{"data":{"slug":"eu-ai-act-role-risk-classifier","title":"EU AI Act Role and Risk Classifier","type":"checklist","formats":["xlsx"],"topics":["inventory","risk","governance"],"frameworks":["eu-ai-act"],"short":"Answer six questions per system and the sheet returns the role, the risk tier and the date its duties apply, looked up from the dated milestones on the EU AI Act record.","covers":{"policies":["eu-ai-act"]},"version":4,"dataset_version":"52bd836b1d6b","generated_at":"2026-10-08T05:30:01+00:00","citations":53,"downloads":3,"files":[{"format":"xlsx","filename":"eu-ai-act-role-risk-classifier-v4.xlsx","bytes":44682,"url":"https://aipolicytracker.org/templates/eu-ai-act-role-risk-classifier#download"}],"url":"https://aipolicytracker.org/templates/eu-ai-act-role-risk-classifier","inside":["Classifier sheet: role, Annex III area, prohibited practice, safety component, GPAI and systemic-risk questions as dropdowns; tier and application date as formulas","Dates sheet: every dated milestone on the EU AI Act record, with status and confidence","Duties sheet: every recorded EU AI Act duty by role, with article reference"],"legal_basis":["eu-ai-act"],"caveat":"dates","covered_obligations":[{"slug":"eu-ai-act-prohibited-practices","title":"Do not deploy or provide AI for prohibited practices","policy":"eu-ai-act","source_reference":"Article 5","url":"https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices"},{"slug":"eu-ai-act-ai-literacy","title":"Ensure AI literacy of staff operating AI systems","policy":"eu-ai-act","source_reference":"Article 4","url":"https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy"},{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","policy":"eu-ai-act","source_reference":"Article 9","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"eu-ai-act-data-governance","title":"Apply data governance and quality criteria to training, validation and testing data","policy":"eu-ai-act","source_reference":"Article 10","url":"https://aipolicytracker.org/obligations/eu-ai-act-data-governance"},{"slug":"eu-ai-act-technical-documentation","title":"Draw up technical documentation before placing a high-risk system on the market","policy":"eu-ai-act","source_reference":"Article 11 and Annex IV","url":"https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation"},{"slug":"eu-ai-act-record-keeping","title":"Design high-risk systems to log events automatically","policy":"eu-ai-act","source_reference":"Article 12; Article 26(6) for deployers","url":"https://aipolicytracker.org/obligations/eu-ai-act-record-keeping"},{"slug":"eu-ai-act-transparency-to-deployers","title":"Provide deployers with clear instructions for use","policy":"eu-ai-act","source_reference":"Article 13","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers"},{"slug":"eu-ai-act-human-oversight","title":"Enable and assign effective human oversight","policy":"eu-ai-act","source_reference":"Article 14; Article 26(2) for deployers","url":"https://aipolicytracker.org/obligations/eu-ai-act-human-oversight"},{"slug":"eu-ai-act-accuracy-robustness-cybersecurity","title":"Achieve appropriate accuracy, robustness and cybersecurity","policy":"eu-ai-act","source_reference":"Article 15","url":"https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity"},{"slug":"eu-ai-act-quality-management-system","title":"Operate a quality management system","policy":"eu-ai-act","source_reference":"Article 17","url":"https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system"},{"slug":"eu-ai-act-conformity-assessment-registration","title":"Complete conformity assessment, CE marking and EU database registration","policy":"eu-ai-act","source_reference":"Articles 43, 47, 48 and 49; Annex VIII","url":"https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration"},{"slug":"eu-ai-act-deployer-obligations","title":"Use high-risk AI as instructed, monitor it and inform affected people","policy":"eu-ai-act","source_reference":"Article 26","url":"https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations"},{"slug":"eu-ai-act-fundamental-rights-impact-assessment","title":"Carry out a fundamental rights impact assessment before deployment","policy":"eu-ai-act","source_reference":"Article 27","url":"https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment"},{"slug":"eu-ai-act-transparency-article-50","title":"Disclose AI interaction and label synthetic content","policy":"eu-ai-act","source_reference":"Article 50","url":"https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50"},{"slug":"eu-ai-act-gpai-provider-obligations","title":"Meet general-purpose AI model provider obligations","policy":"eu-ai-act","source_reference":"Article 