Am I Ready for the EU AI Act? A 5-Question Self-Check

Probably not in the way you think — and probably less work than you fear. Most companies face nothing like the full high-risk regime, because Regulation (EU) 2024/1689 is risk-tiered: your obligations scale with what your AI does, not with the fact that you touch AI at all. This page is a fast locator, not the full methodology — five yes/no questions to find where you sit, then routes you to the deeper guides.

---

Before the questions: what "ready" actually means

"Ready" is relative to which obligations apply to you. There is no single finish line: a company running one chatbot and one selling a CV-ranking engine are held to entirely different standards, and both can be fully "ready" at very different effort.

The trap is assuming "not high-risk" means "nothing to do." It does not — Article 4 AI literacy has bound every provider and deployer since 2 February 2025, whatever the tier. The floor is never zero. The five questions below sort you into the right tier and show what applies.

---

Question 1: Do you build AI, or just use it?

The build-versus-use split maps to the two core roles and decides most of what follows. A provider develops an AI system or places it on the market under its own name or trademark (Article 3(3)). A deployer uses an AI system under its authority (Article 3(4)).

Buying a SaaS tool and switching it on usually makes you a deployer. Full stop. But the line is not where most people draw it: training or fine-tuning beyond the intended purpose, or rebranding someone else's system as your own, can flip you into provider territory under Article 25.

Why it matters: for a high-risk system, provider obligations (Article 16) are far heavier than deployer obligations (Article 26) — same tool, different duty set. If your answer is ambiguous, work through the provider versus deployer boundary before going further.

---

Question 2: Is anything you run Article 5-prohibited?

This is the highest-stakes question and the only part of the regime already fully enforceable. The Article 5 prohibitions have been in force since 2 February 2025 — a "yes" here means stop, not plan. The practices a company might plausibly hit:

• Subliminal, or purposefully manipulative or deceptive, techniques that materially distort behaviour.
• Exploiting vulnerabilities tied to age, disability, or socio-economic situation.
• Social scoring of natural persons based on behaviour or personal characteristics.
• Certain biometric categorisation, and emotion inference in workplace or education settings.

Two additions are scheduled: a prohibition targeting CSAM and "nudifier"-type generation lands on 2 December 2026 — the same date as the Article 50 content-marking duties for synthetic content. The penalty is the top tier: up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)). If you answered yes, this is the one thing you act on today.

---

Question 3: Does any system touch an Annex III high-risk area?

Annex III lists the stand-alone high-risk areas. The ones companies actually meet are employment (point 4: 4(a) recruitment and selection, 4(b) in-employment decisions), critical-infrastructure safety components (point 2: water, gas, heating, electricity, road traffic), plus education, access to essential private and public services including creditworthiness, and biometrics.

Be honest about what is not here. Most marketing, adtech, and logistics AI is not high-risk. If that is you, the high-risk regime is the wrong thing to chase — watch Article 50 transparency instead (disclose AI chatbots, mark deepfakes and synthetic content), plus the Article 4 floor.

A second high-risk route people miss: product-embedded AI under Article 6(1) and Annex I. Annex I Section B covers motor-vehicle type-approval under Regulation (EU) 2018/858, plus aviation, rail, and marine — if your AI is a safety component of a regulated product, you arrive at high-risk through that door.

One escape hatch: under Article 6(3), an Annex III system rebuts high-risk status if it performs only a narrow procedural task and does not materially influence the outcome — narrower than it sounds. For the full test, see the high-risk classification guide.

---

Question 4: When do your obligations actually bite?

Every "yes" needs a date, or readiness has no clock. Some duties are live now; the contested ones sit further out, and the "delay" headlines are half the story.

The context: the Digital Omnibus was adopted in June 2026 — the European Parliament passed it on 16 June 2026 and the Council on 29 June 2026. Entry into force follows Official Journal publication, expected before 2 August 2026. The deferral is fixed calendar dates; the standards-contingent "stop the clock" variant was rejected. Not everything is delayed — the in-force rows do not move.

---

Question 5: If you slip, what is at stake?

Readiness needs a cost anchor. The penalties run in three tiers, and the gradient is the point — the weight mirrors the risk.

• Prohibited practices: up to €35 million or 7% of total worldwide annual turnover, whichever is higher (Article 99(3)).
• High-risk and most obligation breaches: up to €15 million or 3% of total worldwide annual turnover, whichever is higher (Article 99(4)).
• Incorrect or misleading information to authorities: up to €7.5 million or 1% of total worldwide annual turnover, whichever is higher (Article 99(5)).

If you are an SME or a start-up, Article 99(6) caps you at the lower of the fixed sum or the percentage, not the higher figure most readers assume. Use the tiers as a prioritisation lever: fix Article 5 exposure first, then high-risk gaps. The remediation detail lives on the readiness and gap-analysis pages.

---

Worked example: locating a mid-sized company in five answers

Meridian Talent is a 180-person Berlin recruitment-software company.

