Chapter 1 of 7 · 5 checks · 3 min
Scope and your role
Before any obligation, work out whether the Act reaches your systems and in what role. Providers and deployers carry very different duties, and one company can be both.
Keep an inventory of every AI system and model you build, buy or useMust
Why it matters and how to check
You cannot classify what you have not listed. Record each AI feature, internal tool and third-party AI service: what it does, who uses it, which model or vendor sits behind it, which countries its users or outputs reach, and who owns it. Include AI inside bought software when your team configures or relies on it for decisions about people.
To verify, pick three products or internal workflows at random and trace every model call in them. Each one should map to a row in the inventory with an owner and a last-reviewed date. Anything you find that is not listed is a gap to fix before classifying.
Check whether the Act reaches you, including when only the output is used in the EUMust
Why it matters and how to check
Article 2(1) applies the Act to providers placing AI systems or general-purpose AI models on the EU market whether they are established in the EU or not, to deployers established or located in the EU, and to providers and deployers in a third country where the output of the AI system is used in the EU. A team outside Europe serving EU customers is usually in scope.
To verify, for each inventory row record yes or no for: placed on the EU market, deployer in the EU, output used in the EU. Note the evidence, such as EU customers in billing data or EU traffic in analytics. Any yes means the rest of this checklist applies to that system.
Record for each system whether you are the provider, the deployer or bothMust
Why it matters and how to check
Broadly, the provider develops an AI system or model, or has it developed, and places it on the market or puts it into service under its own name. The deployer uses an AI system under its authority in a professional activity. If you build a hiring assistant on a vendor model and sell it, you are the provider of that system; if you also use it on your own candidates, you are its deployer too. The vendor stays the provider of the underlying model.
To verify, add a role column to the inventory and have the owner of each system confirm it. Where the answer depends on contract terms, attach the contract clause.
Know the changes that turn a deployer or reseller into a providerMust
Why it matters and how to check
Article 25(1) says a distributor, importer, deployer or other third party becomes the provider of a high-risk AI system, with the provider duties, if they put their own name or trademark on it, make a substantial modification to a high-risk system so it stays high-risk, or change the intended purpose of a system, including a general-purpose one, so that it becomes high-risk.
The third case catches many teams: wiring a general chatbot into candidate screening changes its purpose into an Annex III use. To verify, add a step to your product review template that asks whether the change rebrands, substantially modifies or repurposes an AI system, and requires a classification review when the answer is yes.
Apply exclusions only where the text clearly covers you, and write down whyShould
Why it matters and how to check
Article 2 excludes, among others, AI used exclusively for military, defence or national security purposes, AI developed and put into service solely for scientific research and development, research and testing before a system is placed on the market (testing in real-world conditions is not covered by that exclusion), and natural persons using AI in a purely personal, non-professional activity. Free and open-source systems are excluded unless placed on the market as high-risk or falling under Article 5 or 50.
To verify, any system marked out of scope should have a written reason that names the paragraph relied on and has been reviewed by counsel. "It is only a beta" is not an exclusion once real users outside your team use it.