AI Act Checker · quality
The test cases behind the checker
Every rule in the checker is covered by a test case with the expected legal result. The same cases run automatically on every change to the rules; this page is generated from them when the site is built. Today: 46 of 46 cases pass.
Each case states the situation, the result the law leads to and the article it rests on. If you think a case or a result is wrong, please tell us. The full method is on the methodology page.
| Case | Situation | Expected result | Legal basis | Status |
|---|---|---|---|---|
| General AI assistant for emailsUsing a vendor's general tool makes you a deployer. No high-risk use, so AI literacy and the GDPR are what applies. | A small company uses ChatGPT from OpenAI to draft emails; staff enter customer names. | Minimal riskRole: deployer | Art. 3(4), Art. 4; Art. 28 GDPR | ✓ passes |
| Coding assistant without personal dataMinimal risk; no GDPR note when no personal data is processed. | Developers use GitHub Copilot; no personal data goes in. | Minimal risk | Art. 4 | ✓ passes |
| Rule-based automationSystems that do not infer how to produce outputs are not AI systems. | A workflow tool that only follows if-then rules written by staff. | Not an AI system | Art. 3(1) | ✓ passes |
| Unsure whether it is AIThe cautious reading treats it as AI and lists an open question. | The user does not know whether a tool uses machine learning. | Minimal risk | Art. 3(1) | ✓ passes |
| Military useMilitary, defence and national-security uses are excluded. | A system used exclusively for defence purposes. | Outside the AI Act | Art. 2(3) | ✓ passes |
| Purely personal usePurely personal, non-professional use is excluded. | A person uses an AI app for a private hobby. | Outside the AI Act | Art. 2(10) | ✓ passes |
| Vendor chatbot on the company websiteThe vendor, as provider, must make the chatbot disclose it is AI; the company should check it does. | A company runs a chatbot bought from a vendor on its website. | Transparency obligationsRole: deployer | Art. 50(1) | ✓ passes |
| Own chatbot sold to customersThe provider must design it to disclose AI interaction; product liability covers the software. | A software company builds a chatbot and sells it under its own name. | Transparency obligationsRole: provider | Art. 50(1); Directive (EU) 2024/2853 | ✓ passes |
| Deepfakes in marketingDeployers who create deepfakes must disclose that the content is artificial. | An agency creates realistic videos of real people with an AI video tool. | Transparency obligations | Art. 50(4) | ✓ passes |
| Emotion recognition on staffEmotion recognition in the workplace is banned unless for medical or safety reasons. | A call centre analyses the emotions of its own agents. | Prohibited practice | Art. 5(1)(f) | ✓ passes |
| Social scoringSocial scoring leading to unjustified detrimental treatment is banned. | A system rates people's trustworthiness from their social behaviour and restricts services. | Prohibited practice | Art. 5(1)(c) | ✓ passes |
| Applicant screening in an ATS built for itRecruitment and selection is an Annex III area; ranking applicants is profiling, so the exception cannot apply. The company is the deployer. | A company uses its applicant-tracking system's AI ranking, which the vendor sells for this purpose. | High-risk (Annex III use)Role: deployer | Art. 6(2), Annex III point 4(a), Art. 26; Art. 22 GDPR | ✓ passes |
| General chatbot used to rank applicantsUsing a general-purpose system for a high-risk purpose its vendor did not intend makes the company the provider of a high-risk system. | HR pastes CVs into a general AI assistant and asks it to rank the candidates. | High-risk (Annex III use)Role: deployer + provider | Art. 25(1)(c) | ✓ passes |
| Unsure whether the vendor covers the useListed as an open question with the matching vendor request; no provider role is assumed. | A company uses an HR tool for screening but does not know whether the vendor documents that use. | High-risk (Annex III use) | Art. 25(1)(c), Art. 13 | ✓ passes |
| Unsure whether a recruiting tool profilesTreated as profiling (the cautious reading), so it stays high-risk, with an open question. | The user selects a recruitment use but does not know whether the tool evaluates candidates. | High-risk (Annex III use) | Art. 6(3) last subparagraph | ✓ passes |
| Narrow procedural task in an Annex III areaThe Art. 6(3) exception can apply to narrow procedural tasks; it must be documented. | A tool only converts unstructured applications into structured data, without profiling. | Annex III use, not high-risk (Art. 6(3)) | Art. 6(3)(a), Art. 6(4) | ✓ passes |
| Credit scoring by a private lenderCredit scoring is high-risk and always needs a fundamental rights impact assessment; BaFin may be the supervisor; § 15 KI-MIG adds national fines. | A German consumer lender scores applicants with a vendor model. | High-risk (Annex III use) | Annex III point 5(b), Art. 27; § 2(3), § 15 KI-MIG | ✓ passes |
| Life insurance pricingRisk assessment and pricing in life and health insurance is high-risk and needs a fundamental rights impact assessment. | An insurer prices life insurance for individuals with an AI model. | High-risk (Annex III use) | Annex III point 5(c), Art. 27 | ✓ passes |
| Public authority assessing benefit eligibilityPublic bodies must carry out a fundamental rights impact assessment and register their use; German national fines do not apply to public bodies. | A public body uses AI to evaluate eligibility for public benefits. | High-risk (Annex III use) | Annex III point 5(a), Art. 26(8), Art. 27; § 17(2) KI-MIG | ✓ passes |
| Critical infrastructure operatorCritical infrastructure (point 2) is excluded from the impact-assessment and explanation duties. | A private utility with a public mandate uses AI as a safety component in grid operation. | High-risk (Annex III use) | Annex III point 2, Art. 27(1), Art. 86 | ✓ passes |
