How do I know which risk tier my AI system falls into?

Classification depends on intended purpose, role, and deployment context, not just code. Article 6 defines high-risk routes and Article 50 creates specified transparency duties. A system with no detected elevated path is not automatically minimal risk or outside the Act. A code scanner reports indicators but cannot make the legal determination.

What is the Article 6(3) derogation for high-risk AI?

Article 6(3) allows a system listed in Annex III to be classified as non-high-risk if it performs a narrow procedural task, improves the result of a previously completed human activity, or is used for human decision support where the human decision is not bypassed. You must document this assessment. This is a self-assessment — it is not automatic, and the conditions are narrow.

When do the high-risk obligations start applying?

Regulation (EU) 2026/1744 is in force and sets 2 December 2027 for Annex III high-risk provisions and 2 August 2028 for the Annex I product-embedded path. Article 6 classification and transition rules must still be assessed in context.

Can a code scanner classify my AI system for me?

Not fully. A code scanner like Regula can detect risk indicators — AI library imports, pattern matches suggesting high-risk use cases, credential exposure, and agent autonomy markers. It can suggest a risk tier based on code patterns. It cannot determine if your system meets the significant risk threshold, assess your deployment context, verify Article 6(3) exemption applicability, or replace legal advice.

11 June 2026 · Kuziva Muzondo

How to Classify Your AI System Under the EU AI Act

Q: What are the Article 5 prohibitions under the EU AI Act?

Article 5 defines prohibited practices with conditions and exceptions. The original points have applied since 2 February 2025. Regulation (EU) 2026/1744 adds points 5(1)(ba) and 5(1)(bb), applying from 2 December 2026. Whether a system meets a prohibition requires the full legal test, not a code-pattern match.

Classification depends on your system’s intended purpose and deployment context, not just what the code does. Article 6 defines the routes. A code scanner like Regula can detect risk indicators but cannot make the Article 6 determination for you — that requires understanding how, where, and on whom your system is deployed.

The four risk tiers

The EU AI Act is commonly explained through four practical groupings: practices not permitted (Article 5), high-risk (Annex III use-based or Annex I product-embedded), systems subject to Article 50 transparency duties, and systems without an identified elevated risk-tier path. This shorthand is not a substitute for checking cross-cutting and context-dependent duties.

The EU AI Act sorts AI systems into four tiers. Your obligations depend entirely on which tier applies.

Practices not permitted (Article 5)

Article 5 defines prohibited practices with detailed conditions and exceptions. The original points have applied since 2 February 2025. Regulation (EU) 2026/1744 adds points 5(1)(ba) and 5(1)(bb), applying from 2 December 2026. A code-pattern match is not proof that the legal test is met.

High-risk: use-based (Annex III)

Annex III lists specified intended uses across eight areas. Classification requires the Article 6 test, including applicable exceptions and documentation duties; libraries alone cannot decide it. Regulation (EU) 2026/1744 sets 2 December 2027 for the Annex III path.

High-risk: product-embedded (Annex I)

AI systems that are safety components of, or are themselves, products covered by EU harmonisation legislation listed in Annex I — including medical devices, machinery, toys, lifts, and radio equipment. These follow the existing CE marking framework. Compliance deadline: 2 August 2028 (Digital Omnibus).

Limited risk (Article 50)

Systems with transparency obligations: chatbots that interact with people, systems generating synthetic content (deepfakes, AI-generated text or images), emotion recognition systems, and biometric categorisation systems. The obligation is disclosure, not the full high-risk conformity assessment. These obligations apply from 2 August 2026.

Minimal risk

This label is commonly used when no prohibited, high-risk, or Article 50 path is identified. It does not prove that the Act is inapplicable: Article 4, Article 5, role-specific duties, and other context-dependent provisions still need review. Article 95 provides for voluntary codes of conduct.

How Article 6 works

Article 6 is the gateway provision. It determines whether your Annex III system is actually high-risk by introducing a significant risk threshold. A system listed in Annex III is high-risk only if it poses a significant risk of harm to health, safety, or fundamental rights.

Article 6(3) provides a narrow derogation. An Annex III system is not high-risk if it:

Performs a narrow procedural task (e.g. converting unstructured data to structured data);
Improves the result of a previously completed human activity; or
Is intended for human decision support where the human decision is not bypassed or overridden by the AI output.

This is a self-assessment, not an automatic exemption. You must document why your system qualifies. The conditions are narrow and context-dependent — the same model used for different purposes can fall on different sides of this line. Context matters more than code.

What Regula can and cannot tell you

Regula can detect risk indicators in your code — AI library imports, pattern matches suggesting high-risk use cases, credential exposure, and agent autonomy markers — and suggest a risk tier. It cannot determine whether your system meets the Article 6 significant risk threshold, assess your deployment context, or replace legal advice. The code scan is a starting point, not a legal determination.

Regula is a code scanner. It reads your source code and matches patterns. That is useful, but it has clear boundaries.

Regula can	Regula cannot
Detect risk indicators in your code (AI library imports, pattern matches, credential exposure, agent autonomy markers)	Determine if your system meets the Article 6 “significant risk” threshold
Classify your risk tier based on code patterns	Assess your deployment context (who uses it, where, on whom)
Flag gaps in your technical documentation	Verify Article 6(3) exemption applicability
Generate an evidence pack for your compliance file	Replace legal advice

The code-level scan is a starting point. It narrows the field. It does not make the legal determination.

Practical steps

To prepare a contextual human review, run three Regula commands in sequence: regula assess to record intended purpose and deployment context, regula check . to scan for code-observable indicators, and regula gap . to identify documentation evidence for review. These outputs do not determine legal classification, compliance, or applicable obligations.

Start with the guided assessment, then scan your code, then check for gaps:

# 1. Guided assessment: 5 questions, no code needed
regula assess

# 2. Scan your codebase for risk indicators
regula check .

# 3. Check for compliance gaps against the Act
regula gap .

regula assess records intended-purpose and deployment answers and reports candidate paths for review. regula check reports source-code indicators, and regula gap compares observable evidence with selected controls. None determines a legal tier, applicable obligations, or compliance gaps conclusively.

Omnibus status

The dates stated here come from Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. The provisional agreement of 7 May 2026 is legislative history, not the current legal basis.

Last reviewed: 14 August 2026 · Author: Kuziva Muzondo · Sources: Regulation (EU) 2024/1689, Digital Omnibus provisional agreement (7 May 2026) · Not legal advice. Regula identifies risk indicators for developer review.