Does the EU AI Act apply to your organisation?

1. Define the system you are assessing

Describe the concrete system and its intended purpose: what it does, who operates it, which decisions it supports, who is affected and where its output is used. A broad label such as ‘chatbot’ or ‘machine learning model’ is not enough for a reliable scope decision.

Record the model, application, integrations and operating process separately. One general-purpose model can sit inside several AI systems with different purposes and risk profiles.

• Name the system owner and business process.
• Write a one-sentence intended-purpose statement.
• List users, affected people, inputs, outputs and deployment countries.
• Keep the vendor's instructions and your actual use case together.

2. Check the connection to the European Union

The Act can apply to organisations established in the EU and to organisations outside it. Relevant connections include placing an AI system or general-purpose AI model on the EU market, putting a system into service in the EU, using it in the EU, or using an output in the EU in circumstances covered by the Act.

Map each legal entity and deployment country. A supplier, customer and group company may hold different roles for the same system.

A non-EU headquarters does not by itself put an organisation outside the Act. Analyse the market, use and output connections.

3. Identify your role for this use

The Act assigns duties by role. A provider develops an AI system or has one developed and places it on the market or puts it into service under its name or trademark. A deployer uses an AI system under its authority, except for personal non-professional activity. Importers, distributors, product manufacturers and providers of general-purpose AI models have separate duties.

Roles can change. Substantial modification, a new name or trademark, or a changed intended purpose can make an actor responsible as a provider. Record the facts behind the role decision instead of relying only on contract labels.

4. Test exclusions and special cases

The Act contains exclusions and qualifications, including certain military, defence and national-security uses; personal non-professional activity; and some research, testing and development before a system is placed on the market or put into service. Open-source status does not create a blanket exemption.

Treat an exclusion as a conclusion that needs evidence. Note its legal basis, the facts that support it and the person who approved the decision. Other laws, including data protection, consumer, employment and product-safety rules, may still apply.

5. Move from scope to classification

If the Act applies, screen for prohibited practices first. Then assess high-risk classification, transparency duties, general-purpose AI rules and any role-specific obligations. The same organisation may need several assessments where one model supports multiple use cases.

• Keep an AI inventory with versioned scope and role decisions.
• Link each conclusion to contracts, system documents and process evidence.
• Reassess when the purpose, model, users, geography or integration changes.