1 · Scope check

Are you placing this AI system on the EU market, or are its outputs intentionally used in the EU?

Is the system an "AI system" per Art. 3(1) — machine-based, autonomous, generating outputs that can influence physical or virtual environments?

2 · Your role(s) in the AI value chain

Check all that apply. Obligations differ per role; the result lets you filter to a specific role.

Provider — develops the AI system or places it on the EU market under its own nameDeployer — uses the AI system in the EU under its own authority (the end-user business)Importer — first natural/legal person who brings a third-country AI system into the EUDistributor — makes the AI system available on the EU market without altering its properties

3 · Prohibited practices (Art. 5)

Check every item that applies. Any check here means the system is prohibited.

Art. 5(1)(a). Uses subliminal, manipulative or deceptive techniques beyond a person's awareness in a way that causes (or is likely to cause) significant harm.Art. 5(1)(b). Exploits vulnerabilities of specific groups (age, disability, socio-economic situation) in a way that causes significant harm.Art. 5(1)(c). Performs social scoring of natural persons by public authorities, or general-purpose social scoring leading to detrimental treatment.Art. 5(1)(d). Assesses or predicts risk of a natural person committing a criminal offence based solely on profiling or personality traits.Art. 5(1)(e). Untargeted scraping of facial images from the internet or CCTV to build / expand facial recognition databases.Art. 5(1)(f). Emotion recognition in workplaces or educational institutions (except for medical / safety reasons).Art. 5(1)(g). Biometric categorisation to infer race, political opinions, trade-union membership, religion, philosophical beliefs, sex life or sexual orientation.Art. 5(1)(h). Real-time remote biometric identification in publicly accessible spaces for law-enforcement (outside Art. 5(1)(h) exceptions).

4 · High-risk classification (Art. 6 + Annexes)

Annex I — Is the AI system a safety component of, or itself, a product covered by EU harmonisation legislation (EU MDR, machinery, toys, aviation, etc.) AND requires a third-party conformity assessment?

Annex III — check every use case that applies.

Biometrics — remote biometric identification, biometric categorisation by sensitive attributes, emotion recognition (outside prohibited list).

Critical infrastructure — safety components in road traffic, water, gas, heating, electricity, digital infrastructure.

Education / vocational training — admission, evaluation of learning outcomes, monitoring of prohibited behaviour during tests, level assessment.

Employment / workers — recruitment, screening, decisions on terms, promotion, termination, task allocation, performance monitoring.

Essential services — credit scoring / creditworthiness of natural persons, public-benefit eligibility, dispatch of emergency services, life/health insurance risk pricing.

Law enforcement — individual risk assessment, polygraphs, evidence reliability evaluation, profiling for investigation.

Migration / asylum / border control — polygraphs, risk assessment for entry, examination of applications.

Administration of justice & democratic processes — assistance to judicial authority in interpreting facts/law, influence on election outcomes / voter behaviour.

Art. 6(3) carve-out — Does the system fall into an Annex III area BUT perform only a narrow procedural task, improve human work, detect patterns without replacing human assessment, or carry out preparatory work?

5 · GPAI (general-purpose AI model)

Is this a general-purpose AI model (foundation model that can perform a wide range of tasks)?

Art. 3(63): a GPAI model is trained on large quantities of data using self-supervision at scale, displays significant generality, can competently perform a wide range of distinct tasks, and can be integrated into a variety of downstream systems. Examples: GPT-4, Claude, Llama, Mistral, Gemini base models. A fine-tuned variant of a GPAI is not itself a new GPAI — it stays downstream.

6 · Transparency (Art. 50)

Check every item that applies — each triggers a transparency obligation.

The system interacts directly with natural persons (chatbot, virtual assistant, voice agent).The system generates or manipulates synthetic image, audio, video or text content.The system performs emotion recognition or biometric categorisation (and is not itself prohibited).The system produces deepfakes — manipulated content that appears authentically to depict a real person/event.

EU AI Act Deep Scope Classify your system, then get every obligation that applies.