PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchClassify the complete AI system—not just its model—by its intended purpose, deployment context and likely effect on people. The practical order is: confirm that the product meets the Act’s AI-system definition, screen for prohibited practices, test the two high-risk routes, check transparency duties, assess any general-purpose AI (GPAI) obligations, and document your role and evidence.
This guide reflects the EU AI Act’s phased timetable as of 17 October 2026. A classification is a legal and operational record of what the system does, where it is used, who is affected and which organisation is responsible; a model name or marketing label is not enough.
As an Amazon Associate I earn from qualifying purchases.
What you are actually classifying
The Act defines an AI system as a machine-based system that can operate with varying levels of autonomy, may adapt after deployment, and infers from inputs how to generate predictions, content, recommendations or decisions that influence physical or virtual environments. Start with the complete product or service: model, prompts or rules, interface, connected data, safeguards and the stated use.
A foundation or general-purpose model is usually only a component. The same model can sit inside a low-impact writing assistant, a recruitment ranking tool or a system that affects access to credit. Those deployments do not receive one universal label from the model’s name. Record the use that the provider intends and the use that the deployer actually enables.
The European Commission describes four risk levels. They are not four product-quality grades: they describe the level and type of harm the system can pose and determine which obligations attach.
| Risk level | Trigger | Practical consequence |
|---|---|---|
| Prohibited (unacceptable risk) | A practice falls within a banned use. | Do not place it on the market, put it into service or use it in that form. |
| High risk | The system follows an Annex I product-safety route or an Annex III sensitive-use route. | The heaviest controls apply, including risk management, data governance, logging, technical documentation, human oversight, robustness, accuracy, cybersecurity, conformity assessment and EU-database registration as applicable before market placement or use. |
| Transparency or limited risk | The system interacts with people or creates or manipulates content covered by transparency rules. | Disclose the AI interaction and apply the required detectability or labelling measures. A transparency trigger does not by itself make the system high risk. |
| Minimal or no risk | No prohibition, high-risk route or specific transparency trigger is identified. | The AI Act’s risk-tier controls are not triggered by that classification alone, although other legal duties can still apply. |
Step-by-step classification workflow
1. Confirm that the product is an AI system
Write a one-sentence description of the complete system, not merely the model: what inputs it receives, what it infers or generates, how autonomous it is, whether it can change after deployment, and what its output does in a physical or virtual environment.
- Include the model, retrieval or search layer, rules, user interface, external tools and human-review process.
- State whether the output is a prediction, recommendation, generated content or decision.
- Describe the people, organisations or systems that can be affected.
- Separate a provider’s intended purpose from optional or foreseeable uses that a deployer may activate.
If the product only executes fixed instructions without the inference characteristics described by the Act, document why it is outside the AI-system definition. If it does infer or generate, continue through every risk screen even when the model is supplied by someone else.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Screen for prohibited practices first
Prohibition is a stop condition. Check it before asking whether the system is high risk or merely subject to transparency rules. The Commission’s list covers harmful manipulation or deception, harmful exploitation of vulnerabilities, social scoring, certain individual criminal-risk prediction, untargeted scraping to build facial-recognition databases, workplace or education emotion recognition subject to the Act’s stated exceptions, and biometric categorisation for protected characteristics.
Most of these prohibitions are already applicable. An additional ban on generating non-consensual sexually explicit material or child sexual-abuse material is scheduled for December 2026. Treat that date as a future application point in a deployment plan prepared before it arrives, and verify the consolidated law and any amendments at launch.
Rank #2
For each suspected practice, record the exact feature, target population, data source, decision or influence mechanism and legal exception relied on, if any. Do not relabel a prohibited function as a harmless analytics feature: the intended purpose and real operating context control.
3. Test both high-risk routes
A system is high risk through either of two legal routes. Test both; passing one route is enough to require the high-risk analysis.
Annex I: product-safety route
The first route applies when the AI system is a safety component of a product, or is itself a product, covered by specified Union harmonisation legislation listed in Annex I. The surrounding product and its conformity process matter, not only the algorithm. Record the product law, the safety function and how an AI failure could affect users or the environment.
Annex III: sensitive-use route
The second route is based on intended use in an Annex III area. The areas identified by the Commission include:
- Critical infrastructure.
- Education.
- Employment and worker management.
- Access to essential private services and public services or benefits, including credit-related decisions.
- Biometrics.
- Law enforcement.
- Migration, asylum and border control.
- Administration of justice and democratic processes.
Map the intended purpose to the precise Annex entry and describe the affected people and decision. A system that recommends training material and a system that ranks applicants for a job may use similar technology but have materially different legal routes because the context and effect differ.
Rank #3
The Commission’s material illustrating 2026 Annex III classifications is identified as draft pending formal adoption. Use it to structure an assessment, but do not treat a draft example as a final legal determination; confirm the adopted text and any national guidance for the date of deployment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →4. Check transparency obligations
A system can be lawful and still require a clear notice. Chatbots and social companions generally need to tell people that they are interacting with AI. Providers and deployers may also need to make generated or manipulated content detectable and to visibly label deepfakes and certain text on matters of public interest.