53 and Annexes XI–XII","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations"},{"slug":"eu-ai-act-gpai-systemic-risk","title":"Manage systemic risk for high-impact general-purpose models","policy":"eu-ai-act","source_reference":"Articles 51, 52 and 55","url":"https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk"},{"slug":"eu-ai-act-post-market-monitoring","title":"Operate a post-market monitoring system","policy":"eu-ai-act","source_reference":"Article 72","url":"https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring"},{"slug":"eu-ai-act-serious-incident-reporting","title":"Report serious incidents to market surveillance authorities","policy":"eu-ai-act","source_reference":"Article 73","url":"https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting"},{"slug":"eu-ai-act-importer-distributor-obligations","title":"Verify conformity before importing or distributing high-risk AI","policy":"eu-ai-act","source_reference":"Articles 23 and 24","url":"https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations"},{"slug":"eu-ai-act-art-16-provider-obligations","title":"Providers must meet the full set of provider duties for high-risk AI","policy":"eu-ai-act","source_reference":"Article 16","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations"},{"slug":"eu-ai-act-art-18-documentation-keeping","title":"Providers must keep high-risk AI documentation for ten years","policy":"eu-ai-act","source_reference":"Article 18","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping"},{"slug":"eu-ai-act-art-19-provider-log-retention","title":"Providers must retain automatically generated logs under their control","policy":"eu-ai-act","source_reference":"Article 19","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention"},{"slug":"eu-ai-act-art-20-corrective-actions-and-information","title":"Providers must take corrective action and inform the supply chain about non-conforming high-risk AI","policy":"eu-ai-act","source_reference":"Article 20","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information"},{"slug":"eu-ai-act-art-21-cooperation-with-authorities","title":"Providers must supply conformity evidence and log access to authorities on request","policy":"eu-ai-act","source_reference":"Article 21","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities"},{"slug":"eu-ai-act-art-22-authorised-representative","title":"Non-EU providers must appoint an EU authorised representative for high-risk AI","policy":"eu-ai-act","source_reference":"Article 22","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative"},{"slug":"eu-ai-act-art-25-value-chain-becoming-provider","title":"Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI","policy":"eu-ai-act","source_reference":"Article 25(1) and 25(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider"},{"slug":"eu-ai-act-art-25-4-written-agreements-with-component-suppliers","title":"Providers of high-risk AI must have written agreements with suppliers of components, tools and services","policy":"eu-ai-act","source_reference":"Article 25(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers"},{"slug":"eu-ai-act-art-6-4-non-high-risk-assessment-documentation","title":"Providers must document and register a conclusion that an Annex III system is not high-risk","policy":"eu-ai-act","source_reference":"Article 6(4); Article 49(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation"},{"slug":"eu-ai-act-art-26-4-deployer-input-data","title":"Deployers must ensure input data they control is relevant and representative","policy":"eu-ai-act","source_reference":"Article 26(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data"},{"slug":"eu-ai-act-art-26-5-deployer-monitoring-and-suspension","title":"Deployers must monitor high-risk AI, suspend use on risk and report serious incidents","policy":"eu-ai-act","source_reference":"Article 26(5)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension"},{"slug":"eu-ai-act-art-26-7-worker-information","title":"Employers must inform workers and their representatives before using high-risk AI at work","policy":"eu-ai-act","source_reference":"Article 26(7)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information"},{"slug":"eu-ai-act-art-26-8-public-authority-registration-before-use","title":"Public authorities must register their use of high-risk AI and must not use unregistered systems","policy":"eu-ai-act","source_reference":"Article 26(8); Article 49(3) and 49(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use"},{"slug":"eu-ai-act-art-26-9-dpia-using-provider-information","title":"Deployers must use the provider's transparency information in their data protection impact