Free assessment

Published July 5, 2026

Are you covered by the AI Act?

The AI Act follows a risk-tier logic. Placing your system in the right tier determines your obligations — often far lighter than assumed.

The four tiers

  • Unacceptable risk: some practices are banned (for example general-purpose social scoring).
  • High risk: Annex III systems (credit, employment, biometrics…) or safety components of regulated products. Heavy obligations, including the Article 10 data dossier.
  • Limited risk: transparency obligations (for example disclosing you are talking to an AI, or that content is generated).
  • Minimal risk: most use cases. Almost no obligation under the AI Act.

Provider or deployer? It changes everything

Beyond the risk tier, your role determines your obligations. The provider — the party that builds, trains or fine-tunes the system — bears the heavy obligations, including the Article 10 data dossier. The deployer — the party that merely uses an AI supplied by a third party — has far lighter obligations (human oversight, informing people): Article 10 is its provider’s job, not its own. Many organisations believe they are bound by Article 10 when they are only deployers.

The good surprise: often, “you don’t need X”

The value of scoping is not to add work, but to remove it. Many systems that look like “AI” are actually minimal risk. The useful reflex: don’t pile on obligations the Act doesn’t impose.

What about GDPR?

Independent of the AI Act: as soon as you process personal data, GDPR applies, whatever the AI risk tier.

Indicative guidance, not legal advice. When in doubt, a structured assessment removes the ambiguity.

COMPAS: Conformlex recovers the racial disparity ProPublica exposed Pointed at the COMPAS dataset without being told what to look for, the engine recovers the racial disparity in the risk score — the same one ProPublica's investigation exposed. Reproducible proof, honest framing.You have an AI governance platform. Who measured your data? AI governance and data evidence are two different jobs. Platforms document compliance; Article 10 requires measuring the dataset. Where the gap is.Article 10 of the AI Act, explained What 'representative, error-free, traceable' training data actually means — and who Article 10 really applies to.Building an auditable data dossier (Article 10) The eight blocks of Article 10-compliant dataset documentation, and the simple test to know whether your dossier holds up.AI Act and GDPR: where they overlap on training data Two distinct regulations, one common ground: provenance, legal basis, profiling. What overlaps and what differs.The AI Act timeline after the Digital Omnibus The key AI Act deadlines after the Digital Omnibus deferral — transparency, high risk — and what to do now.