Article 50 transparency obligations apply from 2 August 2026, so a system launched or materially changed after that point needs an implementation record. Specify where the notice appears, when it is shown, which output types receive a label, how machine-detectable marking is preserved through distribution, and who checks the result. Do not describe a generic privacy notice as proof of AI disclosure unless it actually informs the person at the required interaction point.
5. Assess GPAI as a separate layer
General-purpose AI obligations do not replace application-level classification. If your organisation provides a general-purpose model, assess the separate requirements on transparency and copyright. Providers of models with systemic risk must also assess and mitigate those risks. The Commission says the GPAI rules became effective in August 2025 and provides a code of practice and a training-content summary template.
Run two records where appropriate:
- The GPAI record for the model provider, including the applicable transparency, copyright and systemic-risk work.
- The downstream AI-system record for the product or service in which the model is used, including prohibited, high-risk and Article 50 tests.
A downstream deployer cannot avoid a high-risk assessment by pointing to a model provider’s GPAI documentation, and a model provider cannot assume that every downstream application has the same risk category.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →6. Record your role and the evidence
Identify whether each organisation is acting as provider, deployer, importer or distributor. Duties differ by role, and a single corporate group can occupy more than one role in a supply chain. Record the legal entity, product version, market or service location, launch date, suppliers, integrators and the person accountable for updates.
Your classification file should contain:
- The intended purpose, foreseeable users and deployment setting.
- The affected persons and the interests at stake: safety, health, rights, access to services or democratic participation.
- Inputs, outputs, autonomy, post-deployment adaptation and human involvement.
- The prohibited-practice screen and its conclusion.
- The Annex I product and Annex III use analysis, including the exact entry considered.
- The transparency triggers and the notice, labelling or detectability design.
- The GPAI relationship and any systemic-risk assessment.
- The organisation’s role and the evidence supporting each conclusion.
- The applicable application date, transition rule and legal version used.
How the categories differ in practice
Prohibited practice: stop rather than mitigate
For a prohibited practice, adding a human review queue, accuracy target or warning label does not turn the use into an ordinary high-risk system. Redesign the purpose and functionality, remove the banned feature, or stop the deployment. Keep the analysis showing why the original use was rejected and what changed in the replacement.
High-risk system: build a compliance case before use
High-risk status requires a controlled lifecycle, not a one-time model check. Before placing the system on the market or putting it into service, plan the controls that the Act associates with high-risk systems:
| Control area | What to establish |
|---|---|
| Risk management | A documented process that identifies and controls risks across design, deployment, operation and change. |
| Data governance | Data practices suited to the intended purpose, affected groups and known limitations. |
| Logging | Records that allow operation and significant events to be traced for the required oversight period. |
| Technical documentation | Architecture, purpose, performance information, limitations, testing and change history sufficient to explain conformity. |
| Instructions for use | Clear information for the deployer about capabilities, limits, operating conditions and required safeguards. |
| Human oversight | Defined people, authority and intervention procedures rather than an unspecified promise that a human is in the loop. |
| Robustness and accuracy | Evidence that the system performs reliably for its intended conditions and that material failure modes are addressed. |
| Cybersecurity | Protection against manipulation, unauthorised access and other attacks relevant to the system’s operation. |
| Conformity assessment | The applicable assessment route completed before the system is placed on the market or put into service. |
| EU-database registration | Registration where the Act requires it, completed as part of the launch readiness record. |
When the intended purpose, data, model, interface or operating environment changes, revisit the classification and the evidence. A feature that moves a system into employment, credit, biometrics or another Annex III area can change the legal route even if the underlying model is unchanged.
Transparency or limited risk: make the interaction legible
Transparency work is narrower than the high-risk control set but still needs design and testing. A person should know when a chatbot or social companion is the interlocutor. Content controls should identify where an output is generated or manipulated, apply visible labels to covered deepfakes and public-interest text, and preserve detectability when content is exported or republished. Document the trigger, message wording, label placement, technical marking and monitoring owner.
Best Value
Minimal or no risk: keep the boundary evidence
Do not discard the classification record merely because no special AI Act tier applies. Keep the intended-purpose statement, affected-person analysis and screen results so a later feature, customer segment or deployment context can be compared against the original decision. Reassess when the product begins making recommendations or decisions that influence people or environments in a regulated setting.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Worked classification examples
| Example system | Likely first conclusion | What must still be checked |
|---|---|---|
| Customer-service chatbot | Transparency risk: disclose that the user is interacting with AI. | Whether it also makes decisions in an Annex III area, generates covered public-interest text or uses a prohibited manipulation technique. |
| Social-companion application | Transparency risk: identify the AI interaction. | Its influence on vulnerable people, any manipulation features and the exact deployment safeguards. |
| Tool that ranks applicants for employment | Annex III employment route; treat it as potentially high risk. | The precise employment purpose, affected workers, human oversight, data governance, documentation and conformity obligations. |
| System that evaluates eligibility for credit or an essential service | Annex III access-to-services route; treat it as potentially high risk. | The exact service, decision effect, affected persons and applicable high-risk controls. |
| Workplace emotion-recognition feature | Screen for a prohibited practice before any high-risk analysis. | Whether a stated exception applies and whether the actual deployment fits its conditions. |
| Education emotion-recognition feature | Screen for a prohibited practice before any high-risk analysis. | The stated exceptions, setting, people affected and purpose. |
| Untargeted scraping used to build a facial-recognition database | Screen for a prohibited practice. | Whether the data collection and database-building activity matches the banned pattern. |
| General-purpose model offered to developers | GPAI assessment for the model provider. | Transparency, copyright and, where applicable, systemic-risk assessment; each downstream product needs its own classification. |
| AI safety component in a regulated product | Annex I product-safety route; treat it as potentially high risk. | The covered product legislation, safety function, conformity route and launch date. |
These are screening examples, not automatic legal opinions. The same interface can move categories when its intended purpose, users, decision authority or deployment setting changes.
