EU AI Act Role and Risk Classifier
Using this in a product? Commercial use is allowed under CC BY 4.0, with attribution. Ask about an SLA-backed feed or a white-label licence.
On this page 7 sections
In brief
The EU AI Act Role and Risk Classifier is a free XLSX checklist for EU AI Act. Answer six questions per system and the sheet returns the role, the risk tier and the date its duties apply, looked up from the dated milestones on the EU AI Act record. It is licensed CC BY 4.0 and is not legal advice.
- Format
- XLSX · Checklist
- Version
- v4, built 8 Oct 2026
- Duties cited
- 44 from 1 instruments
- Rows from the records
- 59
- Frameworks
- EU AI Act
- Written for
- Provider / developer, Deployer / user organisation, Public authority / government body
- Price and licence
- Free · CC BY 4.0
What's inside
- Classifier sheet: role, Annex III area, prohibited practice, safety component, GPAI and systemic-risk questions as dropdowns; tier and application date as formulas
- Dates sheet: every dated milestone on the EU AI Act record, with status and confidence
- Duties sheet: every recorded EU AI Act duty by role, with article reference
Dates: Dates are as recorded on the build date. EU AI Act: Dates below follow Article 113 as amended by Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), published in the Official Journal on 24 July 2026 and in force from 27 July 2026: the Chapter III high-risk obligations now apply from 2 December 2027 for stand-alone Annex III systems and from 2 August 2028 for AI embedded in Annex I products, while general application and the Article 50 transparency duties kept 2 August 2026. Recorded on 26 September 2026 from concordant secondary reporting; the amending regulation itself has not yet been read against the Official Journal by a reviewer here, so these dates are pending review.
Preview
The sheets and sections of version v4, as built. Columns marked ▾ have a dropdown; ƒ is a formula.
Sheet: Classifier
| System | Your role ▾ | Annex III area (use case) ▾ | A prohibited practice? ▾ | Safety component of a regulated product (Annex I)? ▾ | A general-purpose AI model? ▾ | With systemic risk? ▾ | Risk tier ƒ | Duties apply from ƒ | Notes |
|---|---|---|---|---|---|---|---|---|---|
| Rows are yours to fill; the dropdowns, formulas and colour rules are already in place. | |||||||||
A first-pass classification from six questions. The Act's definitions have exceptions the sheet cannot ask about; confirm each high-risk or prohibited result against the record and the official text.
Sheet: Tiers
| Tier | Duties apply from | Milestone on the record |
|---|---|---|
| Prohibited | 2025-02-02 | Prohibited practices milestone |
| High-risk | 2027-12-02 | Annex III high-risk milestone |
| High-risk (Annex I product) | 2027-12-02 | Annex I safety-component milestone |
| GPAI | 2025-08-02 | General-purpose AI milestone |
| GPAI with systemic risk | 2025-08-02 | General-purpose AI milestone |
| Minimal or limited risk | 2026-08-02 | Article 50 transparency milestone |
The record notes: Dates below follow Article 113 as amended by Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), published in the Official Journal on 24 July 2026 and in force from 27 July 2026: the Chapter III high-risk obligations now apply from 2 December 2027 for stand-alone Annex III systems and from 2 August 2028 for AI embedded in Annex I products, while general application and the Article 50 transparency duties kept 2 August 2026. Recorded on 26 September 2026 from concordant secondary reporting; the amending regulation itself has not yet been read against the Official Journal by a reviewer here, so these dates are pending review.
