Use this after the AI inventory exists, one system at a time. You get, in a new folder ./ai-act-risk-classification/: a short written record per AI system explaining which EU AI Act risk tier it falls in and why, with the article behind each step (<system-id>.md), and a one-line-per-system spreadsheet you can open in Excel with the tier and the open questions (summary.csv). This skill drafts for a human to review and sign; this skill never marks a control effective. The output is a reasoned draft, not a legal opinion; the person accountable for legal interpretation confirms every high-risk, prohibited or unclear result.

Inputs to gather

Read the AI register entry, the product documentation, the vendor's instructions for use, and any marketing copy about the system. Ask the reader, in one message: what the system is for in one sentence, who it makes or supports decisions about, whether the company puts it on the market under its own name, and whether it is used in the EU or its output is used there.

Step 1: confirm scope and role

Check territorial scope against Art. 2 and note any exclusion that may apply (military, research before placing on the market, purely personal use). Then fix the company's role using the definitions in Art. 3: provider, deployer, importer or distributor. Check Art. 25 before settling on deployer: putting your name or trademark on a high-risk system, making a substantial modification, or changing the intended purpose so the system becomes high-risk can turn a deployer into a provider. A company that fine-tunes a vendor model and sells the result under its brand is the common case.

Step 2: rule out prohibited practices

Read each practice listed in Art. 5 and record for this system: not applicable, applicable, or unclear, with one line of reasoning each. Emotion recognition at work or in education, social scoring, untargeted scraping of facial images and manipulative techniques are the ones that catch ordinary companies. Any answer other than "not applicable" stops the classification and goes to the legal owner with the facts. The 2026 amendment (the Digital Omnibus on AI) added a ban on systems that generate non-consensual intimate content, including child sexual abuse material and nudification, applying from December 2026; any image or video generation feature gets this check. Check the Commission guidelines on prohibited practices for the current interpretation.

Step 3: test the two high-risk routes

Product route, Art. 6(1): the AI system is a safety component of, or itself is, a product covered by the Union legislation listed in Annex I that needs a third-party conformity assessment. Ask whether the product carries a CE marking under such legislation.
Use-case route, Art. 6(2): the intended purpose falls within an area listed in Annex III (biometrics, critical infrastructure, education, employment and worker management, access to essential services including credit and insurance pricing, law enforcement, migration, justice and democratic processes). Quote the Annex III point you rely on, by number.