Methodology

The EU AI Act defines risk tiers through explicit rules in Annex I (product safety), Annex III (high-risk use cases), and Article 5 (prohibited practices). Many first-pass classification branches can be represented as deterministic rules. However, intended purpose, Article 6(3), substantial modification, overlapping operator roles and factual ambiguity can require legal judgment.

We don't use AI to classify your system.Using an LLM to interpret legal text would introduce hallucination risk. Instead, we ask you structured questions and map your answers to the regulation's enumerated categories.

Our classification logic follows this order (implemented in lib/aiact/classify.ts):

1. Out-of-scope check:If you answer "no EU market exposure", classification stops. The Act doesn't apply. (Article 2 — territorial scope.)
2. Prohibited tier:If your answers match a prohibited-practice definition after applying its stated conditions and exceptions, the checker returns "prohibited" and recommends qualified review. (Article 5(1).)
3. High-risk tier:If you selected any Annex III use case (employment, credit scoring, education access, law enforcement, biometric ID, critical infrastructure, migration/asylum), result is "high-risk". Current deadline copy separates Annex III stand-alone systems from Annex I product-embedded systems because their application dates differ.
4. Limited-risk tier:If you selected any Article 50 transparency trigger (chatbot, emotion recognition for non-prohibited use, biometric categorization for non-prohibited use, synthetic content generation), result is "limited-risk". Transparency obligations apply.
5. Minimal-risk tier: No prohibited, Annex III or Article 50 trigger was identified from your answers. Providers and deployers may still have Article 4 AI-literacy duties, while other operator-specific duties and other laws may apply.

The Act contains judgment calls our tool can't make for you:

• Article 6(3) derogation:High-risk systems can be downgraded to non-high-risk if they perform a narrow procedural task, don't materially influence outcomes, and meet other conditions. This is a legal analysis we can't automate — when answers are ambiguous, we flag "review recommended".
• General-purpose vs narrow:Determining whether you "provide" a GPAI model under Article 3(44) requires understanding your distribution model and API terms. We ask a yes/no question, but the real answer might need counsel.
• Substantial modification:Article 43(4) says substantial modifications restart conformity obligations. We can't tell you whether a v2.0 release counts as "substantial" — that's context-specific.
• Provider vs deployer vs importer/distributor/authorised representative/product manufacturer: operator definitions overlap in complex supply chains. If you white-label someone else's model and rebrand it, are you a provider? Probably — but "probably" isn't compliance.

When our tool encounters these ambiguities (you selected multiple high-risk areas + transparency triggers, or your operator role creates supply-chain ambiguity), we set reviewRecommended: true in the result and tell you to consult qualified counsel. Company size is used only as a product heuristic for packaging and buyer-readiness context, not as a statutory classification rule.

Our classification logic is based on:

• Regulation (EU) 2024/1689 — the AI Act text as published in the Official Journal, 12 July 2024.
• Annexes I, III, IV, and recitals — the enumerated lists and explanatory context.
• Commission Q&A and guidance documents— when published, we incorporate clarifications that don't contradict the regulation itself.

We track regulatory developments and update the classification logic when the Commission issues binding guidance or when delegated acts amend the annexes. When we make changes, we'll note them on the /updates page.

Our tool is a self-assessment aid, not a legal service. We designed it this way on purpose:

• We don't collect enough information to render a binding opinion (we'd need to review your code, contracts, GDPR docs, risk assessments).
• We're not qualified to provide legal advice under any EU member state's bar rules.
• Even if we were, templated document generation isn't a substitute for bespoke legal work when stakes are high (prohibited practices, novel use cases, systems processing millions of decisions).

The output you get — classification tier + obligations + generated documents — is a starting point: a structured first draft with company-specific evidence gaps clearly marked. Reviewing those gaps, tailoring policies, and confirming edge-case classifications is where qualified counsel adds value.

Our classification function is open to inspection (not open-source, but viewable in dev tools):

1. Open the risk checker and complete it with your answers.
2. Open browser dev tools (F12) and look at the network tab for /checker requests.
3. The classification happens client-side — you can see the exact logic in the bundled JS.

If you spot a classification bug (we map an answer to the wrong tier, or cite the wrong article), email us at hello@trustpacket.app. We'll fix it and credit you if you want.