Sheet: Dates
| Date | Milestone | Instrument | Jurisdiction | Source reference | Status | Confidence | Note | Record |
|---|---|---|---|---|---|---|---|---|
| 2024-08-01 | Entry into force | EU AI Act | European Union | Article 113 | passed | high | Twentieth day after publication in the Official Journal. | https://aipolicytracker.org/policies/eu-ai-act |
| 2025-02-02 | Prohibited practices and AI literacy apply (Chapters I and II) | EU AI Act | European Union | Article 113(a) | passed | high | Article 5 bans and Article 4 literacy duties apply. | https://aipolicytracker.org/policies/eu-ai-act |
| 2025-08-02 | General-purpose AI, governance, notified bodies and penalties apply | EU AI Act | European Union | Article 113(b) | passed | high | Chapter V (GPAI models), Chapter III Section 4, Chapter VII, Chapter XII (except Article 101) and Article 78 apply. | https://aipolicytracker.org/policies/eu-ai-act |
| 2026-08-02 | General application and Article 50 transparency duties | EU AI Act | European Union | Article 113, as amended by Regulation (EU) 2026/1744 | passed | medium | Default application date for the remainder of the Regulation. Regulation (EU) 2026/1744 did not move this date or the Article 50 transparency duties, according | https://aipolicytracker.org/policies/eu-ai-act |
| 2026-12-02 | Two further Article 5 prohibitions apply (non-consensual intimate imagery and child sexual abuse material generation) | EU AI Act | European Union | Regulation (EU) 2026/1744 amending Articles 5 and 113 | scheduled | medium | Added by Regulation (EU) 2026/1744. Recorded from secondary reporting; confirm the exact wording and date against the Official Journal. | https://aipolicytracker.org/policies/eu-ai-act |
| 2027-08-02 | General-purpose models placed on the market before 2 August 2025 must comply | EU AI Act | European Union | Article 111(3) | scheduled | medium | Transitional period for models already on the market. | https://aipolicytracker.org/policies/eu-ai-act |
Sheet: Duties by role
| Duty | Category | Instrument | Jurisdiction | Who it binds | Nature | Source reference | Applies from | What it requires | Evidence a reviewer expects | ISO/IEC 42001 | NIST AI RMF | Verification | Record |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Do not deploy or provide AI for prohibited practices | Prohibited practices | EU AI Act | European Union | Provider / developer, Deployer / user organisation, Public authority / government body | Legal requirement | Article 5 | 2025-02-02 | Article 5 bans placing on the market, putting into service or using AI for listed practices, including subliminal or manipulative techniques that cause signific | Prohibited-practice screening record; AI system inventory | Clause 6.1.2 and Annex A control on AI system impact assessment | GOVERN 1.1, MAP 1.1 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices |
| Ensure AI literacy of staff operating AI systems | AI literacy and training | EU AI Act | European Union | Provider / developer, Deployer / user organisation | Legal requirement | Article 4 | 2025-02-02 | Providers and deployers must take measures to ensure, to their best extent, a sufficient level of AI literacy among their staff and other persons dealing with t | AI literacy training programme | Clause 7.2 Competence and 7.3 Awareness | GOVERN 2.2 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy |
| Establish a risk management system for high-risk AI | AI risk management | EU AI Act | European Union | Provider / developer | Legal requirement | Article 9 | 2027-12-02 | Providers of high-risk AI systems must establish, implement, document and maintain a continuous, iterative risk-management system across the system's lifecycle: | Risk register and treatment plan; Pre-market test reports | Clauses 6.1.2, 6.1.3, 8.2, 8.3 and Annex A controls on AI risk | MAP, MEASURE and MANAGE functions | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system |
| Apply data governance and quality criteria to training, validation and testing data | Data governance and quality | EU AI Act | European Union | Provider / developer | Legal requirement | Article 10 | 2027-12-02 | High-risk AI systems that use data-driven techniques must be developed on training, validation and testing data sets meeting quality criteria: appropriate gover | Dataset documentation (datasheet); Bias examination report | Annex A controls on data for AI systems | MAP 2.3, MEASURE 2.1, MEASURE 2.11 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-data-governance |
| Draw up technical documentation before placing a high-risk system on the market | Technical documentation | EU AI Act | European Union | Provider / developer | Legal requirement | Article 11 and Annex IV | 2027-12-02 | Technical documentation must be drawn up before a high-risk system is placed on the market or put into service and kept up to date. It must demonstrate complian | Annex IV technical file | Clause 7.5 Documented information; Annex A control on system documentation | GOVERN 1.4, MAP 3.x | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation |
| Design high-risk systems to log events automatically | Record keeping and logging | EU AI Act | European Union | Provider / developer, Deployer / user organisation | Legal requirement | Article 12; Article 26(6) for deployers | 2027-12-02 | High-risk AI systems must technically allow automatic recording of events (logs) over their lifetime to support traceability, post-market monitoring and operati | Logging specification and retention policy | Annex A control on event logging | MEASURE 2.x, MANAGE 4.1 | Pending review · source-linked | https://aipolicytracker.org/obligations/eu-ai-act-record-keeping |
How to use it
- 1Request the files. Enter your name, company and work email in the form on this page. The XLSX download links arrive by email and work for 7 days.
