AI Act triage. Three questions, a rough answer.

Answer three questions to see the likely category of an AI system under the EU AI Act, and which articles to read. It’s a starting point, not legal advice.

1. What does the system mainly do? Makes or shapes decisions about people (hiring, credit, eligibility, public services)Annex III · likely high-risk Processes biometric or emotion dataArticle 5 or Annex III · check both Generates content (text, images, code) that people seeArticle 50 · transparency Works behind the scenes (search, recommendations, analytics)Usually minimal risk Uses manipulative techniques or exploits vulnerabilities in a way that can cause significant harmArticle 5(1)(a)–(b) · prohibited

2. Who uses it, and where? The public in the EUIn scope Businesses in the EUIn scope Only employees, inside an organisationIn scope · deployer duties (Article 26) Only outside the EUCheck Article 2 · is the output used in the EU?

3. How much does a person check what it does? It acts on its own, no one checks first A person reviews the output before anything happens It only advises; a person always decidesDoesn’t exempt a system on its own · Article 6(3)

What to do next

Not legal advice. A simplified triage by me, Lorenzo (CIPP/E). A real assessment depends on the intended purpose, how and where the system is used, whether you build it or use it, and the exact wording of Articles 2, 5, 6 and 50 and Annex III of the AI Act. Last checked September 2026.

Decisions from enforcementtracker.com, provided by CMS, and GDPRhub (noyb), under CC BY-NC-SA 4.0. GDPR and AI Act texts from EUR-Lex, © European Union. Not legal advice.

Spotted a mistake? angelillolorenzo@gmail.com · Privacy