Is your AI high risk?

🚫 Unacceptable risk

Your use case appears to fall under a practice prohibited by the EU AI Act. These practices have been banned in the EU since 2 February 2025: the system cannot be deployed as it stands.

Reconsider the purpose with legal counsel. A properly scoped sovereign AI often makes it possible to reach the business objective through a compliant use.

⚠️ High risk (Annex III)

Your use case probably falls under Annex III. This is the most demanding level. Main obligations for a deployer, in particular a public one:

• Risk management system and data governance
• Technical documentation, logging and traceability
• Effective human oversight
• Accuracy, robustness and cybersecurity
• Information and transparency towards the people concerned
• Fundamental rights impact assessment (mandatory for public bodies)
• Registration of the system in the EU database
• A DPIA (GDPR) is most often required in parallel

Deadline: these obligations apply from 2 August 2026. It is better to anticipate them from the design stage.

ℹ️ Limited risk

Your system is subject to transparency obligations:

• Clearly inform people that they are interacting with an AI
• Mark AI-generated content (text, images) in a detectable way

Deadline: transparency applies from 2 August 2026 (obligations for general-purpose models: 2 August 2025). No heavy obligation, but documented governance remains recommended.

✅ Minimal risk

No specific legal obligation under the EU AI Act for this use case. Still recommended: good practice, documented governance and GDPR compliance.

Worth noting: the AI literacy of your staff (art. 4) has been required since 2 February 2025, whatever the risk level.