Application dates and transition planning
The Act is phased. Put the date next to every conclusion because a system can be classified correctly but still be subject to a requirement only when that requirement’s application date arrives.
| Date | Milestone | Planning implication |
|---|---|---|
| February 2025 | Most prohibited-practice rules began to apply. | Run the prohibition screen before any current deployment or expansion. |
| August 2025 | GPAI rules became effective, according to the European Commission. | Model providers should maintain the separate transparency, copyright and systemic-risk records that apply to them. |
| 2 August 2026 | Article 50 transparency obligations apply. | Chatbot notices, social-companion disclosures and covered content labels or detectability measures must be ready for in-scope systems. |
| December 2026 | The additional prohibition on non-consensual sexually explicit material and child sexual-abuse material is scheduled to take effect. | Review generation, editing and distribution features before this application point. |
| 2 December 2027 | Annex III high-risk provisions are scheduled to apply. | Complete the sensitive-use inventory, controls and conformity work well before deployment or the transition deadline. |
| 2 August 2028 | Annex I product-embedded high-risk provisions are scheduled to apply. | Align product-safety, AI conformity and release calendars. |
The dates above are subject to the consolidated law and subsequent amendments. Recheck the legal text and Commission guidance when a system is launched, substantially changed or moved into a new market.
A practical classification worksheet
Use the following sequence for each product version and deployment context. Keep the answers with the technical and contractual records rather than in an informal chat or slide deck.
- Define the system: name the model and every surrounding component, then describe inputs, inferred outputs, autonomy, adaptation and environmental influence.
- Define the purpose: write the provider’s intended purpose and the deployer’s actual configured purpose in separate fields.
- Map people and effects: list users, affected persons, vulnerable groups, rights, safety, health, essential services and democratic processes implicated by the output.
- Run the prohibition screen: check manipulation, vulnerability exploitation, social scoring, criminal-risk prediction, facial-database scraping, emotion recognition, protected-trait biometric categorisation and the later sexually explicit or child-abuse-material prohibition.
- Run both high-risk screens: identify any Annex I product-safety connection and any Annex III intended-use entry. Attach the precise legal text or adopted guidance used.
- Run the transparency screen: test chatbot and social-companion disclosures, generated or manipulated-content detectability, deepfake labels and covered public-interest text labels.
- Run the GPAI screen: identify whether your organisation provides a general-purpose model, uses one in a downstream system, or both.
- Assign roles: record provider, deployer, importer and distributor status for every entity in the chain.
- Set the application date: record which obligation applies, on what date and under which legal version.
- Approve and revisit: obtain accountable sign-off, then reopen the worksheet whenever purpose, data, model, interface, users or deployment setting changes.
Common classification mistakes and corrections
- Classifying the model name: replace a label such as assistant, copilot or foundation model with a description of the complete product and its use.
- Starting with high risk: run prohibited-practice checks first; a banned function is not made lawful by adding controls.
- Treating transparency as high risk: a disclosure or labelling trigger can apply to a lawful, non-high-risk system. Keep the two analyses separate.
- Assuming GPAI paperwork covers the application: maintain a model-level record and a downstream system record when both layers exist.
- Using a draft example as final law: mark the Commission’s 2026 Annex III examples as draft pending formal adoption and verify the adopted material.
- Ignoring deployment context: the same technology can change category when moved into employment, credit, biometrics, education, law enforcement or another sensitive setting.
- Leaving roles unclear: identify provider, deployer, importer and distributor entities before assigning tasks, because their duties differ.
- Missing phased dates: put the application date beside each conclusion and align product, safety, procurement and compliance release gates.
- Keeping no evidence: preserve the intended purpose, affected-person analysis, legal route, transparency design and version history so a later review can reproduce the decision.
What a defensible classification decision looks like
A defensible record reaches one clear conclusion for one system, version and deployment context: prohibited, high risk, transparency or limited risk, or minimal or no risk. It identifies the legal route tested, the people and interests affected, the organisation’s role, the evidence used and the date on which the conclusion applies.
If the answer is high risk, the record should connect directly to the control plan and conformity work. If the answer is transparency risk, it should point to the disclosure, label and detectability implementation. If the answer is minimal or no risk, it should preserve the boundary conditions that made that conclusion possible. Classification is therefore a maintained governance artifact, not a one-time model description.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
