(a) the placing on the market, the putting into service or the use of an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective, or the effect of materially distorting the behaviour of a person or a group of persons by appreciably impairing their ability to make an informed decision, thereby causing them to take a decision that they would not have otherwise taken in a manner that causes or is reasonably likely to cause that person, another person or group of persons significant harm;
Every ending
The ten outcomes a scope assessment can reach
Written out in full, in the order that matters most first. Each one carries the provisions it rests on, the date it starts to bind, the penalty tier attached to it, and the point where the answer stops being safe to rely on.
Likely prohibited
Basis: Article 5(1), point (a) and point (ba).
Shown with one original prohibition and one the Digital Omnibus added.
This is not a tier with obligations attached. Article 5 bans the practice outright: placing it on the market, putting it into service, and in most points using it at all.
Up to EUR 35 000 000, or 7 percent of total worldwide annual turnover under Art. 99(3)
Where this outcome stops
- Points (ba) and (bb) came in with the Digital Omnibus and apply from 2 December 2026. Article 5(1a) narrows them: for placing on the market the generation has to be the intended purpose, or a reasonably foreseeable and reproducible outcome that the system has no adequate safeguards against.
- Several points carry their own express exceptions, including medical and safety uses for emotion inference and the law enforcement objectives under point (h). Read the point in full before you conclude.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
(ba) the placing on the market, the putting into service or the use of an AI system that generates or manipulates realistic images, videos, audio or similar material of an identifiable natural person’s intimate parts, or of an identifiable natural person engaged in sexually explicit activities, without that person’s freely-given, specific, informed, unambiguous and explicit consent for that generation or manipulation;
For the purposes of paragraph 1, first subparagraph, points (ba) and (bb):
(a) the placing on the market or putting into service of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, point (ba) or (bb) is only prohibited where:
(i) that generation or manipulation is the intended purpose of the AI system; or
(ii) the system’s design, training, architecture, capabilities or user-facing functionalities make that generation or manipulation a reasonably foreseeable and reproducible outcome, without requiring significant technical modification, and the system does not have reasonable and adequate technical safety measures and other safeguards to reliably prevent that generation or manipulation, taking into account reasonably foreseeable misuse, and to correct observed or reported misuse;
(b) the use of an AI system that generates or manipulates the material or performance referred to in paragraph 1, first subparagraph, points (ba) and (bb) is only prohibited where the deployer uses the system for the purpose of generating or manipulating such material or performance.
For the purposes of paragraph 1, first subparagraph, point (ba), an AI system that manipulates material in a way that does not increase the exposure of any depicted intimate parts or alter the nature of any depicted sexually explicit activities shall not constitute manipulation.
Run the wizard on your own system to see which of these it reaches, and why.
Likely high risk, Annex I Section A
Basis: Article 6(1) with Annex I Section A.
A safety component of a toy, a lift, a medical device, radio equipment.
Your system is a safety component of a product that already has to pass third-party conformity assessment, or it is that product. Chapter III applies to it in full: risk management, data governance, documentation, logging, human oversight, accuracy and robustness, then conformity assessment and registration.
Chapter III Sections 1 to 3 apply to Annex I systems from 2 August 2028 Art. 113(c)(ii)
Where this outcome stops
- Article 6(1a) is the Omnibus escape hatch, and it is narrow: a system used solely for non-safety related user assistance, performance optimisation, service efficiency, automation, convenience or quality control is not a safety component. Article 6(1b) takes it straight back if a failure would endanger health and safety.
- Article 2(13) lets specific Chapter III requirements be limited where Section A legislation already protects health, safety or fundamental rights to an equivalent or higher level, but only once the Commission has adopted the delegated act that names them.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
What this tier asks of you
Art. 9 risk managementArt. 10 data governanceArt. 11 technical documentationArt. 12 loggingArt. 13 instructions for useArt. 14 human oversightArt. 15 accuracy and robustnessArt. 17 quality managementArt. 43 conformity assessmentArt. 49 registrationArt. 26 deployer dutiesArt. 73 serious incidents
The text it rests on
Irrespective of whether an AI system is placed on the market or put into service independently of the products referred to in points (a) and (b), that AI system shall be considered to be high-risk where both of the following conditions are fulfilled:
(a) the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;
(b) the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I.
For the purposes of this Regulation, including paragraph 1 of this Article, AI systems that are solely used for non-safety related aspects of user assistance, performance optimisation, service efficiency, automation or convenience or quality control shall not qualify as safety components.
Notwithstanding paragraph 1a, AI systems the failure or malfunctioning of which would endanger health and safety shall qualify as safety components.
A product that is required to undergo a third-party conformity assessment solely due to risks other than risks to health and safety, in particular risks relating to the distribution of radio spectrum or electromagnetic interference that do not affect health and safety, shall not be considered as fulfilling the condition in paragraph 1, point (b).
