AI Use Cases and the EU AI Act: Classification by Purpose

The EU AI Act does not regulate technology. It regulates purpose. Regulation (EU) 2024/1689 attaches obligations to what an AI system is used for — its intended purpose and its deployment context — not to the architecture, the model size, or the sophistication of the technique behind it. The same model can be minimal-risk in one deployment and high-risk in another. This section works through common AI use cases and shows where each one lands — for the product managers, compliance officers, and founders who have to answer that question in practice.

---

Why the same model lands in different tiers

Article 3(12) defines "intended purpose" as the use the provider intends, as stated in the instructions for use, promotional material, and technical documentation. That definition does the heavy lifting.

A text-classification model that routes support tickets to the right queue is minimal-risk. Point the same model at job applications to screen candidates and it lands in Annex III point 4 (employment and workers management): high-risk, with the full obligation stack from Articles 9 to 15, conformity assessment under Article 43, and registration under Article 49. Nothing about the model changed. The use case did.

This is why "we only use off-the-shelf models" is not a classification argument, and why an AI inventory keyed to models rather than to use cases will misclassify. Register the use case, classify the use case, and reassess when the use case changes.

---

How to reason from use case to obligations

Work the sequence in order and stop at the first rule that fires.

1. Article 5 — is it prohibited? Eight practices have been prohibited since 2 February 2025, among them subliminal manipulation, social scoring, and emotion recognition in workplaces and educational settings (except for medical or safety reasons); two more apply from 2 December 2026. Social scoring under Article 5(1)(c) is not limited to public authorities — private actors are bound too. No consent notice or human-review step cures a prohibited system.

2. Article 6 — does the use case sit in Annex I or Annex III? Article 6(1) catches AI that is a safety component of a product covered by the Annex I harmonisation legislation. Article 6(2) catches AI whose intended purpose falls in one of the eight Annex III areas: biometrics, critical infrastructure, education, employment and workers management, access to essential services, law enforcement, migration and border control, and the administration of justice and democratic processes.

3. Article 6(3) — does the exemption filter apply? An Annex III system is not high-risk if it poses no significant risk of harm to health, safety, or fundamental rights — a narrow procedural task, improving an already-completed human activity, detecting decision patterns without influencing human assessment, or preparatory work only. The filter has a hard limit: a system that profiles natural persons is always high-risk. Document the assessment and register it under Article 49.

4. Article 50 — does the use case trigger transparency? Chatbots and other conversational AI, generation or manipulation of synthetic media, emotion recognition where not prohibited, and biometric categorisation that does not identify the person.

5. Otherwise — minimal risk under the Act. GDPR, product-safety law, and sector rules still apply.

---

Most everyday use cases are limited-risk, not high-risk

The high-risk regime gets the attention, but the majority of commercial AI use cases never reach it. Recommendation engines, summarisers, spam filters, demand forecasting, and route optimisation are typically minimal-risk. Customer-support chatbots are typically limited-risk: they carry the Article 50 duty to make clear that the person is interacting with a machine, and little else.

The deadlines differ, and are routinely conflated:

For a company whose AI portfolio is chatbots and summarisers, the operative date is 2 August 2026 — not 2 December 2027. Reading the Annex III timetable as your own defers work that is due sooner. Note too that the Article 50(2) content-marking duty has applied since 2 August 2026, not from the Annex III high-risk date; treating them as one is a frequent error. The deferred high-risk dates come from the Digital Omnibus, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026.

---

Read the carve-outs and the edges carefully

Annex III areas contain exclusions written into the text, and they are surgical rather than general. Point 5(b) covers creditworthiness assessment and credit scoring, but explicitly excludes AI used to detect financial fraud. The line is functional: "will this person repay?" is creditworthiness and is high-risk; "is this transaction genuine?" is fraud detection and is excluded from that point. A system that does fraud detection and feeds a creditworthiness score does not inherit the exclusion for the scoring half.

Two edges catch companies repeatedly. Composite systems: classify each function, not the product as a marketed whole — one deployment can hold minimal-, limited-, and high-risk components at once, and each carries its own obligations. Article 25 role shifts: put your own name on a high-risk system, modify it substantially, or change its intended purpose, and you become the provider with the full Article 16 stack.

Penalties track the tier, and they are ceilings rather than floors: up to €35 million or 7% of total worldwide annual turnover for the Article 5 prohibitions, and up to €15 million or 3% for high-risk and Article 50 failures (Article 99).

---

How Confir helps

Confir classifies by use case, which is how the Regulation is written. Guided intake establishes the intended purpose, deployment context, and your role; a deterministic rule-based engine then derives the tier against Article 6 and Annex III, shows the rule that fired, and scopes the obligations that follow — from Article 50 transparency for a chatbot to the Annex IV pack for an Annex III system.