AI Act initial check

AI Act initial check for businesses

Get a preliminary view of whether your AI system may trigger stop-check, high-risk, GPAI, transparency or governance obligations. The checker structures role, area of use, impact on individuals, prohibited practices, model involvement and interfaces with data protection, product law, the Data Act, the CRA, contracts and documentation.

Important: The check does not replace an individual legal review by a lawyer. It classifies your answers and prepares an enquiry.

Start the check

AI Act Providers & deployers High-risk AI GPAI Transparency AI governance

What this initial check is for

The check helps companies, start-ups, agencies, platform operators, SaaS/cloud providers and decision-makers prepare an AI project in a structured way: role, risk class, red lines, documents, deadlines and governance needs.

Preliminary editorial classification based on risk signals and AI Act roles.
Notes on prohibited practices, high-risk constellations, transparency and GPAI.
Concrete next review points and a document list for an enquiry to ITMR.
No substitute for an individual legal review.

Risk pass

AI Act review gates: from stop-check to governance

The visualisation is built as an interactive AI risk pass. Select a review gate or let the questionnaire highlight the matching gate based on the result.

AI risk pass Starting point: describe the AI system and determine the role.

After the questionnaire, the preliminary risk level is reflected here. The review gates can also be clicked manually.

Active review gate

Stop-check before rollout

First check whether a prohibited practice or a particularly critical constellation may be involved.

Rule out manipulation, exploitation of vulnerability or social scoring.
Review biometrics, emotion recognition and law enforcement contexts separately.
No productive use, promotion or expansion until clarified.

Orientation

How the AI Act initial classification works

Determine the role

Providers, deployers, integrators, importers, distributors or product manufacturers can have different obligations.

Define the use case

What matters is the intended purpose, user groups, data, output and actual context of use.

Check red flags

Prohibited practices and sensitive areas are checked first, before product or rollout questions are explored in depth.

Classify the risk class

High risk, GPAI, transparency obligations and ordinary governance obligations are considered separately.

Prepare evidence

AI inventory, risk assessment, data protection review, vendor documents and training are made ready for documentation.

Scope

What this check does

The AI Act initial check is a structured pre-filter. It does not replace a legal assessment of the individual case, but it helps bundle the relevant questions for providers, deployers and integrators and identify typical follow-up reviews. How we then translate the classification into obligations, governance and documentation is shown on our page Implementing the AI Act; an overview of all AI law questions is provided by AI law at ITMR.

It identifies typical signals for prohibited practices, high-risk AI, GPAI and transparency obligations.
It takes into account governance building blocks such as an AI inventory, AI literacy, human oversight, vendor review and documentation.
It points out interfaces with the GDPR/DPIA, copyright, trade secrets, the Data Act, the CRA, product liability, the DSA and contracts.
It generates a copyable short summary for the enquiry.

What does this AI Act initial check cover?

The check asks about role, AI function, area of use, impact on individuals, red flags, transparency signals, GPAI aspects and existing governance building blocks. The result is a preliminary risk classification with next review points.

Does a high result automatically mean high-risk AI?

No. A high result means that an in-depth review is advisable. Whether an AI system actually qualifies as high-risk AI depends on its intended purpose, specific use, the company's role, exceptions and the deadlines under Regulation (EU) 2026/1744.

Which AI Act obligations are particularly relevant in the near term?

Prohibited practices, AI literacy, GPAI, transparency and high-risk questions must be considered separately. Since the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 27.07.2026), fixed dates apply: new prohibitions under Art. 5 from 02.12.2026, high-risk AI under Annex III from 02.12.2027, under Annex I from 02.08.2028. In addition, Art. 50 AI Act has applied since 02.08.2026; providers of AI systems that generate synthetic audio, image, video or text content and were placed on the market before 02.08.2026 must implement the labelling under Art. 50(2) by 02.12.2026 (Art. 111(4)).

What relief does the Digital Omnibus bring for SMEs and SMCs?

Regulation (EU) 2026/1744 extends relief to SMEs including start-ups and in part to small mid-caps (SMCs): simplified quality management for SMEs (Art. 63(1)), simplified technical documentation for SMEs and SMCs (Art. 11(1)), a fine cap based on the lower amount for SMCs for infringements under Art. 99(4) and (5) (Art. 99(6a)), and priority access to the AI Office's regulatory sandbox (Art. 57(3a)). Whether your company qualifies as an SME or SMC must be assessed separately.

Which documents should be prepared?

Helpful are a system description, purpose, user groups, data flows, vendor documents, contracts, screenshots, output examples, data protection documents, risk analysis, training concept and planned go-live.

Interactive initial check

Which AI Act obligations could affect your AI system?

Answer the questions as the project is currently planned. If unsure, choose the more cautious answer or select “None or unclear” where offered.

Step 1 of 6

1. What role does your company have? ProviderYou develop, train, configure or place an AI system on the market under your own name. DeployerYou use an AI system within your company or towards customers, employees or users. Integrator / Downstream ProviderYou integrate a third-party model or tool into your own product, SaaS offering or customer project. Importer, distributor or product manufacturerYou distribute, import or integrate AI into a regulated product or a safety component. Internal pilot / test phaseThe system is being tested or evaluated internally or prepared for a later rollout.