For high-risk AI systems referred to in Article 6(1), the application of specific requirements or obligations laid down in Articles 9 to 15 and 17 to 25 may be limited, where and to the extent that:
(a) Union harmonisation legislation listed in Section A of Annex I lays down requirements or obligations providing an equivalent or higher level of protection of health, safety or fundamental rights as the requirement or obligation concerned; and
(b) such limitation does not reduce the overall level of protection provided for by this Regulation.
By 2 August 2027, the Commission shall adopt delegated acts in accordance with Article 97 in order to supplement this Regulation by specifying the high-risk AI systems concerned, the requirements or obligations that may be limited, the conditions under which such limitation applies, and the scope of the limitation.
Run the wizard on your own system to see which of these it reaches, and why.
High risk on the sectoral track, Annex I Section B
Basis: Article 6(1) with Annex I Section B, read with Article 2(2).
A product under aviation, motor vehicle, rail, marine equipment or machinery law.
Your product sits in Section B of Annex I, the sectoral legislation for aviation, motor vehicles, rail, marine equipment and machinery. Article 2(2) is emphatic here: of this Regulation, only Article 6(1), Article 60a and Articles 102 to 112 apply to you. The requirements themselves arrive through your sectoral law, not through Chapter III.
Article 6(1) applies to Annex I systems from 2 August 2028 Art. 113(c)(ii)
Where this outcome stops
- This is the branch most scoping tools get wrong. Reading Chapter III onto a Section B product invents duties this Regulation does not impose on it.
- Articles 57, 58 and 59 on regulatory sandboxes apply only in so far as the high-risk requirements have been integrated into that sectoral legislation.
- The classification in Article 6(1) still applies from the Annex I date, and your sectoral regime applies on its own timetable.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
For AI systems classified as high-risk AI systems in accordance with Article 6(1) related to products covered by the Union harmonisation legislation listed in Section B of Annex I, only Article 6(1), Article 60a and Articles 102 to 112 shall apply. Articles 57, 58 and 59 shall apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.
Irrespective of whether an AI system is placed on the market or put into service independently of the products referred to in points (a) and (b), that AI system shall be considered to be high-risk where both of the following conditions are fulfilled:
(a) the AI system is intended to be used as a safety component of a product, or the AI system is itself a product, covered by the Union harmonisation legislation listed in Annex I;
(b) the product whose safety component pursuant to point (a) is the AI system, or the AI system itself as a product, is required to undergo a third-party conformity assessment, with a view to the placing on the market or the putting into service of that product pursuant to the Union harmonisation legislation listed in Annex I.
Run the wizard on your own system to see which of these it reaches, and why.
Likely high risk, Annex III
Basis: Annex III point 4 with Article 6(2).
Shown for Annex III point 4, employment and workers' management.
A stand-alone high-risk system. Chapter III Sections 1 to 3 apply: the provider builds the risk management system, the data governance, the technical documentation, the logs, the human oversight and the accuracy and robustness case, passes conformity assessment, and registers the system before it goes to market. The deployer carries Article 26 on top.
Chapter III Sections 1 to 3 apply to Annex III systems from 2 December 2027 Art. 113(c)(i)
Up to EUR 15 000 000, or 3 percent of total worldwide annual turnover under Art. 99(4)
Where this outcome stops
- The Article 6(3) derogation was open to you and did not close the question, so the classification stands.
- Annex III point 1 on biometrics, point 6 on law enforcement and point 7 on migration each open with the same condition: in so far as their use is permitted under Union or national law. That condition is not a formality.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
What this tier asks of you
Art. 9 risk managementArt. 10 data governanceArt. 11 technical documentationArt. 12 loggingArt. 13 instructions for useArt. 14 human oversightArt. 15 accuracy and robustnessArt. 17 quality managementArt. 43 conformity assessmentArt. 49 registrationArt. 26 deployer dutiesArt. 73 serious incidents
The text it rests on
4. Employment, workers’ management and access to self-employment:
(a) AI systems intended to be used for the recruitment or selection of natural persons, in particular to place targeted job advertisements, to analyse and filter job applications, and to evaluate candidates;
(b) AI systems intended to be used to make decisions affecting terms of work-related relationships, the promotion or termination of work-related contractual relationships, to allocate tasks based on individual behaviour or personal traits or characteristics or to monitor and evaluate the performance and behaviour of persons in such relationships.
In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.
By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.
The first subparagraph shall apply where any of the following conditions is fulfilled:
(a) the AI system is intended to perform a narrow procedural task;
(b) the AI system is intended to improve the result of a previously completed human activity;
(c) the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or
(d) the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.