assessment","policy":"eu-ai-act","source_reference":"Article 26(9)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information"},{"slug":"eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation","title":"Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually","policy":"eu-ai-act","source_reference":"Article 26(10)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation"},{"slug":"eu-ai-act-art-26-11-notice-to-affected-persons","title":"Deployers must tell natural persons that a high-risk AI system is used in decisions about them","policy":"eu-ai-act","source_reference":"Article 26(11)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons"},{"slug":"eu-ai-act-art-50-2-synthetic-content-marking","title":"Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way","policy":"eu-ai-act","source_reference":"Article 50(2)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking"},{"slug":"eu-ai-act-art-50-3-emotion-recognition-notice","title":"Deployers of emotion recognition or biometric categorisation must inform exposed persons","policy":"eu-ai-act","source_reference":"Article 50(3)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice"},{"slug":"eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure","title":"Deployers must disclose deepfakes and AI-generated text published on matters of public interest","policy":"eu-ai-act","source_reference":"Article 50(4)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure"},{"slug":"eu-ai-act-art-52-systemic-risk-notification","title":"Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold","policy":"eu-ai-act","source_reference":"Article 52(1)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification"},{"slug":"eu-ai-act-art-53-gpai-technical-and-downstream-documentation","title":"Providers of GPAI models must maintain technical documentation and inform downstream providers","policy":"eu-ai-act","source_reference":"Article 53(1)(a) and 53(1)(b); Annexes XI and XII","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation"},{"slug":"eu-ai-act-art-54-gpai-authorised-representative","title":"Non-EU providers of GPAI models must appoint an EU authorised representative","policy":"eu-ai-act","source_reference":"Article 54","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-54-gpai-authorised-representative"},{"slug":"eu-ai-act-art-55-systemic-risk-incident-reporting","title":"Providers of systemic-risk GPAI models must track and report serious incidents to the AI Office","policy":"eu-ai-act","source_reference":"Article 55(1)(c)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-incident-reporting"},{"slug":"eu-ai-act-art-55-systemic-risk-cybersecurity","title":"Providers of systemic-risk GPAI models must secure the model and its infrastructure","policy":"eu-ai-act","source_reference":"Article 55(1)(d)","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-55-systemic-risk-cybersecurity"},{"slug":"eu-ai-act-art-86-right-to-explanation","title":"Deployers must explain individual decisions taken with high-risk AI on request","policy":"eu-ai-act","source_reference":"Article 86","url":"https://aipolicytracker.org/obligations/eu-ai-act-art-86-right-to-explanation"}],"versions":[{"version":4,"generated_at":"2026-10-08T05:30:01+00:00","dataset_version":"52bd836b1d6b","changelog":"Dataset 9710140e23e4 → 52bd836b1d6b.","stats":{"sheets":{"Classifier":0,"Tiers":6,"Dates":9,"Duties by role":44},"blocks":0,"headings":0,"citations":53}},{"version":3,"generated_at":"2026-10-06T05:30:00+00:00","dataset_version":"9710140e23e4","changelog":"Dataset 3335c39da4b7 → 9710140e23e4.","stats":{"sheets":{"Classifier":0,"Tiers":6,"Dates":9,"Duties by role":44},"blocks":0,"headings":0,"citations":53}},{"version":2,"generated_at":"2026-09-27T05:30:00+00:00","dataset_version":"3335c39da4b7","changelog":"Dataset 7c0835db52c1 → 3335c39da4b7. Sheet \"Dates\": 7 → 9 rows (+2). Record citations: 51 → 53.","stats":{"sheets":{"Classifier":0,"Tiers":6,"Dates":9,"Duties by role":44},"blocks":0,"headings":0,"citations":53}},{"version":1,"generated_at":"2026-09-26T13:11:02+00:00","dataset_version":"7c0835db52c1","changelog":"First version, built from dataset 7c0835db52c1.","stats":{"sheets":{"Classifier":0,"Tiers":6,"Dates":7,"Duties by role":44},"blocks":0,"headings":0,"citations":51}}]},"meta":{"license":"CC BY 4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","disclaimer":"This template is generated from the records on aipolicytracker.org. It is an informational resource, not legal advice, and completing it does not make an organisation compliant with any law or standard. Every row that cites a duty links to the record it came from; check the official source before relying on it."}}