EU AI Act Applicability Checker

How to use the EU AI Act Applicability Checker

The checker asks three questions. Work through them in order.

Step 1: Prohibited practice screening. Answer whether your system uses any practice the Act flatly bans. Examples include social scoring by public authorities, untargeted scraping of facial images from the internet, and subliminal techniques that manipulate behavior below conscious awareness. If the answer is yes, the tool stops there: the system cannot be deployed in the EU regardless of other factors.

Step 2: Primary use case. Select the category that best describes what the system actually does in production, not what it could theoretically do. Annex III of the Act lists the specific high-risk use cases: employment decisions, credit scoring, biometric identification, critical infrastructure management, law enforcement, and several others. Choose the closest match. If your system spans multiple categories, use the highest-risk one.

Step 3: Direct interaction or synthetic content. Indicate whether the system talks directly to people (a chatbot, a virtual assistant) or generates synthetic content such as deepfakes or AI-written text. These features trigger transparency obligations even when the underlying use case would otherwise be minimal-risk.

Once you submit, the checker returns a risk tier and a list of the obligations that attach to it. The result is a starting point, not a legal opinion, so bring it to your legal counsel before filing any conformity assessment.

What the result means

The checker can return one of four tiers.

Prohibited means the practice is banned outright under Article 5. Deployment in the EU is not permitted. If you receive this result, the immediate action is to halt any planned rollout and engage legal counsel.

High-risk means your system falls under Annex III and is subject to the Act's core conformity requirements: a risk management system, technical documentation, data governance measures, human oversight mechanisms, logging of events, and registration in the EU database before market placement. High-risk obligations are substantial and typically require months of preparation.

Transparency-obligated means the system interacts with people or generates synthetic content in ways that require disclosure. Users must know they are interacting with an AI, and certain synthetic content must be labeled. This tier has lighter obligations than high-risk but still requires documented controls.

Minimal-risk means no specific obligations apply under the Act. You may still want to maintain internal documentation for procurement or audit purposes, but there is no statutory conformity assessment required.

The result page lists obligations in plain language. Use that list as a gap analysis: check each item against your current controls and note what is missing.

Why this matters for compliance teams

The EU AI Act applies to providers who place AI systems on the EU market and to deployers who put those systems into service within the EU. Financial institutions using AI for credit decisions, fraud detection, or customer-facing services are frequently in scope. The stakes are real: non-compliance with high-risk requirements can carry fines of up to 3 percent of global annual turnover, and prohibited-practice violations can reach 7 percent.

For a compliance officer or MLRO, the practical challenge is that many vendors do not clearly state their system's risk tier. Running this checker yourself, based on actual use in your institution, is faster than waiting for vendor documentation and gives you an independent view to bring into due-diligence conversations.

FluxForce built this tool specifically for financial crime and compliance contexts, where AI is increasingly embedded in transaction monitoring, customer onboarding, and adverse-media screening, all areas that sit close to the Annex III boundary. Use the output to prioritize which AI systems need a full conformity review first.