| Performance analytics with a works councilHigh-risk under Annex III point 4(b); staff must be informed; the works council has co-determination rights. | A German company with a works council scores employee performance with AI. | High-risk (Annex III use) | Art. 26(7); § 87(1) No. 6, § 90(1) No. 3 BetrVG | ✓ passes |
| Applicant selection with a works councilSelection guidelines need the works council's agreement, also when AI is used. | A German company with a works council ranks applicants with AI. | § 95(2a) BetrVG | ✓ passes | |
| German company unsure about a works councilThe checker flags the works-council question. | The user does not know whether a works council exists. | § 87(1) No. 6 BetrVG | ✓ passes | |
| Company in another EU countryGerman works-council and KI-MIG notes only apply to German companies. | A French company ranks applicants with AI. | High-risk (Annex III use) | Annex III point 4(a) | ✓ passes |
| Non-EU provider of a high-risk systemNon-EU providers of high-risk systems need an authorised representative in the EU. | A US company sells an AI hiring tool to EU customers. | High-risk (Annex III use)Role: provider | Art. 2(1)(c), Art. 22 | ✓ passes |
| Small mid-cap with a prohibited practiceThe small mid-cap fine relief does not cover prohibited practices: the higher amount applies. | A company with 600 staff uses a banned practice. | Prohibited practice | Art. 99(3), Art. 99(6a) | ✓ passes |
| SME with high-risk deployer dutiesFor SMEs the lower of the two fine amounts applies. | A small company deploys a high-risk system. | Art. 99(4), Art. 99(6) | ✓ passes | |
| AI in a medical deviceSafety components of Annex I Section A products are high-risk; the manufacturer is provider and product manufacturer. | A manufacturer builds AI diagnostics into a medical device that needs a notified body. | High-risk (Annex I product)Role: provider + product manufacturer | Art. 6(1), Annex I Section A | ✓ passes |
| AI in machinerySince the AI Omnibus, machinery is in Annex I Section B: the duties reach you through the sectoral rules. | A machine builder uses AI as a safety component. | High-risk (Annex I product) | Art. 6(1), Annex I Section B | ✓ passes |
| Unsure about a regulated productNot treated as high-risk until confirmed; listed as an open question. | The user does not know whether the product needs third-party conformity assessment. | Minimal risk | Art. 6(1) | ✓ passes |
| Open-source minimal-risk systemThe open-source exemption applies to minimal-risk systems. | A developer releases a minimal-risk tool under an open-source licence. | Outside the AI Act | Art. 2(12) | ✓ passes |
| Open-source chatbotThe exemption does not cover Art. 50 systems. | An open-source chatbot that talks to people. | Transparency obligations | Art. 2(12), Art. 50 | ✓ passes |
| Provider of a general-purpose modelGeneral-purpose model providers must keep documentation and a copyright policy. | A company trains a language model and offers it to others. | General-purpose AI model obligations | Art. 53 | ✓ passes |
| Very large modelSystemic-risk models have additional duties. | A model trained with more than 10^25 FLOPs. | Art. 51, Art. 55 | ✓ passes | |
| Fine-tuned someone else's modelDownstream modifiers only become model providers above the compute threshold in the Commission guidelines. | A start-up fine-tunes an open model for its product. | Art. 3(63), Art. 53; Commission GPAI guidelines (2025) | ✓ passes | |
| Rebranding a high-risk systemPutting your name on a high-risk system makes you its provider. | A company sells a vendor's high-risk hiring tool under its own brand. | Role: distributor + provider | Art. 25(1)(a) | ✓ passes |
| Modifying a minimal-risk toolArt. 25 only shifts the provider role for high-risk systems. | A company customises a minimal-risk tool. | Minimal risk | Art. 25(1) | ✓ passes |
| Importer of a high-risk systemImporters must check conformity before placing it on the market. | A company brings a non-EU vendor's high-risk system to the EU market. | Role: importer | Art. 23 | ✓ passes |
| Distributor of a high-risk systemDistributors must check the CE marking and documentation. | A reseller distributes a high-risk system. | Role: distributor | Art. 24 | ✓ passes |
| High-risk system built for internal useBuilding for internal use makes you provider and deployer; product liability does not attach to purely internal use. | A company builds its own AI to score staff performance. | Role: provider + deployer | Art. 3(3), Art. 3(4) | ✓ passes |
| Unsure about banned practicesFlagged as an open question with a warning; not classified as prohibited. | The user is not sure whether any Art. 5 practice applies. | Minimal risk | Art. 5 | ✓ passes |
| Meeting transcriptionMinimal risk under the AI Act, but personal data goes to a vendor. | A team records and summarises meetings with an AI notetaker. | Minimal risk | Art. 4; Art. 28 GDPR | ✓ passes |
| Online exam proctoringDetecting prohibited behaviour during tests is an Annex III education use. | A training provider monitors students for cheating with AI. | High-risk (Annex III use) | Annex III point 3(d) | ✓ passes |
| Fingerprint unlock for doorsBiometric verification that only confirms identity is not remote biometric identification. | Staff unlock doors with a fingerprint reader. | Minimal risk | Annex III point 1(a) | ✓ passes |
| Face recognition on camerasRemote biometric identification is high-risk where permitted. | A retailer identifies people at a distance from camera footage. | High-risk (Annex III use) | Annex III point 1(a) | ✓ passes |
| Profiling outside high-risk areasNot an Annex III use, but profiling with personal data brings in GDPR rules on automated decisions and impact assessments. | A shop uses AI to predict customer interests for recommendations. | Minimal risk | Art. 22, Art. 35 GDPR | ✓ passes |
Rules dataset v1.2.2, law as of 2026-10-17. General information, not legal advice.