INTELLIGENCE TOOL
Artificial Intelligence
Compliance with the European Artificial Intelligence Regulation (AI Act): classification of systems by risk level, algorithmic governance and legal obligations for companies deploying artificial intelligence.
Compliance and governance of Artificial Intelligence.
The European Artificial Intelligence Regulation (AI Act) introduces a framework of legal obligations based on the risk level of each system: prohibited practices, high-risk systems subject to conformity assessment, and transparency duties. We help companies classify their AI systems, implement the human oversight and traceability required, and document compliance. A solution designed by lawyers that combines regulatory analysis with technological integration.
AI Act classification
Automatic classification of your AI systems by risk level under the European Regulation.
Algorithmic governance
Frameworks for human oversight, traceability and the technical documentation required by the AI Act.
Transparency obligations
Duties to inform users and to label content generated by artificial intelligence.
AI risk management
Continuous assessment, incident logging and conformity for high-risk systems.
This page brings together two free-to-use tools relating to Regulation (EU) 2024/1689, the European AI Act. The AI Act Risk Classifier is a guided questionnaire taking around five minutes to complete, which provides a preliminary assessment of your AI system, including its likely regulatory status, risk category and key obligations, with a downloadable PDF report. The Governance Policy Generator creates a draft internal policy on the use of AI, complete with a readiness score and next steps. Both results are preliminary assessments, not legal advice, and the first time you run the classifier, it may take a few seconds to load.
Understand the result
What does the result mean?
The result is a preliminary classification in accordance with the risk levels set out in Regulation (EU) 2024/1689, not a legal opinion.
Regulation (EU) 2024/1689 classifies AI systems into a risk pyramid. At the top are the prohibited practices set out in Article 5. Below these are high-risk systems, systems integrated into products already subject to regulation, and the uses listed in Annex III – such as employment, education or credit – which are subject to risk management, technical documentation, human oversight and conformity assessment. At the base are systems with limited risk, subject to transparency obligations, and those with minimal risk, which have no additional obligations.
Obligations also depend on the company’s role. The supplier, whether they develop the system or market it under their own brand, bears the bulk of the responsibility for compliance. The party responsible for deployment, who uses the system under their own authority, must follow the instructions, ensure competent human supervision and monitor the input data. Making substantial modifications to a high-risk system makes that party the supplier.
The timetable is phased: bans from 2 February 2025, general-purpose AI models from 2 August 2025, and a general high-risk regime from 2 August 2026. If the screening indicates a prohibited practice, high-risk indicators or uncertainties regarding its role, a professional analysis is required to confirm the classification and document the company’s position.
What obligations does a company have if it uses AI but does not develop it itself?
Most companies are not AI providers but are responsible for deployment, as they use third-party systems in human resources, marketing or business decision-making. Even so, the Regulation applies to them. From 2 February 2025, they must ensure that staff operating these systems are AI-literate and, if the system is high-risk, use it in accordance with the instructions, assign human oversight to competent individuals and inform the workers concerned.
In practice, the starting point is an inventory of the AI systems in use, detailing their purpose, their supplier and a preliminary classification such as the one on this page. This forms the basis for the internal policy on the use of AI, the clauses in contracts with suppliers and coordination with the data protection authority.
Classifying a system as ‘dubious’ or designing a compliance programme under the AI Act requires the application of legal judgement to the specific case. For further information, please see our regulatory compliance section.
Methodology and sources
What they rely on
Both tools apply the text of Regulation (EU) 2024/1689: the classifier checks the responses against the prohibited practices set out in Article 5, the high-risk areas listed in Annex III, the transparency obligations and the regime for general-purpose models; the generator translates them into a draft internal policy.
None of these can replace the analysis carried out by a lawyer: the documents are drafts intended for professional review. The criteria are revised in line with developments in the European Commission’s guidelines and AESIA’s practice.
Frequently asked questions
What people ask on the AI Act
Who does the AI Act apply to?
What is a high-risk AI system?
When does each block of the Regulation come into force?
What is a general-purpose AI (GPAI) model?
What penalties does the AI Act provide for?
What should an AI governance policy include?
How does the AI Act relate to data protection?
Should we make it clear that a chatbot is an AI?
Related analysis
On the blog
Do you need to adapt your AI systems to the new European legal framework?
Our AI regulation specialists guide you through AI Act compliance.