The EU AI Act Product Quick-Check

This is written for product managers, not lawyers. If your product touches the EU market and uses AI, the first job is not compliance — it's classification. You cannot scope the work until you know which tier you're in.

One date to hold on to: the Act has applied in general since 2 August 2026, but the Digital Omnibus on AI moved the high-risk obligations to 2 December 2027 (Annex III) and 2 August 2028 (regulated products under Annex I). That is runway for classification, not a reason to postpone it. Current as of 30 August 2026 — this page is orientation, not legal advice; the consolidated Act on EUR-Lex is the source of truth.

The Act sorts AI systems into four tiers. Most product features land in the bottom two; the cost of being wrong lives in the top two.

• Unacceptable risk — prohibited. Social scoring, manipulative or exploitative systems, most real-time biometric identification in public spaces. If a feature is here, it doesn't ship in the EU. Full stop.
• High risk — heavy obligations. Systems used in the contexts listed in Annex III (see Step 2), or that act as a safety component of a regulated product. These duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I) — the classification work that decides whether they hit you is due now.
• Limited risk — transparency obligations. Chatbots, generative content, emotion recognition. Users must be told they're interacting with AI; synthetic media must be labelled.
• Minimal risk — no specific obligations. Spam filters, recommendations, most internal tooling. Document the call and move on.

0 von 8 treffen zu

Annex III lists exactly eight areas. A feature used in any of them is presumed high-risk. Check what applies to your product:

BiometricsRemote identification, biometric categorisation, emotion recognition.

Critical infrastructureEnergy, water, transport, digital infrastructure — as a safety component.

Education and vocational trainingAccess, scoring, proctoring.

Employment and workers' managementRecruitment, screening, task allocation, evaluation.

Access to essential services and benefitsCredit scoring, insurance pricing, public benefits.

Law enforcementRisk assessments, evidence evaluation, profiling.

Migration, asylum, and border controlApplication processing, risk and security assessments.

Administration of justice and democratic processesJudicial decision support, election-influencing systems.

If your feature decides, ranks, or gates a person's access to one of these, assume high-risk until proven otherwise.

Whatever the tier, these five move you from exposed to defensible. Two are duties written into the Act, three are the groundwork that makes those duties cheap. Mark what you already have:

0 von 5 abgehakt

InventoryGroundwork, not a statutory duty. List every AI system and feature you ship or deploy. You can't classify what you haven't named — and the inventory is the single most urgent step.

ClassificationGroundwork the Act's tiering hinges on. Assign each system a tier and write down why. This document is your first line of defence.

A named ownerGovernance practice, not a statutory duty. One accountable person, or an AI committee with a named chair — not a shared inbox.

TransparencyA legal duty for user-facing AI, in force since August 2026. Tell people they're dealing with AI and label generated content. Cheap to do, expensive to skip.

Human oversightA legal duty for high-risk systems from the 2027/2028 dates. The ability for a person to understand, override, and detect anomalies — in the architecture, not the release notes.

The Act has no finish line — the Digital Omnibus already moved the high-risk dates once. The Commission is still issuing guidance, the AI Office is revising codes of practice, and national regulators are operationalising penalties. Treat classification as a living document you revisit each quarter, not a one-time gate.

Getting the classification right is the cheap part; discovering you were high-risk in production is the expensive one. If you're staring at a backlog of features and aren't sure which ones are already in scope, that triage is exactly the kind of thing I help product teams work through.

Zum Mitnehmen

Das einseitige PDF, bereit zum internen Weiterleiten.

PDF herunterladen