Classify an AI system
Choose a system's risk tier, its Article 6 basis and Annex III area, your role and its oversight, and see what each answer changes.
The register doesn't decide a system's class for you. You choose the risk tier and answer the questions it opens; the register checks that the answers fit together as Article 6 of the AI Act requires, and works out the system's status and duties from them. You answer these questions when you register a system, and can change them later with Edit details.
Choose the risk tier
| Risk tier | What it means | Status on the register |
|---|---|---|
| Prohibited | An Article 5 practice, which can't be placed on the EU market. It can never be listed on your Privacy Center. | Prohibited practice |
| High-risk | High-risk under Article 6. The register tracks its Article 49 registration and its Article 43 conformity assessments. | Registration due, Registration overdue or Registered |
| Limited risk | Caught by the Article 50 transparency duties, such as telling people they're interacting with an AI system, or marking generated content as artificial. | Transparency duties |
| Minimal risk | None of the above. The register tracks nothing further. | Minimal risk |
A withdrawn system shows Withdrawn, whatever its tier.
Say why a system is high-risk
For a high-risk system, choose the Article 6 basis:
- Article 6(1) — safety component of an Annex I product: the system is a safety component of a product, or is itself a product, covered by the EU legislation listed in Annex I, and that product must undergo a third-party conformity assessment. Where that legislation is in Section A of Annex I, the system follows its conformity procedure (Article 43(3)), so the register suggests no Article 43 route for an Annex I system.
- Article 6(2) — Annex III use case: then choose the Annex III area. The list names each point from 1 to 8, with point 5 offered as 5(a), access to essential public services and benefits, and 5(b), creditworthiness and credit scoring.
The Annex III point decides the conformity route the register suggests. For point 1 (biometrics) it suggests Annex VII, with a notified body, which Article 43(1) requires unless harmonised standards or common specifications were applied in full. For points 2 to 8 it suggests Annex VI internal control (Article 43(2)).
An Annex III system that isn't high-risk
Under Article 6(3), a system in an Annex III area isn't high-risk where it doesn't pose a significant risk of harm to people's health, safety or fundamental rights, for example where it only performs a narrow procedural task. An Annex III system that profiles natural persons is always high-risk.
To record that conclusion, choose Limited risk or Minimal risk, pick the Annex III area the use case falls under, and write the Article 6(3) justification.
Article 6(4) requires you to document this assessment before the system goes on the market and to provide it to national competent authorities on request, and Article 49(2) still requires you to register such a system in the EU database. The register keeps your justification, but offers Record registration on high-risk systems only. The justification never appears on your Privacy Center.
Your role and the system's oversight
Our role is the role your organisation holds for the system. The hint under it names the article whose duties follow:
- Provider: you develop the system and place it on the market (Article 16).
- Deployer: you use a system someone else provides (Article 26).
- Importer: you bring a third-country system into the EU (Article 23).
- Distributor: you make it available further down the chain (Article 24).
The register's Provider column shows this role. Human oversight records how people oversee the system: In the loop — every decision reviewed, On the loop — sampled review or Out of the loop — exceptions only. For a high-risk system, Article 14 requires a design that lets people oversee it effectively while it's in use.
Change a classification later
Open the system and choose Edit details from its More actions menu. Changing the risk tier clears the answers that depend on it, so fill in whatever the new tier asks for. A change of tier is written to the audit log as a reclassification, and the system's status, its suggested route and your usage count follow it. See Edit or withdraw an AI system.