How risky is your use of AI?
Three questions about role, purpose and decisions about people are enough for a first assessment of your risk class and obligations under the AI Act.
AI Act Check
Use our free AI Act Check.
Background
Two roles, four risk classes.
The EU AI Act (Regulation (EU) 2024/1689) ties obligations to your role and to the risk of the system. The GDPR applies in parallel as soon as personal data is processed.
Clarify your role first
Most companies are deployers of third-party AI systems, not their providers. Anyone who develops or substantially modifies AI becomes a provider with considerably higher obligations.
The four risk classes
- Unacceptable risk (Art. 5 EU AI Act, prohibited since February 2025)
- High risk (Annex III, e.g. recruitment, credit scoring)
- Limited risk with transparency obligations (Art. 50 EU AI Act)
- Minimal risk (the vast majority of applications)
The application timeline
- In force since August 2024
- Prohibited practices since February 2025
- Obligations for general-purpose AI since August 2025
- Most remaining obligations from August 2026
Background
AI labelling duties from 2 August 2026.
From 2 August 2026 the Regulation applies generally, and with it Art. 50 EU AI Act. The provision addresses providers and deployers separately, which is why the check above asks for your role first.
Provider duties
- Art. 50(1): systems interacting directly with people must be designed so the AI is recognisable, unless that is obvious anyway.
- Art. 50(2): generators must mark synthetic audio, image, video and text output in a machine-readable way (watermarks, metadata). Exception: purely assistive functions that do not substantially alter the input.
Deployer duties, this is what affects most companies
- Art. 50(3): emotion recognition and biometric categorisation: inform the people concerned.
- Art. 50(4): disclose deep fakes. For text only where published to inform the public on matters of public interest, and not even then if a human reviewed it and holds editorial responsibility.
- Art. 50(5): clearly and distinguishably, at the latest at the first interaction, and accessible.
Deep fake or not? Three elements must coincide
Under Art. 3(60) EU AI Act a deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear authentic. If one element is missing there is no deep fake, and no disclosure duty for deployers.
- Requires disclosure: AI video showing the face of a real person; an AI voice of a managing director; a manipulated photo of a real event.
- Does not: invented illustrations and stock-style imagery without real-world reference; AI-generated source code; internal texts, proposals and presentations; ordinary marketing copy; editorially reviewed publications.
Breaches of Art. 50 EU AI Act can be fined under Art. 99(4)(g) EU AI Act with up to EUR 15 million or 3 % of total worldwide annual turnover, whichever is higher.
From the blog
Further reading on the topic.
Frequent questions