EU AI Act Assessment Tool

1. System Type & Intended Purpose

What type of AI system are you building/deploying? Article 3(1) - AI System Definition An AI system is "a machine-based system designed to operate with varying levels of autonomy that infers how to generate outputs such as predictions, content, recommendations, or decisions"

Who will use or be affected by this AI system? Article 3(4) - Deployer Definition

Internal only (employees, organization members)

External customers/clients (B2B or B2C)

General public (publicly accessible spaces) Includes real-time remote biometric identification in public - Article 5(1)(h)

Vulnerable groups (children, disabled, elderly) Systems targeting vulnerabilities - Article 5(1)(a)

2. Deployment Location & Jurisdiction

Where will this AI system be deployed or used? Article 2 - Scope The AI Act applies to providers placing AI on the EU market, deployers in the EU, and third-country providers whose AI output is used in the EU

European Union

United Kingdom (separate AI regulation)

Outside EU, but output used in EU Article 2(1)(c) - Third-country providers are in scope

What is your role? Article 3(2-8) - Definitions

3. Data Processing & Decision-Making

Does your AI system process personal data? GDPR Compliance + Article 10 - Data Governance

No personal data (anonymous/aggregated only)

Basic personal data (names, emails, demographics)

Sensitive/special category data Health, biometric, financial, political opinions, race, religion - GDPR Article 9

Does the AI system perform profiling? Article 6(2) - High-Risk Classification Profiling = automated processing of personal data to evaluate aspects of a person (performance, economic situation, health, preferences, behavior)

No profiling

Yes - for analysis/insights only (no automated decisions)

Yes - profiles used for automated decisions High-risk if used for employment, credit, education, essential services - Annex III

What level of decision-making does the AI perform? Article 14 - Human Oversight

Informational only (no decisions)

Suggestions only (human decides)

Automated with human review capability Article 14 - Human oversight for high-risk systems

Fully automated (no human intervention) Requires justification for high-risk systems

Do AI decisions affect legal rights or access to services? Annex III - High-Risk Use Cases

No significant impact

Affects access to essential services Benefits, healthcare, financial services - Annex III(5)

Affects employment decisions Hiring, promotion, termination - Annex III(4)

Directly affects legal rights/freedoms Justice administration, law enforcement - Annex III(6,7,8)

4. Annex III High-Risk Scenarios

Select any areas where your AI system operates (these are high-risk categories under Annex III):

Biometrics - Remote identification, categorization, emotion recognition Annex III(1) | Prohibited if real-time RBI in public (Article 5) with narrow exceptions

Critical Infrastructure - Management/operation of critical services Annex III(2) | Water, gas, electricity, digital infrastructure, road traffic

Education - Admission, assessment, monitoring, steering learning Annex III(3) | All education/vocational training levels

Employment - Recruitment, task allocation, performance monitoring Annex III(4) | Hiring, promotion, termination, performance evaluation

Essential Services - Benefits eligibility, credit assessment, insurance Annex III(5) | Public/private services, creditworthiness, emergency services

Law Enforcement - Risk assessment, evidence evaluation, profiling Annex III(6) | Individual risk assessment, polygraphs, crime prediction

Migration/Asylum - Applications, eligibility, border control Annex III(7) | Visa/asylum applications, polygraphs, identification

Justice Administration - Legal research, fact interpretation Annex III(8) | Courts, alternative dispute resolution, election influence

None of the above

5. General Purpose AI (GPAI) - Chapter V

Is this a general-purpose AI model? Article 3(63) - GPAI Definition "AI model displaying significant generality, capable of performing a wide range of distinct tasks" - e.g., GPT, Claude, Gemini, Llama

No, task-specific AI system

Yes, proprietary GPAI model Article 53 - Technical documentation, copyright compliance, training data summary required

Yes, free and open-source GPAI model Article 53(1)(b,c) - Lighter obligations (copyright + training summary only), unless systemic risk

Yes, GPAI with systemic risk (>10^25 FLOPs) Article 51 - Additional obligations: model evaluation, adversarial testing, incident reporting, cybersecurity

6. Transparency Requirements - Article 50

Does your AI system do any of the following? Article 50 - Transparency Obligations

Directly interact with people (chatbot, virtual assistant) Article 50(1) - Must inform users they're interacting with AI

Generate/manipulate image/audio/video (deepfakes) Article 50(2) - Must disclose AI-generated/manipulated content

Generate text for publication (articles, social posts) Article 50(3) - Must label AI-generated text published publicly

Emotion recognition or biometric categorization Article 50(4) - Must inform exposed persons