AI Act check: is your AI high risk? Check it in two minutes

The short answer. The AI Act divides AI applications into four classes: prohibited, high risk, transparency obligation and minimal risk. Most AI in businesses falls into the last two. High risk covers a fixed list of applications, such as recruitment and selection, credit assessment of individuals, premiums for life and health insurance, admission and assessment in education, and AI as a safety component of products. After the Digital Omnibus of July 2026, the strict rules for these apply from 2 December 2027, and for AI in products from 2 August 2028. What you need to do also depends on your role: do you build the system (provider) or use it (deployer)? The check below shows you this for each application, with your deadlines and a register you can download.

Based on the AI Act as amended by the Digital Omnibus on AI. What the AI Act means for SMEs in general is covered in our overview of the AI Act.

The four risk classes

Prohibited. Since 2 February 2025, you may not, among other things, use AI to recognise the emotions of employees or students via face, voice or other biometrics (except for medical or safety reasons), give people a social score, steer behaviour with hidden techniques or exploit vulnerabilities, or categorise people through biometrics by race, religion, political opinion or sexual orientation. From 2 December 2026, the Digital Omnibus adds two prohibitions: AI that creates sexually explicit images of real people without their consent, and AI that creates child sexual abuse material.

High risk. Applications from Annex III, where AI has a major influence on someone’s opportunities: work, credit, insurance, education, access to public services, biometric identification and critical infrastructure. Plus AI as a safety component of products with CE marking, such as machinery and medical devices (Annex I).

Transparency obligation. Chatbots, AI that creates images, audio or video, deepfakes and AI-written texts on matters of public interest. People must know that they are dealing with AI. This has applied since 2 August 2026.

Minimal risk. Everything else: summarising, writing, analysing, code, internal search tools. The AI Act sets no specific requirements for these, apart from supporting the AI literacy of the people who work with them.

Provider or deployer?

The AI Act places most obligations on the provider: whoever develops an AI system and places it on the market or puts it into service under their own name. If you build a system for your own use, you are both provider and deployer. If you only use a system from a supplier, you are a deployer, with a shorter list of obligations.

Pay attention to Article 25: you become a provider yourself if you put your name or trademark on someone else’s high-risk system, substantially modify it, or use it for a purpose that makes it high risk. That last one happens sooner than you think. A general-purpose chatbot that you use to assess job applicants is suddenly a high-risk system, with you as the provider.

The exception in Article 6(3)

Not everything on the Annex III list is automatically high risk. A system falls outside it if it does not pose a significant risk, for example because it only performs a narrow procedural task, improves the result of previously completed human work, detects patterns without replacing human judgement, or performs a preparatory task. That exception never applies if the system profiles individuals. The provider records the assessment before the system is placed on the market, and still registers it in the EU database.

The timeline after the Digital Omnibus

1. 2 February 2025: prohibited practices and AI literacy.
2. 2 August 2026: transparency obligation for chatbots, AI content and deepfakes.
3. 2 December 2026: the new prohibitions from the Digital Omnibus, and marking of AI content for generative systems that were already on the market before August 2026. Newer systems have had to do so since 2 August 2026.
4. 2 December 2027: high risk under Annex III, such as recruitment, credit and education.
5. 2 August 2028: high risk in products under Annex I.

What has applied since August 2026 is covered in our piece on 2 August.

What you need to do as a deployer of a high-risk system

If you use a high-risk system from a supplier, for example a tool that ranks CVs, these are your main obligations from 2 December 2027 (Article 26):

• Using the system in line with the provider’s instructions.
• Assigning human oversight to people with the right knowledge and authority.
• Keeping the automatically generated logs for at least six months.
• Informing employees and their representatives before you put the system to use in the workplace.
• Letting people know that the system is being used when it prepares decisions about them, and giving them an explanation on request.

If you are a public sector organisation, provide a public service, or the system is used for credit assessment or insurance premiums, you also carry out a fundamental rights impact assessment beforehand (Article 27). If you already work this way, you will not have to overhaul anything later.

What the fines are

For prohibited practices, the fine can reach 35 million euros or 7 percent of global annual turnover. For most other obligations, it is 15 million euros or 3 percent. For SMEs, the lower of the two amounts always applies. For small mid-caps, that only applies to the other obligations, not to prohibited practices.

Why you keep an AI register

You can only say which class your AI falls into once you know which AI is running. That is why you can save every check in a register and download it as Excel or Word. The register is also the basis of your AI policy: which tools are allowed, with what risk, and who owns each tool.

Frequently asked questions

Is using ChatGPT high risk?

No. A general-purpose AI assistant for writing, summarising or analysing falls under minimal risk. It only becomes high risk if you use it for an Annex III application, such as assessing job applicants. In that case, you also become the provider yourself.

Does our chatbot fall under the AI Act?

Yes, under the transparency obligation. People must know that they are talking to AI, unless that is obvious. The provider designs the system that way; as a deployer, you check that it is set up correctly.

Does the AI Act also apply to small businesses?

Yes. There is some relief for SMEs, such as simplified technical documentation for providers and lower fine caps. Since the Digital Omnibus, most of these also apply to small mid-caps.

Do I need to do anything if all my AI is minimal risk?

Not much, but not nothing: make sure your people are AI literate, keep a register and set out in a policy which data may go into which tool.