Is your AI system
High-Risk under the EU AI Act?

August 2, 2026 is the primary enforcement date for Annex III high-risk AI systems. By this date, systems in employment, finance, biometrics, critical infrastructure, and other Annex III categories must have completed Annex IV technical documentation, conformity assessment, CE marking, and registration in the EU AI Act database. Market surveillance authorities begin active enforcement.

Yes. If your SaaS processes EU individuals' data for risk-based decisions — like resume screening, loan approval, insurance pricing, or performance evaluation — you are likely a 'Provider' under the Act. As a provider you bear the full Annex III compliance burden: documentation, risk management, human oversight, conformity assessment, and registration.

Yes. The Act has extra-territorial reach and applies to any provider placing AI on the EU market or whose AI produces outputs used in the EU — regardless of where the company is established. Non-EU providers must also designate an EU Authorised Representative before market placement.

Even if a system falls within an Annex III category, it is not considered high-risk if it performs a narrow procedural task, improves the result of a previously completed human activity, or performs only a preparatory task to a human decision — provided it poses no significant risk to health, safety, or fundamental rights. This exception requires careful legal analysis and must be documented.

No. This tool and the report provide structured compliance guidance based on the EU AI Act as of March 2026, but do not constitute legal advice. For binding classification opinions, conformity assessment sign-off, or regulatory submissions, engage qualified EU AI Act legal counsel.

Yes. The download link on the success page is tied to your Stripe payment session and can be used to re-download your report. Bookmark the success page URL after purchase.

If your AI system undergoes a 'substantial modification' — a change affecting compliance or the intended purpose — a new conformity assessment is required under the Act. The report includes guidance on what constitutes a substantial modification and how to handle change management.

Deployers (organisations using AI in a professional context) have secondary obligations under the Act: monitoring the system per provider instructions, ensuring human oversight, and reporting serious incidents. The report covers deployer obligations in the conformity and post-market sections.