2. Which AI function is central? Chatbot, assistant or automated communicationPeople interact directly with the AI system, for example in support, advice, sales or HR. Generation of text, images, audio, code or videoThe system generates synthetic content, marketing material, images, voices, videos, texts or code. Assessment, recommendation or decision supportThe system assesses people, risks, applications, requests, performance, content or behaviour. Internal process automationThe system supports research, documentation, knowledge management, support or back-office processes. General-purpose AI model / foundation modelYou train, publish, fine-tune or provide a model that can be used for many purposes. AI as a product or safety componentAI is part of a product, device, system or safety-relevant function.

4. Are there critical AI Act red flags?

Tick everything that might possibly apply.

Manipulative, deceptive or subliminal influencing of people. Exploitation of age, disability or social or economic vulnerability. Social scoring or evaluation of people across several areas of life. Prediction of criminal behaviour based solely on profiling or personality traits. Building or expanding facial recognition databases through untargeted scraping. Emotion recognition in the workplace or in educational institutions. Biometric categorisation to infer sensitive characteristics. Real-time remote identification in public spaces, particularly in a law enforcement context. None of these red flags is apparent or currently known.

6. Which governance building blocks are already in place? An AI inventory or overview of all AI systems used or offered exists. Purpose, user groups, data flows, model/tool origin and responsibilities are documented. Risk analysis, data protection review, DPIA or comparable impact assessment carried out. Human oversight, escalation, override and error management are regulated. Contracts, vendor information, DPA, terms of use and technical documentation reviewed. AI literacy, training or an internal AI policy exists and is documented (measures under Art. 4). No reliable governance building blocks in place, or unclear.

Deadlines & interfaces

Typical AI Act risks, deadlines and measures

Editorial status: 24.10.2026. The deadlines follow Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27.07.2026); guidelines, standards and national supervisory practice supplement them.

Review area	Classification	Typical measure
Prohibited practices	Stop-check for Art. 5 constellations such as certain manipulative, biometric or social scoring cases.	Block or redesign the use case, legal review, document management approval.
AI literacy	Training and capacity building are an early governance building block for organisations using AI. Under Art. 4 as amended by Regulation (EU) 2026/1744, providers and deployers must take measures to promote the AI literacy of their staff; a specific level of competence of individual persons does not have to be guaranteed. The Commission and Member States provide support, particularly for SMEs.	Document the training concept, AI policy, evidence and role responsibilities.
GPAI	For general-purpose AI models, provider, documentation, copyright and transparency obligations must be reviewed separately.	Review model documentation, training data summary, copyright policy and vendor clauses.
Transparency (Art. 50)	Art. 50 has applied since 02.08.2026 to chatbots, synthetic content, deepfakes and certain emotion recognition. For generative systems placed on the market before 02.08.2026, the transition period for labelling under Art. 50(2) ends on 02.12.2026.	Implement and document notices, machine-readable labelling and deepfake disclosure.
High-risk AI under Annex III	HR, education, essential services, biometrics, critical infrastructure and public authority contexts particularly require review.	Prepare risk management, data quality, technical documentation, logging, human oversight, robustness and cybersecurity.
Product-integrated high-risk AI	For AI in regulated products, safety components, software or digital elements, longer phase-in periods and product law may apply.	Align conformity assessment, CE/product documents, SBOM, secure SDLC, update policy and liability documentation.
GDPR / DPIA	Personal data, employee data, profiling or sensitive data can trigger an in-depth data protection review.	Review legal bases, RoPA, DPA, TOMs, DPIA, data subject information and deletion concept.
Data Act / CRA / DSA	Connected products, cloud, product data, software, platforms, ranking or moderation can trigger additional regimes.	Review data inventory, data access process, trade secrets, cybersecurity, platform obligations and contract clauses.

Sensible next steps

Related ITMR checkers and follow-up reviews

DPIA checkChecks whether AI use, profiling, employee data or sensitive data suggest an impact assessment. Image rights / AI image / asset checkHelps with chains of rights, AI outputs, training material, images, music, code and content use. Data Act checkRelevant for connected products, data access, cloud switching, data holders and product data. CRA checkImportant if AI is part of software, hardware, apps or products with digital elements. Open source / SBOM checkClassifies OSS components, licences, SBOM, security updates and development processes. Document dossier builderStructures the documents for AI inventory, governance, data protection, vendor review and risk assessment.

Prepare AI Act questions in a structured way

Briefly describe which AI system you use, offer or integrate, what role your company has, whether personal data is involved and whether a go-live, customer rollout or authority/customer requirements are coming up.

Request an AI Act initial check from ITMR

Legal notice: This checker offers initial orientation for digital business models and AI projects. It does not replace a legal review of the specific system, contracts, data flows, roles, technical documentation or current legal situation. The AI Act as amended by Regulation (EU) 2026/1744 (in force since 27.07.2026) is authoritative; guidelines and national authority practice continue to develop. Classification by ITMR Rechtsanwälte on the Digital Omnibus.