Deployers of high-risk AI systems shall take appropriate technical and organisational measures to ensure they use such systems in accordance with the instructions for use accompanying the systems, pursuant to paragraphs 3 and 6.
Run the wizard on your own system to see which of these it reaches, and why.
Likely not high risk, Article 6(3)
Basis: The Article 6(3) derogation applies.
An Annex III system that only performs a narrow procedural or preparatory task.
Your system is named in Annex III and still falls outside the high-risk regime, because it does not pose a significant risk of harm and does not materially influence the outcome of decision making. That conclusion is yours to defend, which is why Article 6(4) turns it into a document and Article 49(2) into a registration.
Where this outcome stops
- Article 6(4) is a duty, not a suggestion: document the assessment before the system is placed on the market or put into service, register under Article 49(2), and hand the documentation over on request.
- Add profiling of natural persons at any point and the derogation disappears under the last subparagraph of Article 6(3).
- Article 50 transparency can still apply to a system that is not high risk. Carry on through the last step to check.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
By derogation from paragraph 2, an AI system referred to in Annex III shall not be considered to be high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making.
The first subparagraph shall apply where any of the following conditions is fulfilled:
(a) the AI system is intended to perform a narrow procedural task;
(b) the AI system is intended to improve the result of a previously completed human activity;
(c) the AI system is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or
(d) the AI system is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III.
A provider who considers that an AI system referred to in Annex III is not high-risk shall document its assessment before that system is placed on the market or put into service. Such provider shall be subject to the registration obligation set out in Article 49(2). Upon request of national competent authorities, the provider shall provide the documentation of the assessment.
Before placing on the market or putting into service an AI system for which the provider has concluded that it is not high-risk according to Article 6(3), that provider or, where applicable, the authorised representative shall register themselves and that system in the EU database referred to in Article 71.
Run the wizard on your own system to see which of these it reaches, and why.
Likely limited risk, Article 50
Basis: Article 50, paragraph 1, paragraph 2, paragraph 3 and paragraph 4.
Shown with all four Article 50 duties selected.
Article 50 asks for one thing and asks it plainly: people must be able to tell that they are dealing with a machine, or with content a machine made. Disclosure has to reach the person at the first interaction, in a clear and distinguishable way.
Article 50 transparency obligations apply from 2 August 2026 Art. 113
Up to EUR 15 000 000, or 3 percent of total worldwide annual turnover under Art. 99(4)
Where this outcome stops
- Article 50 applies from 2 August 2026, the Regulation's general date of application.
- Each paragraph carries exceptions, including systems authorised by law for criminal offences, standard editing assistance, and artistic or satirical work where the disclosure must not spoil the work.
- Limited risk is not a ceiling. A system with transparency duties can also be high risk, and the two sets of obligations stack.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
Providers shall ensure that AI systems intended to interact directly with natural persons are designed and developed in such a way that the natural persons concerned are informed that they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. This obligation shall not apply to AI systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, unless those systems are available for the public to report a criminal offence.
Providers of AI systems, including general-purpose AI systems, generating synthetic audio, image, video or text content, shall ensure that the outputs of the AI system are marked in a machine-readable format and detectable as artificially generated or manipulated. Providers shall ensure their technical solutions are effective, interoperable, robust and reliable as far as this is technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art, as may be reflected in relevant technical standards. This obligation shall not apply to the extent the AI systems perform an assistive function for standard editing or do not substantially alter the input data provided by the deployer or the semantics thereof, or where authorised by law to detect, prevent, investigate or prosecute criminal offences.
Deployers of an emotion recognition system or a biometric categorisation system shall inform the natural persons exposed thereto of the operation of the system, and shall process the personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable. This obligation shall not apply to AI systems used for biometric categorisation and emotion recognition, which are permitted by law to detect, prevent or investigate criminal offences, subject to appropriate safeguards for the rights and freedoms of third parties, and in accordance with Union law.
Deployers of an AI system that generates or manipulates image, audio or video content constituting a deep fake, shall disclose that the content has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offence. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the transparency obligations set out in this paragraph are limited to disclosure of the existence of such generated or manipulated content in an appropriate manner that does not hamper the display or enjoyment of the work.
Deployers of an AI system that generates or manipulates text which is published with the purpose of informing the public on matters of public interest shall disclose that the text has been artificially generated or manipulated. This obligation shall not apply where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences or where the AI-generated content has undergone a process of human review or editorial control and where a natural or legal person holds editorial responsibility for the publication of the content.
The information referred to in paragraphs 1 to 4 shall be provided to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure. The information shall conform to the applicable accessibility requirements.
Run the wizard on your own system to see which of these it reaches, and why.
Likely minimal risk
Basis: No prohibition, no high-risk classification, no Article 50 trigger.
Where most AI in an organisation actually lands.
