The idea behind it
The EU AI Act, Regulation (EU) 2024/1689, sets obligations by two things: the role an organization plays for an AI system and the risk tier the system falls in. A provider develops a system and places it on the market or puts it into service under its own name. A deployer uses one in its professional activity. Importers and distributors sit in the supply chain. The tiers run from prohibited practices (Article 5) through high-risk systems (Article 6, with Annex I for safety components of regulated products and Annex III for listed uses) to the transparency duties of Article 50, which apply on top of any tier. General-purpose AI models have their own obligations in Chapter V.
The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since July 27, 2026, changed the dates. High-risk obligations for Annex III systems now apply from December 2, 2027 and for Annex I systems from August 2, 2028. The prohibitions have applied since February 2, 2025, the GPAI model obligations since August 2, 2025, and Article 50 since August 2, 2026. The Omnibus also added two prohibited practices, which apply from December 2, 2026. The worksheet uses the amended dates, checked against the Official Journal text.
What's inside
- Key dates as amended by the Digital Omnibus, Regulation (EU) 2026/1744: Annex III high-risk from December 2, 2027, Annex I from August 2, 2028, each with its article.
- Five checks per system: your role (provider, deployer, importer, distributor) and the Article 25 question, the Article 5 prohibited practices, the Article 6 high-risk test with Annex I and Annex III, the Article 50 transparency duties and the general-purpose AI model questions.
- A tier rule that sets each system as prohibited, high-risk (Annex I or III), not high-risk under Article 6(3), or outside the high-risk tier.
- The obligations for each tier and role, with article references, and the Article 111 rules for systems already on the market.
- A worked example of seven systems at a fictional lender, from a prohibited emotion-recognition tool to a website assistant with Article 50 duties.
- A one-page classification record to print, and a not-legal-advice notice asking counsel to confirm the result.
- The Excel version has a classification register with drop-downs that works out the tier, the date and the obligations, plus a question guide.
Format: PDF (5 pages) and Excel workbook.
A look inside
Pages 1 and 2 of 5 of the PDF. Select an image to enlarge it.
Who uses it
- Compliance and legal leads, to give counsel a complete inventory with the reasoning for each classification written down.
- CIOs and heads of AI governance, to see which systems carry high-risk obligations and when each tier applies.
- Procurement and vendor managers, to record the role the organization plays for each bought AI system and what to ask the provider for.
- Data science leads, to check whether fine-tuning or rebranding a model changes the organization's role.
When to use it
- An AI inventory exists and each system needs a first classification.
- A new AI system or use case goes to the architecture or AI review board.
- A team plans to fine-tune a model, put the company's name on a vendor's system, or use a system for a new purpose.
- A plan for the December 2, 2027 high-risk date needs a list of the systems in scope.
- Guidance written before July 2026 has to be checked against the amended dates.
How to use it
Enter each AI system from your inventory, answer the five checks, and take every prohibited, high-risk or Article 6(3) result to counsel.
- List each AI system with its intended purpose and the date it was first placed on the EU market or put into service.
- Record your role for each system, and answer the Article 25 question: your name on it, a substantial modification, or a new purpose that makes it high-risk.
- Check the purpose against each point of Article 5. Mark Possible where counsel has not ruled, and stop there until counsel does.
- Answer the high-risk questions: Annex I safety component, Annex III area, the Article 6(3) conditions and whether the system profiles people.
- Record the Article 50 trigger and the GPAI model position, including whether a modification used more than a third of the original model's training compute.
- Read the tier, the date and the obligations for your role, and take every prohibited, high-risk and Article 6(3) result to counsel.
You leave with: A register of AI systems, each with your role, its tier, the date that tier applies, the obligations for your role, the Article 50 and GPAI duties, and an owner and review date.
Where it goes wrong
- Planning to the August 2, 2026 high-risk date from older guidance. The Omnibus moved Annex III to December 2, 2027 and Annex I to August 2, 2028.
- Treating the deferral as a pause. Article 5, the GPAI model obligations and Article 50 already apply.
- Classifying by sector instead of by intended purpose. A tool used in a lender's back office is not high-risk because the lender is.
- Missing the role change. Fine-tuning a vendor's high-risk system or putting your name on it can make you its provider.
Get the worksheet
It is free. Enter your work email and we send the download link.
Questions
When do the EU AI Act's high-risk obligations apply?
Under the Act as amended by Regulation (EU) 2026/1744, high-risk obligations apply from December 2, 2027 for the Annex III uses and from August 2, 2028 for AI systems that are safety components of products under Annex I. The prohibited practices have applied since February 2, 2025, and the Article 50 transparency duties since August 2, 2026.
Is an Annex III system always high-risk?
No. Under Article 6(3) it is not high-risk if it poses no significant risk of harm and performs a narrow procedural task, improves a completed human activity, detects decision patterns without replacing human review, or does a preparatory task. A system that profiles natural persons is always high-risk. The provider documents the assessment and registers the system.
Does fine-tuning a model make us its provider?
For a high-risk system, a substantial modification makes you its provider under Article 25. For a general-purpose AI model, the Commission's guidelines treat a modifier as the provider of the modified model when the modification used more than a third of the original model's training compute, and the obligations are then limited to the modification.