2–3 minute check: is your AI use case likely high-risk under the EU AI Act?

Does the AI influence decisions about a person or their rights/benefits?

This is the strongest separator for likely high‑risk use cases.

In which area does this system operate? (select 1–2)

Roughly mapped to Annex III categories for high‑risk AI systems.

Do you use biometrics / facial recognition / identification / emotion recognition?

Is the AI a “safety component” of a regulated product (e.g. medical, automotive, aviation)?

Does the system run in an enterprise / regulated environment where customers expect evidence (SOC 2 / ISO / vendor questionnaires)?

Does the end user interact directly with the AI (chat/agent) or see AI‑generated content that could look human?

Does the AI operate on sensitive data (health, biometrics, children, political views) or large‑scale personal data?

Do model / prompt / tool versions change frequently (e.g. weekly) without a formal change process?

Do you have monitoring and logs (who/when/what was generated/changed) plus a basic incident response process?