Does the EU AI Act apply to you?

What the check asks

Each question says which part of the Act it tests. Follow-ups appear only when an earlier answer calls for them, and a UK-only answer closes most of the list off.

1. What does your organisation do with AI systems?

   Tests Article 3

   Pick the closest fit. If you make products with AI built in and sell them under your own name, choose the first option.

   Answers offered

   • We build or sell AI systems under our own name
   • We use AI systems built by other organisations
   • We do both

2. How does your AI activity reach the EU?

   Tests Article 2

   The UK-only answer stands on its own.

   Answers offered

   • We place AI systems on the EU market or put them into service for EU customers or users
   • Outputs from our AI systems are used in the EU
   • We are UK-only, with no EU customers, users or outputs used in the EU

3. Is all of your AI work covered by one of these?

   Asked if you build AI systems and your AI reaches the EU.

   Tests Article 2

   Tick one only if it describes everything you do with AI. Research stops being excluded once a system is placed on the market, put into service or tested in real-world conditions.

   Answers offered

   • AI used only for military, defence or national security purposes
   • Research, testing and development only, with nothing yet placed on the market or put into service
   • AI components we release under a free and open-source licence
   • None of these

4. Do any of these practices happen in your organisation?

   Tests Article 5

   Tick every practice that applies.

   Answers offered

   • Manipulative or deceptive techniques that could cause significant harm
   • Exploiting vulnerability linked to age, disability, or social or economic situation
   • Social scoring of people
   • Predictive policing based solely on profiling
   • Untargeted scraping of facial images for recognition databases
   • Inferring emotion in a workplace or education setting
   • Biometric categorisation used to infer sensitive attributes
   • Real-time remote biometric identification in public spaces for law enforcement
   • Generating or manipulating intimate or sexually explicit imagery of a real person without their consent
   • Generating or manipulating child sexual abuse material
   • None of these

5. Do you provide a general-purpose AI model?

   Tests Chapter V

   Answer based on models you provide, rather than general-purpose tools you only use.

   Answers offered

   • Yes
   • No
   • Not sure

6. Does the model carry systemic risk?

   Asked if you provide a general-purpose AI model.

   Tests Article 51

   It does if it was trained using more than 10²⁵ floating-point operations, or if the European Commission has designated it.

   Answers offered

   • Yes
   • No
   • Not sure

7. Does your AI operate in any of these areas?

   Tests Annex III

   These are the stand-alone high-risk areas listed in Annex III.

   Answers offered

   • Biometrics
   • Critical infrastructure
   • Education or vocational admission and assessment
   • Recruitment, worker management, promotion, termination, task allocation or monitoring
   • Credit, insurance, emergency dispatch, benefits or other essential services
   • Law enforcement
   • Migration or border control
   • Administration of justice or democratic processes
   • None of these

8. Does the AI profile people?

   Asked if you picked an area in the question before.

   Tests Article 6(3)

   Profiling means using personal data to evaluate or predict things about someone, such as their work performance, reliability, behaviour, interests or movements. An AI system in these areas that profiles people is always high-risk.

   Answers offered

   • Yes
   • No
   • Not sure

9. Is the AI's job limited to one of these?

   Asked if you picked an area and the AI does not profile people.

   Tests Article 6(3)

   An AI system in these areas may not be high-risk if its role is this narrow. If you are the provider, you have to document that assessment.

   Answers offered

   • A narrow procedural task, such as turning unstructured data into structured data or sorting incoming documents
   • Improving the result of work a person has already finished, such as polishing the language of a document
   • Spotting patterns in past decisions, or departures from them, without replacing or influencing the human assessment unless a person properly reviews it
   • A preparatory task for an assessment in that area, such as indexing, searching, file handling or translation
   • None of these: it informs or makes the decisions

10. Is AI a safety component of a product covered by EU product law?

    Tests Annex I

    A safety component is one whose failure would endanger health or safety. AI used only for user assistance, performance, efficiency, automation, convenience or quality control does not count.

    Answers offered

    • Yes, in medical or in-vitro diagnostic devices, toys, lifts, radio or pressure equipment, protective equipment, gas appliances, recreational craft, cableways or equipment for explosive atmospheres
    • Yes, in machinery, vehicles, aircraft or drones, marine equipment or rail systems
    • No
    • Not sure

11. Does the product have to go through a third-party conformity assessment?

    Asked if the AI is a safety component of a medical device, toy or similar product.

    Tests Article 6(1)

    That means an assessment by a notified body under the product’s own EU law, for health and safety reasons. An assessment needed only for other reasons, such as radio interference, does not count.

    Answers offered

    • Yes
    • No
    • Not sure

12. Have you done any of these to an AI system another organisation built?

    Asked if you use AI built by others and your answers point to a high-risk system.

    Tests Article 25

    Any of them can make you the provider of a high-risk system, with the provider’s duties.

    Answers offered

    • Put our own name or trademark on it
    • Made a substantial modification to it
    • Changed what it is intended to be used for
    • None of these

13. Does either of these describe you?

    Asked if you use AI built by others in a high-risk area other than critical infrastructure.

    Tests Article 27

    Either one means a fundamental rights impact assessment before you first use a high-risk system.

    Answers offered

    • We are a public body, or a private organisation providing public services
    • We use the AI to assess creditworthiness, or to set prices or assess risk for life or health insurance
    • Neither

14. Which of these does your AI do?

    Tests Article 50

    These are the uses Article 50 asks you to disclose.

    Answers offered

    • Chatbots or other AI systems that talk to people
    • Generating synthetic audio, images, video or text
    • Emotion recognition or biometric categorisation in use
    • Publishing deepfakes: image, audio or video that resembles real people, places or events
    • Publishing AI-generated text to inform the public on matters of public interest
    • None of these

15. Which sector best describes your organisation?

    Answers offered

    • Financial services
    • Healthcare and life sciences
    • Education
    • Technology
    • Professional services
    • Manufacturing and engineering
    • Retail and consumer
    • Public sector
    • Charity and not-for-profit
    • Other

16. What size is your organisation?

    Turnover is optional.

17. What AI is already in use?

    Tests Article 4

    Optional. Include approved tools, anything you've built, and any use you suspect isn't approved.