Your EU AI Act reading, on the record

Ask a compliance team whether a given AI system is high-risk under the EU AI Act and you will usually get a good answer. Ask them to show how they got there, who decided, and what changed since the last time someone asked, and the answer is often a spreadsheet cell and a memory. That is the gap we wanted to close. Deliverd now records your organisation's reading of the Act for every AI system in your register, as its own record, before any internal risk tier is applied to it. The Act's high-risk duties for Annex III systems apply from 2 December 2027, so now is a good time to know which of yours they reach.

Why on its own

Most organisations already score their AI uses: low, medium, high, by their own rules. That is useful, but it is not the same question as the one the Act asks. A use can look low-risk on an internal scorecard and still be listed in Annex III, and a scorecard that folds the two together lets one hide the other. So the legal reading is kept apart. It is recorded first, in the Act's terms, and where your other assessments allow it, a high-risk or prohibited reading can push their result up. Nothing an internal score says can push it down.

The questions, in the Act's order

An administrator answers the questions on the AI systems page, under Agent governance, and only the questions the answers so far lead to are asked:

1. Is it an AI system at all? The Article 3(1) definition: a machine-based system that infers, from its input, how to produce predictions, content, recommendations or decisions. Fixed rules written by people are not one, and the reading stops there.
2. In what role do you meet it? Provider, Deployer, Importer, Distributor or Product manufacturer. The role decides which duties are yours.
3. Is it a prohibited practice under Article 5? If so, the reading stops: it may not be used in the EU, and the next step is Legal.
4. Is it an Annex I product, or a safety component of one, that needs a third-party conformity assessment? That makes it high-risk under Article 6(1).
5. Is it intended for a use listed in Annex III? Credit scoring, recruitment, life and health insurance pricing, education and the rest of the list in Article 6(2).
6. Does it profile people? An Annex III system that profiles natural persons is always high-risk.
7. Does the Article 6(3) exception apply? A narrow procedural or preparatory task, with no significant risk of harm. It is never available to a system that profiles.
8. Does it talk to people, make synthetic content, recognise emotions or produce deep fakes? Those carry Article 50 transparency duties whatever the risk class.
9. Is a general-purpose AI model involved? Built on someone else's, or provided by you, with or without systemic risk.

Every question has the same third option beside yes and no: "Not sure: needs Legal". It exists because the honest answer to some of these is "we need to ask", and a record that forces a guess is worse than no record at all.

What comes out

As the questions are answered, the status follows by fixed rules: Not an AI system, Prohibited practice, High-risk AI system or AI system, not high-risk. With it come the overlays (transparency, or a general-purpose model in the picture) and a list of the duties that follow for the role you recorded, each with its article. A deployer of a high-risk system is reminded of human oversight, logs kept for at least six months, telling the people affected, and the fundamental rights impact assessment where Article 27 asks for one. A provider sees the requirements of Articles 9 to 15, conformity assessment and registration. A system that falls under the Article 6(3) exception is marked as such, with the reminder that the assessment behind it has to be documented.

Because the rules are code, the same answers give the same status in the app today, in our tests, and when someone looks at the record years from now. You can add your own rationale in words beside the answers, and the record keeps who recorded it and when.

What it will not do

It will not record a reading that still has a "not sure" in it. Until every question its path asks is answered, it stays open, and the system shows as not determined. It is a record for people, not a shortcut for agents: an API key or an agent is refused, because a legal reading is the organisation's own. And every new reading is a new row. Nothing is overwritten, so the history of how your view of a system changed is there when someone asks.

It is also not legal advice, and says so wherever it is shown:

A record of your organisation's reading of the EU AI Act, kept for audit. It is not legal advice; Legal or Compliance should confirm anything marked high-risk or prohibited.

Where it fits

The determination sits beside the rest of Compliance Mode: the AI system register, governed tasks, the controls each framework asks for, and evidence. It is part of Compliance Mode on the Business and Enterprise plans (pricing). The same reading can be recorded for a supplier's AI too, which is where due diligence on your suppliers' AI starts. For a worked example of a high-risk Annex III use, the credit decisioning case study follows one from the Act to a release, and the governance guide has the details.