been adopted by Parliament and Council (June 2026); entry into force follows Official Journal publication, expected before 2 August 2026.

Related guides

• How AI risk classification works
• The risk classification decision tree
• The Article 6(3) exemption explained
• Provider vs deployer
• Annex III high-risk use cases
• Intended purpose (Article 3(12))