Is my AI system high-risk under the EU AI Act?

Work through it in this order

1. 1Is it an AI system under the Act's definition, and is it placed on the EU market or its output used in the EU? If not, the Act may not apply.
2. 2Is it a prohibited practice under Article 5, such as social scoring or emotion recognition at work or school? Those are banned, not high-risk.
3. 3Is it a safety component of, or itself, a product under the Annex I laws (such as medical devices or machinery) that needs a third-party conformity assessment? Then it is high-risk, from 2 August 2028.
4. 4Is it used in an Annex III area: biometrics, critical infrastructure, education, employment, essential services such as credit or insurance, law enforcement, migration, or justice and democratic processes? Then it is high-risk from 2 December 2027, unless Article 6(3) applies.
5. 5Does Article 6(3) apply? An Annex III system is not high-risk if it does not pose a significant risk, for example because it only does a narrow procedural task or improves work a person already finished. It never applies to systems that profile people. Document the assessment.
6. 6If none of these, check Article 50 transparency duties, for example telling people they are talking to an AI or marking AI-generated content.

What changes for the software if it is high-risk

Providers need a risk management system, data governance, technical documentation, automatic logging, instructions for deployers, human oversight, accuracy, robustness and cybersecurity, a quality management system, a conformity assessment and registration in the EU database. Deployers have duties too, such as using the system as instructed and keeping logs.

Most of these are easier to design in than to add later, especially logging, oversight screens and documented evaluation.