Updated 1 November 2026: rewritten with article references, examples and the application dates set by Regulation (EU) 2026/1744.
Your tier under the EU AI Act depends on what your AI system is used for, not on how advanced it is. Check the Act in a fixed order: Article 5 (banned practices), Article 6 with Annexes I and III (high-risk), Article 50 (transparency), and then the residual tier, which carries no specific duties beyond AI literacy. Since Regulation (EU) 2026/1744 (the Digital Omnibus on AI) entered into force on 27 July 2026, the bans and most transparency duties already apply, while high-risk duties for Annex III systems start on 2 December 2027.
Does the AI Act apply to you at all?
It very likely does if your system reaches the EU market or its output is used in the EU. Article 2(1) covers providers placing AI systems on the EU market wherever they are established. It also covers providers and deployers outside the EU where the output "is used in the Union". A Turkish or Korean company can therefore fall within the Act without an EU office.
Two roles matter. The provider develops a system, or has it developed, and offers it under its own name (Article 3(3)). The deployer uses a system under its authority, unless the use is personal and non-professional (Article 3(4)). Article 2 also sets exclusions, including AI used only for military, defence or national security purposes (Article 2(3)) and AI built solely for scientific research (Article 2(6)).
General-purpose AI models are a separate track, not a risk tier. Their providers have had duties under Article 53 since 2 August 2025.
Is your system banned under Article 5?
It is banned if it falls within one of the practices listed in Article 5(1), and those bans have applied since 2 February 2025. The list is short and specific:
- manipulative or deceptive techniques, and exploiting vulnerabilities due to age, disability or social or economic situation, where significant harm is caused or likely;
- social scoring that leads to unjustified or unrelated detrimental treatment;
- predicting a person's risk of committing a crime based solely on profiling or personality traits;
- building facial recognition databases by untargeted scraping of images from the internet or CCTV;
- inferring emotions at work or in education, except for medical or safety reasons;
- biometric categorisation to infer race, political opinions, religion, sexual orientation and similar traits;
- real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions.
A concrete example: the Commission's guidelines on prohibited practices state that using emotion recognition during recruitment is prohibited. Those guidelines are non-binding, but they show how the Commission reads the ban.
The Omnibus adds two bans from 2 December 2026: AI systems that generate non-consensual intimate imagery of an identifiable person, and systems that generate child sexual abuse material (Article 5(1)(ba) and (bb)). The site's note on the nudification ban explains the conditions. Breaching Article 5 can cost up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher (Article 99(3)).
Is your system high-risk under Article 6?
It is high-risk if it meets one of two routes, and the routes have different start dates.
Route 1, products (Article 6(1) and Annex I). The system is a product, or a safety component of a product, covered by listed EU product law, and that product needs a third-party conformity assessment (a check by an outside body). Examples are safety functions in lifts, toys or medical devices. These duties apply from 2 August 2028. Products in Annex I, Section B, which now include machinery, follow a narrower rule (Article 2(2)). The Omnibus also narrowed the route: AI used solely for non-safety aspects such as convenience or performance optimisation is not a safety component, unless its failure would endanger health and safety (Article 6(1a) and (1b)).
Route 2, listed uses (Article 6(2) and Annex III). The use falls within one of eight areas: biometrics; critical infrastructure; education; employment; essential private and public services; law enforcement; migration and border control; and justice and democratic processes. Examples are a tool that filters job applications (point 4(a)), credit scoring (point 5(b), fraud detection excepted), life and health insurance pricing (point 5(c)) and exam proctoring (point 3(d)). These duties apply from 2 December 2027.
Article 6(3) offers a way out of Annex III. A system is not high-risk if it poses no significant risk and only performs a narrow procedural task, improves a completed human activity, detects decision patterns without replacing human assessment, or does preparatory work. In this note's reading, a tool that only sorts CVs into folders by file type may qualify; one that ranks candidates is unlikely to. Two limits apply. An Annex III system that profiles people is always high-risk. A provider relying on the exception must document its assessment and register the system (Articles 6(4) and 49(2)).
The Commission published draft classification guidelines on 19 May 2026. The site's high-risk assessment guide turns these tests into questions, and the note on the moved deadline covers the timetable.
Does Article 50 attach transparency duties?
It does if your system talks to people, generates synthetic content, or recognises emotions or categorises people biometrically. Article 50 has applied since 2 August 2026:
- Providers must design chatbots so people know they are dealing with AI, unless that is obvious (Article 50(1)).
- Providers of generative systems must mark outputs in a machine-readable way (Article 50(2)). Systems on the market before 2 August 2026 have until 2 December 2026 (Article 111(4)).
- Deployers must tell people exposed to emotion recognition or biometric categorisation (Article 50(3)).
- Deployers must disclose deepfakes and AI-generated text published to inform the public on matters of public interest, unless the text had human review and someone holds editorial responsibility (Article 50(4)).
The maximum fine is EUR 15 million or 3% of turnover (Article 99(4)). The site's Article 50 kit gives working material.
What if none of these applies?
You are in the residual tier, and the Act adds no specific rules for your system. The Commission calls this "minimal or no risk" and gives AI-enabled video games and spam filters as examples. That label does not appear as a separate chapter in the Regulation; it simply describes what is left.
Two points remain. Article 4 still asks providers and deployers to take measures supporting AI literacy among their staff, although the Omnibus adds that no specific level has to be guaranteed. Other law also continues to apply, including the GDPR and, in Türkiye, the KVKK. Article 95 invites voluntary codes of conduct.
Where do classifications usually go wrong?
Most errors come from treating the tiers as a one-time label rather than a test of each use.
- Tiers overlap. A high-risk recruitment chatbot must meet both high-risk rules and Article 50(1); Article 50(6) says so.
- Purpose can change. If a deployer repurposes a general tool for a use listed in Annex III, it becomes the provider of a high-risk system (Article 25(1)(c)). The AI in hiring guide shows how this plays out in recruitment.
- Dates are not exemptions. A system due to be high-risk in 2027 can breach Article 5 today.
Frequently asked questions
What are the four risk tiers of the EU AI Act?
The EU AI Act is commonly described as having four tiers: prohibited practices (Article 5), high-risk systems (Article 6 with Annexes I and III), systems with transparency duties (Article 50), and minimal or no risk. The last is what remains when the other three do not apply. General-purpose AI models follow separate rules.
When do the EU AI Act's high-risk rules apply?
Under Regulation (EU) 2026/1744, high-risk rules for Annex III systems apply from 2 December 2027, and rules for AI in Annex I products apply from 2 August 2028. The Commission's timeline shows both dates. The Article 5 bans and Article 50 duties are not postponed.
Does the EU AI Act apply to a company in Türkiye?
The EU AI Act can apply to a company in Türkiye. Article 2(1) covers providers placing AI systems on the EU market wherever they are established, and providers and deployers in third countries where the system's output is used in the EU. Selling only to customers in Türkiye falls outside these triggers unless output is used in the EU.
Is every chatbot high-risk under the EU AI Act?
No. A chatbot usually falls under the Article 50 transparency duty, which requires people to be told they are interacting with AI. It becomes high-risk under the EU AI Act only if its intended use falls within Annex III, for example evaluating job candidates.
Sources: Regulation (EU) 2024/1689 and Regulation (EU) 2026/1744 as published in the Official Journal; Commission guidelines C(2025) 5052 and C(2026) 5054; Commission draft high-risk guidelines of 19 May 2026 and Commission web pages, all read on 1 November 2026. Final high-risk guidelines may change the examples above. General information, not legal advice.