Q1 — build or use? Meridian builds and sells a CV-ranking tool under its own name. That makes it a provider (Article 3(3)), not merely a deployer.

Q2 — anything prohibited? No Article 5 practice applies. The tool ranks; it does not manipulate, score socially, or infer emotion. Clear.

Q3 — Annex III? Yes. Automated candidate ranking is Annex III point 4(a) employment, so the tool is high-risk. The Article 6(3) narrow-task exemption does not apply, because ranking materially influences who gets selected.

Q4 and Q5 — when, and what is at stake? Meridian plans against the adopted 2 December 2027 high-risk deadline (entry into force is pending Official Journal publication, expected before 2 August 2026). It faces the €15 million or 3% tier (Article 99(4)), with the Article 99(6) lower-cap relief as an SME. Its customers using the tool are deployers under Article 26, so its documentation must support their obligations too — landing it squarely in the readiness-assessment workflow.

---

Where to go next based on your answers

Route by your answers:

• Yes on Article 5 — stop the practice and get immediate legal review. This is not a project to schedule.
• Yes on Annex III or Annex I — run a full classification, then a readiness assessment against the timeline.
• No on both — scope your Article 50 transparency duties and Article 4 literacy, and revisit the moment a system changes.

This self-check is the front door. The readiness-assessment, gap-analysis, and where-to-start pages are the rooms behind it, each carrying the depth this page deliberately does not.

---

How Confir helps

Once you know roughly where you sit, the next job is to make it precise for every system you run. Confir (confir.eu) maps each system to its tier, role, and obligation set, so the self-location becomes a documented record rather than guesswork.

The engine is deterministic and rule-based — no model inference, no hallucination. It encodes the Act's explicit rules, so the same inputs produce the same classification every time, and the rule that fired is human-readable and audit-defensible. It walks your systems through the Article 5 and Article 6 screens, derives your role via Article 25 logic, and flags which obligations each triggers. GPAI provider coverage (Articles 51–55) is partial and on the roadmap.

---

Frequently asked questions

How do I know if I'm a provider or a deployer under the EU AI Act?

It turns on whether you build or just use the system. A provider develops or places an AI system on the market under its own name or trademark (Article 3(3)); a deployer uses one under its authority (Article 3(4)). Buying and switching on a SaaS tool usually makes you a deployer, but under Article 25 you become a provider by rebranding a high-risk system, substantially modifying it, or changing its intended purpose. It matters because provider duties (Article 16) are far heavier than deployer duties (Article 26).

My company only uses AI for marketing — am I in scope?

Most marketing and adtech AI is not high-risk, so you avoid the Annex III regime — but you are still in scope for lighter duties. Article 50 transparency applies if you run a chatbot or generate deepfakes or synthetic content, and Article 4 AI literacy has bound providers and deployers since 2 February 2025. You also must avoid Article 5-prohibited practices such as subliminal or manipulative techniques and exploiting vulnerabilities. So "not high-risk" means lighter obligations, not none.

Is the EU AI Act actually in force, or is everything delayed?

Parts are fully live. The Article 5 prohibitions and Article 4 AI literacy duties have applied since 2 February 2025, and GPAI obligations (Articles 51–55) since 2 August 2025. The high-risk deadlines were the contested part: the statute originally read 2 August 2026 for stand-alone Annex III systems. A deferral to 2 December 2027 was adopted in June 2026 — the European Parliament voted on 16 June 2026 and the Council on 29 June 2026 — with entry into force following Official Journal publication.

What does it cost if I get the EU AI Act wrong?

Penalties are tiered by severity. Prohibited practices (Article 5) carry the top tier — up to €35 million or 7% of worldwide annual turnover (Article 99(3)). High-risk and most other obligation breaches sit at €15 million or 3% (Article 99(4)). Incorrect or misleading information to authorities is €7.5 million or 1% (Article 99(5)). For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed sum or the percentage — not the higher figure most readers assume.

How is this self-check different from a full readiness assessment?

This page is a fast locator: five yes/no questions telling you roughly where you sit — provider or deployer, high-risk or not, anything prohibited, when your duties bite. A readiness assessment is the full method behind it: building an AI system register, classifying every system, gap-checking the high-risk requirements control by control, and scoring remediation against the timeline. Use this page to find your starting point, then follow the readiness-assessment and gap-analysis guides for depth.

What's the single most urgent thing to check first?

Whether anything you run is prohibited under Article 5. It is the only part of the high-stakes regime already fully enforceable (since 2 February 2025) and it carries the heaviest fine — up to €35 million or 7% of worldwide turnover (Article 99(3)). A "yes" here means stop the practice, not schedule a project. After that, screen for Annex III areas like employment (point 4) and critical infrastructure (point 2), which drive the bulk of the obligation set.

---

Related guides

• the full high-risk classification test
• run a complete readiness assessment
• gap-check your obligations control by control
• a sequenced first-steps plan
• the EU AI Act compliance checklist