EU AI Act - Regulation (EU) 2024/1689

EU AI Act Risk Classifier

Classify your AI use case under the EU AI Act: prohibited, high-risk, limited or minimal.

The four risk categories

The EU AI Act (Regulation (EU) 2024/1689) regulates AI by what it is used for, not by the technology. Each use falls into one of four categories:

Category	Examples	What it means
Prohibited (Art 5)	Social scoring; manipulative or deceptive techniques; emotion recognition at work or in education; real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions	Banned
High-risk (Annex III and Annex I)	Remote biometric identification; CV screening and decisions about employment or education; credit scoring and life or health insurance pricing; safety components of critical infrastructure; AI in regulated products	Risk management, data governance, documentation, logging, human oversight, accuracy and security, conformity assessment
Limited risk (Art 50)	Chatbots; AI-generated or manipulated content	Transparency: tell people they are dealing with AI, and label generated content
Minimal risk	Spam filters, recommendations, most internal tools	No new obligations

Key dates

The Digital Omnibus on AI (Regulation (EU) 2026/1744) moved several of the original dates:

Date	What applies
2 February 2025	Prohibited practices banned
2 August 2025	Obligations for general-purpose AI models
2 December 2026	Two further practices added to the prohibited list; end of the grace period for labelling AI-generated content (Art 50(2))
2 December 2027	High-risk obligations for Annex III use cases
2 August 2028	High-risk obligations for AI in products covered by Annex I

Fines

Breach	Maximum fine (whichever is higher)
Prohibited practices (Art 5)	€35 million or 7% of worldwide annual turnover
Most other obligations, including high-risk and transparency duties	€15 million or 3%
Supplying incorrect or misleading information to authorities	€7.5 million or 1%

For SMEs and startups, the lower of the two amounts applies (Art 99(6)).

Does it apply to companies outside the EU?

Yes, if you place an AI system on the EU market or its output is used in the EU (Art 2). A company in India or the US whose chatbot serves EU customers is covered by the transparency duties, for example.

Provider or deployer?

Providers develop an AI system, or have one developed, and place it on the market under their name. Deployers use one in their own operations. High-risk providers carry most of the obligations, but deployers have their own: using the system as instructed, human oversight, monitoring and, in some cases, informing the people affected.

The classifier above gives an indicative category. Every Art 5 practice and Annex III entry has conditions and exceptions, so get legal advice before relying on the result. For the security side of high-risk systems (accuracy, robustness and cybersecurity), see our security testing and vCISO services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

Each use case you tick maps to a tier. Prohibited (Art 5): social scoring, manipulative or deceptive techniques, real-time remote biometric identification in public spaces for law enforcement, and emotion recognition at work or in education. High-risk (Annex III): other remote biometric identification, CV screening and education or employment decisions, credit scoring and life or health insurance pricing, law-enforcement risk assessment, and safety components of critical infrastructure. Limited (Art 50): chatbots and AI-generated content. Anything else is minimal.
If you tick several, the highest tier wins.
If the output is not used in the EU, the tool reports that the Act likely does not reach you and shows the tier that would apply if it did (Art 2).
The headline amount is the Art 99 maximum for the tier: EUR 35 million or 7% of worldwide turnover for prohibited practices, EUR 15 million or 3% for high-risk obligations, whichever is higher. The tool does not ask for turnover, so it shows the formula rather than a figure.
Your role (provider, deployer or both) only decides which obligation list is shown.

Worked example

The calculator run on its default inputs:

AI use cases (select all that apply): Chatbot / AI-generated content
Your role: Deployer - you use an AI system in your own operations
System output used in the EU / affects people in the EU: Yes

LIMITED risk - transparency obligations (Art. 50)

Transparency use cases: chatbot

With the defaults (a chatbot, you as the deployer, output used in the EU) the only use case is a transparency case, so the result is limited risk: tell people they are interacting with an AI system and label AI-generated or manipulated content. Breaches of these Art 50 duties fall under the Art 99(4) ceiling of EUR 15 million or 3% of worldwide turnover.

Sources

EU AI Act - Regulation (EU) 2024/1689 (EUR-Lex) - prohibited practices (Art 5), transparency (Art 50), fines (Art 99), application dates (Art 113), high-risk use cases (Annex III)
Digital Omnibus on AI - Regulation (EU) 2026/1744 (EUR-Lex) - Annex III high-risk duties from 2 December 2027, Annex I from 2 August 2028, and the Art 50(2) grace period to 2 December 2026

Sources last checked September 2026.

Limitations

Classification follows the use, not the technology, and every Art 5 practice and Annex III entry has conditions and exceptions this list compresses. The classifier does not cover the two practices the Digital Omnibus adds to Art 5 from 2 December 2026, general-purpose AI model duties beyond a note, or the rule that SMEs are fined at the lower of the two amounts (Art 99(6)). This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.