How GenAIze Technologies classifies an AI system under the EU AI Act
Every answer in the checker passes through the same ordered gates. Each gate cites the article it applies. The engine runs on a versioned obligations dataset, so when the law changes we update the data, not the code.
The decision tree
Gates 1–7 decide the risk class and stop at the first conclusive answer. Gates 8–10 are cumulative: they add obligations on top of whatever class the system landed in.
Is it an AI system? Art. 3(1)
The test is inference: does it learn or reason from inputs to produce predictions, content, recommendations or decisions? Fixed human-written rules are not AI. If unsure, we treat it as AI and say so.
Does an exclusion apply? Art. 2
Military, defence or national security only; scientific research only; pre-market testing (not real-world testing); purely personal use. Open-source release is a partial exclusion and is checked later.
What is your role? Art. 3(3)–(7)
Built and sold under your name → provider. Built for internal use → provider and deployer. Use a vendor's tool → deployer. First to bring a non-EU vendor's product to the EU → importer. Resell → distributor. Roles decide which obligations apply; the risk class decides how many.
Is it a prohibited practice? Art. 5
Nine bans, including manipulation, social scoring, emotion recognition at work or school, untargeted face scraping and, from 2 Dec 2026, generating non-consensual intimate imagery or CSAM.
Is it used in an Annex III area? Art. 6(2)
8 areas, 25 specific uses: biometrics, critical infrastructure, education, employment, essential services (credit, insurance, benefits, emergency triage), law enforcement, migration, justice and elections.
Profiling, or an Art. 6(3) exception? Art. 6(3)–(4)
If the system profiles people it is always high-risk. Otherwise it may escape high-risk status if it only performs a narrow procedural task, improves a completed human activity, detects patterns without replacing human review, or performs a preparatory task. Providers must document this and register.
Is it an Annex I product or safety component? Art. 6(1)
Section A products (lifts, toys, medical devices, radio equipment, PPE…) that need a third-party health-and-safety assessment get the full high-risk regime directly. Section B products (vehicles, aviation, rail, marine and, since the AI Omnibus, machinery) receive the requirements through their sectoral rules. AI used only for convenience or performance optimisation is not a safety component. If Annex III applies as well, the earlier Annex III date wins.
Role shift for high-risk systems Art. 25(1)
Rebranding, substantially modifying or repurposing a system so that it becomes high-risk turns a deployer, importer or distributor into its provider, with all provider duties.
Transparency triggers Art. 50
Chatbots must say they are AI (provider). Synthetic content must be machine-marked (provider). People exposed to emotion recognition must be told, and deepfakes and public-interest text disclosed (deployer). These apply on top of any other class.
General-purpose AI model? Art. 53–55
Only if you train or substantially modify and release a GPAI model. Documentation, a copyright policy and a training-data summary apply, with extra duties above the 1025 FLOP systemic-risk threshold.
Always, for every AI system in scope Art. 4–5
AI literacy measures for staff, a screening against prohibited practices, and an AI inventory (good practice). These have applied since 2 Feb 2025.
Outcome classes
Obligations matrix
Every obligation in the dataset, the roles it binds and when it applies. Rows marked with a condition only apply in specific cases (see the special rules below).
| Obligation | Basis | Provider | Deployer | Importer | Distributor | Applies from | Condition |
|---|
Special rules the engine applies
Fundamental rights impact assessment Art. 27
Only deployers that are public bodies or private entities providing public services (any Annex III use except point 2), and any deployer of credit-scoring (5(b)) or life and health insurance pricing (5(c)) systems.
Informing workers Art. 26(7)
Triggered only when a high-risk system is used on the company's own workforce. In Germany the works council's co-determination rights also apply.
Inform and explain Art. 26(11) · Art. 86
Deployers of Annex III systems that decide about people must tell them, and explain decisions with significant effects on request. Not for critical infrastructure (point 2).
Vendor-side transparency Art. 50(1)–(2)
When an SME only deploys a vendor's chatbot or generator, the disclosure and marking duties sit with the vendor. The engine reports this as a check to make with the vendor, not as the SME's own obligation.
Open source Art. 2(12)
The exemption covers the provider of a free and open-source system only while it is not high-risk, not prohibited, not an Art. 50 system and not a GPAI model. Deployers keep their duties.
Emotion recognition at work Art. 5(1)(f)
If a user marks emotion recognition and use on employees, the engine warns that this is prohibited unless used for medical or safety reasons.
Legacy systems Art. 111(2)
High-risk systems already on the market before their date are only caught after significant design changes; public-authority systems by 2 Aug 2030. Shown as a note, never relied on automatically.
SME and small mid-cap fine cap Art. 99(6)–(6a)
For SMEs, the lower of the fixed amount and the turnover percentage applies to every fine (Art. 99(6)). For small mid-caps, the lower amount applies only to fines under Art. 99(4) and (5), not to prohibited practices (Art. 99(6a), inserted by Regulation (EU) 2026/1744). For everyone else, the higher. Duties outside the Art. 99(4) list (FRIA, explanations, post-market monitoring, incident reporting) carry fines set nationally; in Germany, the KI-MIG sets up to €50,000 for a missing FRIA or explanation (§ 15 KI-MIG).
Annex I Section B Art. 2(2)
For vehicles, aviation, rail, marine equipment and machinery, only Art. 6(1), 60a and 102–112 apply. The engine classifies these as high-risk but lists no direct provider duties, and explains the sectoral route instead.
Verified scenarios
The engine is tested against these typical SME scenarios. Each one asserts the expected class, roles and specific obligations (e.g. that a bank using credit scoring gets the FRIA and a utility using a critical-infrastructure system does not).
| Scenario | Result | Roles | Obligations | Next deadline | Test |
|---|
Engine interface
For engineers: the same function powers the public checker and, later, the product's inventory.
classifySystem(dataset, company, system) → result
company = { size: "micro"|"small"|"medium"|"smc"|"large",
eu_established: true, public_body: false, public_service: false }
system = { name, is_ai: "yes"|"no"|"unsure", exclusion: "EX-research"|…|null,
relationship: "build_market"|"build_inhouse"|"use_vendor"|"import"|"distribute",
art25: ["R25-a"…], open_source: false, gpai_model: "none"|"gpai"|"gpai_systemic",
prohibited: ["P-f"…], annex_i: false, annex_iii: ["A3-4a"…],
profiling: true, derogation: ["E-a"…], transparency: ["T-interact"…],
workplace: false }
result = { risk, riskLabel, roles[], route, obligations[{id,title,legal_basis,due,status,actions,evidence}],
trail[{step,result,basis}], warnings[], notes[], penalty{tier,max_eur,max_pct,rule}, smeMeasures[] }