Most AI lands here. The Regulation imposes no product obligations on this tier. What it offers instead is Article 95: codes of conduct that let you apply the high-risk requirements voluntarily, which is exactly what a serious buyer will ask you about.
Where this outcome stops
- Article 4 still reaches you. Providers and deployers owe AI literacy measures to the staff and other people who operate their systems.
- Minimal risk is a conclusion about today's system and today's purpose. A change of purpose is a new classification, and Article 25 can turn a deployer into a provider.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
The AI Office and the Member States shall encourage and facilitate the drawing up of codes of conduct, including related governance mechanisms, intended to foster the voluntary application to AI systems, other than high-risk AI systems, of some or all of the requirements set out in Chapter III, Section 2 taking into account the available technical solutions and industry best practices allowing for the application of such requirements.
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
Run the wizard on your own system to see which of these it reaches, and why.
Likely out of scope, definition
Basis: It does not meet the definition of an AI system, Article 3(1).
A deterministic system that a person fully specified.
The Regulation only reaches AI systems as it defines them. A system that does not infer outputs from inputs is not one, so the risk tiers never engage.
Where this outcome stops
- Inference is a low bar. If any part of the system learns, ranks, scores, predicts or generates, answer step one again.
- AI literacy under Article 4 is a separate duty and it can still apply to the AI you use elsewhere.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
(1) ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;
Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context the AI systems are to be used in, and considering the persons or groups of persons on whom the AI systems are to be used. This obligation does not require providers or deployers to guarantee any specific level of AI literacy of any individual.
Run the wizard on your own system to see which of these it reaches, and why.
Likely out of scope, excluded domain
Basis: An excluded domain applies, Art. 2(3), Art. 2(6), Art. 2(8), Art. 2(10) and Art. 2(12).
Shown with all five Article 2 carve-outs, and the limit on each.
Article 2 lifts whole domains out of the Regulation. On the answers you gave, your system sits in one of them.
Where this outcome stops
- National security stays with the Member States, so national rules can still reach your system. The word that decides this carve-out is exclusively: a dual use system is back in scope.
- The carve-out covers the sole purpose of scientific research and development. The moment the same system is put into service for anything else, it is in scope.
- This one expires by design. It ends at placing on the market or putting into service, and testing in real world conditions is expressly not covered.
- It lifts the duties of deployers who are natural persons acting privately. It says nothing about the provider who placed that system on the market.
- The carve-out fails the moment the system is placed on the market or put into service as a high-risk system, or as one that falls under Article 5 or Article 50.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
This Regulation does not apply to areas outside the scope of Union law, and shall not, in any event, affect the competences of the Member States concerning national security, regardless of the type of entity entrusted by the Member States with carrying out tasks in relation to those competences.
This Regulation does not apply to AI systems where and in so far they are placed on the market, put into service, or used with or without modification exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.
This Regulation does not apply to AI systems which are not placed on the market or put into service in the Union, where the output is used in the Union exclusively for military, defence or national security purposes, regardless of the type of entity carrying out those activities.
This Regulation does not apply to AI systems or AI models, including their output, specifically developed and put into service for the sole purpose of scientific research and development.
This Regulation does not apply to any research, testing or development activity regarding AI systems or AI models prior to their being placed on the market or put into service. Such activities shall be conducted in accordance with applicable Union law. Testing in real world conditions shall not be covered by that exclusion.
This Regulation does not apply to obligations of deployers who are natural persons using AI systems in the course of a purely personal non-professional activity.
This Regulation does not apply to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50.
Run the wizard on your own system to see which of these it reaches, and why.
Likely out of scope, no Union nexus
Basis: No Union nexus under Article 2(1).
No Union market, no Union deployer, no Union output.
The Regulation reaches providers and deployers through the Union market, Union establishment, or Union use of the output. On your answers, none of those threads runs to you.
Where this outcome stops
- Article 2(1)(c) is the one that catches people out: a third country provider is in scope where the output produced by the system is used in the Union, with no establishment needed.
- One customer, one reseller or one Union subsidiary changes this answer.
- This is an educational classification, not legal advice, and it rests only on the answers you gave.
The text it rests on
This Regulation applies to:
(a) providers placing on the market or putting into service AI systems or placing on the market general-purpose AI models in the Union, irrespective of whether those providers are established or located within the Union or in a third country;
(b) deployers of AI systems that have their place of establishment or are located within the Union;
(c) providers and deployers of AI systems that have their place of establishment or are located in a third country, where the output produced by the AI system is used in the Union;
(d) importers and distributors of AI systems;
(e) product manufacturers placing on the market or putting into service an AI system together with their product and under their own name or trademark;
Run the wizard on your own system to see which of these it reaches, and why.
Educational instrument, not legal advice. Outcomes are likely classifications based on the answers you give and on the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. The official texts on EUR-Lex are always authoritative.