# EU AI Act Role and Risk Classifier

- **Type**: Template (Checklist)
- **Page**: https://aipolicytracker.org/templates/eu-ai-act-role-risk-classifier
- **Formats**: XLSX
- **Current version**: v4, built 2026-10-08

Answer six questions per system and the sheet returns the role, the risk tier and the date its duties apply, looked up from the dated milestones on the EU AI Act record.

## What is inside

- Classifier sheet: role, Annex III area, prohibited practice, safety component, GPAI and systemic-risk questions as dropdowns; tier and application date as formulas
- Dates sheet: every dated milestone on the EU AI Act record, with status and confidence
- Duties sheet: every recorded EU AI Act duty by role, with article reference

## Laws and frameworks it is built from

- EU AI Act (European Union), Pending review · source-linked, checked 26 Sep 2026: https://aipolicytracker.org/policies/eu-ai-act

## Recorded duties it covers

- Do not deploy or provide AI for prohibited practices (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-prohibited-practices
- Ensure AI literacy of staff operating AI systems (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-ai-literacy
- Establish a risk management system for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system
- Apply data governance and quality criteria to training, validation and testing data (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-data-governance
- Draw up technical documentation before placing a high-risk system on the market (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-technical-documentation
- Design high-risk systems to log events automatically (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-record-keeping
- Provide deployers with clear instructions for use (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-to-deployers
- Enable and assign effective human oversight (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-human-oversight
- Achieve appropriate accuracy, robustness and cybersecurity (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-accuracy-robustness-cybersecurity
- Operate a quality management system (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-quality-management-system
- Complete conformity assessment, CE marking and EU database registration (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-conformity-assessment-registration
- Use high-risk AI as instructed, monitor it and inform affected people (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-deployer-obligations
- Carry out a fundamental rights impact assessment before deployment (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-fundamental-rights-impact-assessment
- Disclose AI interaction and label synthetic content (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-transparency-article-50
- Meet general-purpose AI model provider obligations (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-gpai-provider-obligations
- Manage systemic risk for high-impact general-purpose models (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-gpai-systemic-risk
- Operate a post-market monitoring system (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-post-market-monitoring
- Report serious incidents to market surveillance authorities (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-serious-incident-reporting
- Verify conformity before importing or distributing high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-importer-distributor-obligations
- Providers must meet the full set of provider duties for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-16-provider-obligations
- Providers must keep high-risk AI documentation for ten years (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-18-documentation-keeping
- Providers must retain automatically generated logs under their control (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-19-provider-log-retention
- Providers must take corrective action and inform the supply chain about non-conforming high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-20-corrective-actions-and-information
- Providers must supply conformity evidence and log access to authorities on request (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-21-cooperation-with-authorities
- Non-EU providers must appoint an EU authorised representative for high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-22-authorised-representative
- Deployers, distributors and importers must assume provider duties when they rebrand or substantially modify high-risk AI (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-25-value-chain-becoming-provider
- Providers of high-risk AI must have written agreements with suppliers of components, tools and services (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-25-4-written-agreements-with-component-suppliers
- Providers must document and register a conclusion that an Annex III system is not high-risk (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-6-4-non-high-risk-assessment-documentation
- Deployers must ensure input data they control is relevant and representative (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-4-deployer-input-data
- Deployers must monitor high-risk AI, suspend use on risk and report serious incidents (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-5-deployer-monitoring-and-suspension
- Employers must inform workers and their representatives before using high-risk AI at work (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-7-worker-information
- Public authorities must register their use of high-risk AI and must not use unregistered systems (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-8-public-authority-registration-before-use
- Deployers must use the provider's transparency information in their data protection impact assessment (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-9-dpia-using-provider-information
- Law-enforcement deployers must obtain authorisation for post-remote biometric identification and report annually (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-10-post-remote-biometric-identification-authorisation
- Deployers must tell natural persons that a high-risk AI system is used in decisions about them (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-26-11-notice-to-affected-persons
- Providers of generative AI must mark synthetic output as artificially generated in a machine-readable way (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-2-synthetic-content-marking
- Deployers of emotion recognition or biometric categorisation must inform exposed persons (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-3-emotion-recognition-notice
- Deployers must disclose deepfakes and AI-generated text published on matters of public interest (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-50-4-deepfake-and-public-interest-text-disclosure
- Providers of GPAI models must notify the Commission within two weeks of meeting the systemic-risk threshold (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-52-systemic-risk-notification
- Providers of GPAI models must maintain technical documentation and inform downstream providers (EU AI Act): https://aipolicytracker.org/obligations/eu-ai-act-art-53-gpai-technical-and-downstream-documentation

## Latest changes

Dataset 9710140e23e4 → 52bd836b1d6b.

- **Retrieved**: 2026-11-12
- **Licence**: https://creativecommons.org/licenses/by/4.0/

> Built from structured summaries of official texts. Not legal advice. A record whose review status is not "verified" has not been confirmed against its official source by a named reviewer; open the official source before relying on any date or duty. How records are verified: https://aipolicytracker.org/verification.