Sort it before you see the lawyer.

Which parts of the EU AI Act touch your AI system?

Know what to ask before you pay someone to answer it.

AI Act Triage helps you prepare for a conversation with a qualified adviser. It points to the parts of the Act your answers touch. It isn't legal advice and doesn't tell you where you stand. By using it you agree to the Terms of Use.

How AI Act Triage works

Think of a triage nurse. They sort the people who arrive, decide who needs to see whom and pass on what they have noticed. The doctor makes the diagnosis. AI Act Triage is the nurse. It asks six questions, points to the parts of the Act your answers touch, flags the grey areas and writes a list of questions for your adviser.

That is deliberately different from a checker that hands out verdicts. The Act turns on facts a short questionnaire can't see, such as what a system is really used for and who sits in the supply chain. A tool that declares a system compliant or exempt can be wrong in ways that matter. A tool that says what to ask is much harder to misuse.

The EU AI Act timeline after the Digital Omnibus (Regulation 2026/1744)

Most guides still show the dates from the original text of Regulation (EU) 2024/1689. Regulation (EU) 2026/1744, the Digital Omnibus on AI, changed them. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. The high-risk requirements moved later, while the prohibitions and the transparency rules did not.

The dated list below shows what starts when. Anything with a date in the past is already in force.

  1. In forceProhibited practices (Article 5) and AI literacy (Article 4) start to apply.
  2. In forceRules for providers of general-purpose AI models (Articles 53 to 55) and the penalty regime start to apply.
  3. In forceTransparency rules under Article 50 start to apply.
  4. UpcomingThe Omnibus ban on non-consensual intimate imagery and child sexual abuse material starts. Systems on the market before 2 August 2026 have until this date to mark synthetic output.
  5. UpcomingThe high-risk requirements start to apply to Annex III systems.
  6. UpcomingThe high-risk requirements start to apply to Annex I systems (products under EU product safety law).

For most businesses using or building AI, the dates to watch are for chatbots and synthetic content, and for the Annex III areas such as hiring, credit and education.

Provider or deployer? How Articles 25 and 26 shape what the Act asks of you

The Act puts most of its weight on the provider, the organisation that develops a system, or has it developed, and places it on the market under its own name or trademark. A deployer uses a system in its own operations. Article 26 sets out what the Act asks of deployers of high-risk systems, such as using the system as the provider instructs, assigning trained human oversight and keeping logs.

Article 25 closes an easy exit. A business that puts its name on a high-risk system, substantially modifies it, or changes its purpose so that a system that was not high-risk becomes high-risk can be treated as the provider. The provider list then applies to it.

Does wrapping or fine-tuning a third-party model make a business a provider? Not by itself. Building a product on a model through an API and selling it under your own brand makes you the provider of an AI system, and that brings transparency rules if it talks to people or generates content. The provider of a high-risk system is whoever puts it to a high-risk use. Separate guidance covers when heavy modification of a general-purpose model creates a new model with its own provider. It is still developing, so it is worth asking your adviser about the current position.

Annex III high-risk areas and the Article 6(3) filter

Annex III lists eight areas where a system counts as high-risk: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, and justice and democratic processes. Only the specific uses named in Annex III count. A company in the education sector isn't automatically in scope, but a tool that grades student exams is.

Article 6(3) is a filter that can take some Annex III systems out of the high-risk category. It covers a narrow procedural task, improving the result of a human activity already completed, detecting patterns in past decisions without replacing human review, and a preparatory task for an assessment.

Three limits catch people out. A system that profiles individuals is always high-risk. Splitting a system into modules does not change its classification, because the system is judged as a whole. And the filter isn't self-executing. The Act asks the provider to document the assessment before the system goes to market, provide it to authorities on request (Article 6(4)), and register the system in the EU database (Article 49(2)). The Commission's draft guidance treats doubtful cases as high-risk.

For most Annex III systems the high-risk requirements apply from . Annex I systems, which are products already covered by EU product safety law, follow from .

Penalties and enforcement

Fines come in three tiers under Article 99. Breaching a prohibited practice can cost up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. Most other obligations carry up to EUR 15 million or 3%. Giving incorrect or misleading information to authorities carries up to EUR 7.5 million or 1%. For SMEs and start-ups the lower of the two figures applies.

Enforcement is mostly national. Each member state designates market surveillance authorities. The AI Office, part of the European Commission, supervises providers of general-purpose AI models and certain systems built on those models. Businesses outside the EU are not out of reach. If a system's output is used in the EU the Act can apply, and it asks non-EU providers of high-risk systems and general-purpose models to appoint an EU authorised representative.

Getting the most from your adviser

Advisers charge for time, so use it on the hard questions. Bring the briefing PDF so they can see your answers and the parts of the Act flagged. Settle the open questions first, especially anything marked as needing a closer look, such as the Article 6(3) filter or the Article 25 question. Ask for written answers on the flagged items so you have a record. If you answered Not sure anywhere, say so. Those answers show where the facts are still unclear.

FAQ

Does the EU AI Act apply to UK and US companies?

It can. The Act reaches providers who place systems on the EU market and cases where a system's output is used in the EU. It asks non-EU providers of high-risk systems (Article 22) and of general-purpose AI models (Article 54) to appoint an EU authorised representative.

What changed with the Digital Omnibus?

Regulation (EU) 2026/1744 moved the high-risk dates to for Annex III systems and for Annex I systems. It also added a ban on non-consensual intimate imagery and child sexual abuse material from and changed the AI literacy duty.

Is using ChatGPT or another AI tool at work covered?

Probably, as a deployer. Most of what the Act asks of deployers relates to high-risk uses. Staff AI literacy and any transparency rules are still worth checking, and using a tool for a high-risk purpose, such as screening CVs, brings the high-risk deployer rules in.

Is this legal advice?

No. AI Act Triage is a preparation tool. Like a triage nurse, it sorts and points, and your adviser makes the call. It doesn't tell you where you stand, and it creates no advisory relationship.

Why doesn't the tool just tell me my risk tier?

A short questionnaire can't see the facts that decide a classification. It shows a starting point for each system and marks the grey areas, so you and your adviser can check them.

Are my answers stored?

No. The questions run in your browser. Your answers are not sent to a server.