- 2Read the README page. It states the version (v4), the dataset it was built from and the licence, so anyone reviewing your copy knows which records it reflects.
- 3Fill in your rows. Complete the "Classifier" sheet for your own systems. Dropdowns, formulas and colour rules are already set.
- 4Check the duties against your situation. The "Tiers", "Dates" and "Duties by role" sheets list the recorded duties with their source references. Mark which apply to you and follow each link to the official text.
- 5Keep the evidence and watch for new versions. Link each completed row to the evidence that supports it. When the law on record changes, this template gets a new version and a changelog on this page.
Duties this template covers (44)
Each is cited in the file with its source reference and a link back to the record.
- Do not deploy or provide AI for prohibited practices
- Ensure AI literacy of staff operating AI systems
- Establish a risk management system for high-risk AI
- Apply data governance and quality criteria to training, validation and testing data
- Draw up technical documentation before placing a high-risk system on the market
- Design high-risk systems to log events automatically
- Provide deployers with clear instructions for use
- Enable and assign effective human oversight
- Achieve appropriate accuracy, robustness and cybersecurity
- Operate a quality management system
- Complete conformity assessment, CE marking and EU database registration
- Use high-risk AI as instructed, monitor it and inform affected people
Legal basis
Version history
| Version | Built | Dataset | What changed |
|---|---|---|---|
| v4 | 52bd836b1d6b | Dataset 9710140e23e4 → 52bd836b1d6b. | |
| v3 | 9710140e23e4 | Dataset 3335c39da4b7 → 9710140e23e4. | |
| v2 | 3335c39da4b7 | Dataset 7c0835db52c1 → 3335c39da4b7. Sheet "Dates": 7 → 9 rows (+2). Record citations: 51 → 53. | |
| v1 | 7c0835db52c1 | First version, built from dataset 7c0835db52c1. |
Only the latest version is served. A rebuild that changes the content adds a version; a rebuild that does not is skipped.
Frequently asked questions
What is in the EU AI Act Role and Risk Classifier?
Classifier sheet: role, Annex III area, prohibited practice, safety component, GPAI and systemic-risk questions as dropdowns; tier and application date as formulas. Dates sheet: every dated milestone on the EU AI Act record, with status and confidence. Duties sheet: every recorded EU AI Act duty by role, with article reference.
Which duties does it cite?
44 recorded duties from EU AI Act, including Article 5, Article 4, Article 9, Article 10, Article 11 and Annex IV and Article 12; Article 26(6) for deployers. Each row links to the record, and the record to the official source.
Who is it for?
The duties it cites fall on provider / developer, deployer / user organisation and public authority / government body. Whoever owns AI governance for those roles usually completes it, with the system owner supplying the facts.
Is it free?
Yes. Request the XLSX with your work email on this page; the download links arrive by email, valid for 7 days. No account and no charge. Licensed CC BY 4.0. You may use, adapt and share this template, including commercially, with attribution to aipolicytracker.org.
How will I know when it changes?
Version v4 was built on 8 October 2026. The library is rebuilt daily; when a change to the records reaches this template it gets the next version, a changelog below and an entry in the templates feed.
Are the dates in it current?
Dates are as recorded on the build date. EU AI Act: Dates below follow Article 113 as amended by Regulation (EU) 2026/1744 (the "Digital Omnibus on AI"), published in the Official Journal on 24 July 2026 and in force from 27 July 2026: the Chapter III high-risk obligations now apply from 2 December 2027 for stand-alone Annex III systems and from 2 August 2028 for AI embedded in Annex I products, while general application and the Article 50 transparency duties kept 2 August 2026. Recorded on 26 September 2026 from concordant secondary reporting; the amending regulation itself has not yet been read against the Official Journal by a reviewer here, so these dates are pending review.
Is there a self-assessment that goes with it?
Yes: the AI System Risk Classification Assessment (21 questions, about 6 minutes). It is free and runs on Certifyi, a related product. A score is a self-check, not an audit; this template is where the work it points to gets written down.
Does completing it make us compliant?
No. It is an informational resource, not legal advice; it helps produce the evidence a regulator, customer or auditor asks for. Whether a duty applies to you is a judgement the template cannot make.
Disclaimer: informational only, not legal advice. Verify every claim against the linked official sources and consult a qualified lawyer before acting.