AI Risk Assessor
Classify your AI system under the EU AI Act's risk framework by answering questions about its use case, autonomy level, and deployment context — and get a summary of applicable obligations.
Tool details
About this tool
Classify an AI system under the EU AI Act's four risk tiers and get a summary of applicable obligations. Covers deployer, provider and importer roles plus the GPAI model-level duties.
What you'll get
- A risk tier for the described system (Prohibited / High-Risk / Limited / Minimal).
- The specific obligations for your role (provider, deployer, importer).
- GPAI model duties when the system builds on a foundation model.
How it works
- The classifier walks the EU AI Act decision tree: Annex II safety-component triggers, Annex III use-case triggers, Article 50 transparency triggers.
- Each 'yes' narrows the tier; the final tier is the highest triggered.
- The duties list is drawn from the applicable Chapter and the EDPS/EDPB joint guidance where the AI Act overlaps GDPR.
Based on
- Regulation (EU) 2024/1689 (the EU AI Act).
- AI Office interpretive guidance on GPAI models.
- EDPS/EDPB joint opinion on GDPR + AI Act interaction.
What is the primary purpose of your AI system?
The EU AI Act categorises systems by their deployment context and potential harm.
Frequently asked questions
What counts as a 'high-risk' AI system?+
Systems used as safety components for products in Annex II or deployed in the Annex III use cases (biometric categorisation, critical infrastructure, education access, employment, essential services, law enforcement, migration, administration of justice).
Does the quiz cover GPAI model duties?+
Yes, when the described system is built on or includes a general-purpose AI model, the quiz surfaces the Article 50 model-level duties (technical documentation, copyright policy, training data summary) separately.
What is a 'deployer' vs 'provider'?+
The provider is who places the system on the EU market under their own name. The deployer uses the system under their own authority. One organisation can wear both hats if it builds and uses the same system.
What is the FRIA?+
A Fundamental Rights Impact Assessment, required for high-risk deployers in the public sector and some private-sector use cases. It overlaps with the GDPR DPIA — most organisations run them together.
Need more than a free tool?
TruePrivacy is a full privacy operations platform. Automate DSRs, consent, vendor risk, and breach response.
Free 14-day trial · No credit card required · Setup in minutes