Free tools/AI risk classification
Classify the risk
of an AI use case
Answer twelve questions to identify the likely EU AI Act tier, internal risk level and the controls that should be applied.
Sample classification
Describe the use case
Want this classification checked? A senior adviser reviews the use case, confirms the tier and the controls, and gives you an independent two page verdict within five working days. From £750 + VAT, deducted from any full engagement within three months. How the expert review works
Use, people, data, impact and geography.
EU AI Act Articles 5 and 50, with Annex III.
Confirm the classification before launch.
Your report
What this classification means
The full report unlocks when all nine areas are answered.
The tier in plain terms
Your duties
The control plan
Before build
Before launch
In operation
The dates that apply
Method and sources
The classifier follows the tier structure of Regulation (EU) 2024/1689 as amended in 2026: the Article 5 prohibitions, the Annex III high risk areas, the Article 50 transparency duties and the minimal tier beneath them. The internal risk level is separate. It scores decision force, human oversight, data sensitivity, who is affected and the consequence of error, because a use case can carry no EU duties and still deserve firm governance. Control recommendations draw on the AI Act, ISO/IEC 42001, ISO/IEC 23894 and UK data protection law.
- Regulation (EU) 2024/1689, the EU AI Act, the legal text this classifier follows.
- European Commission AI Act Service Desk, the official implementation timeline, including the 2026 Digital Omnibus changes.
- European Commission regulatory framework for AI, the risk tier structure.
- ISO/IEC 42001, the AI management system standard behind the control plan.
- ISO/IEC 23894, AI risk management guidance.
- ICO guidance on AI and data protection, the UK baseline.
Questions
Questions about risk classification
Plain answers about the classifier and the rules behind it. Anything specific, ask us directly.
Is this classifier legal advice?
No. It is a structured self classification against the published tiers of the EU AI Act and UK data protection law. It tells you which tier the use case sits in and which controls to plan for. For a high risk or prohibited outcome, or before you commit budget, have an adviser confirm the classification against the full legal text.
Does the EU AI Act apply to UK organisations?
Often, yes. The Act applies where a system is placed on the EU market, where its outputs are used in the EU, or where it affects people in the EU. A UK company with EU customers, EU employees or EU users falls within at least part of it. A use case that stays entirely within the UK is governed by UK GDPR, the Data (Use and Access) Act 2025 and sector regulators instead.
What changed with the 2026 Digital Omnibus?
The EU moved the high risk deadlines: Annex III use cases now have until 2 December 2027 and AI inside regulated products until 2 August 2028. The transparency duties were not moved and apply from 2 August 2026. A new prohibition on generating intimate imagery of real people without consent applies from 2 December 2026. The prohibitions in force since February 2025 are unchanged.
What should we do if the use case is high risk?
High risk does not mean stop. It is the heaviest tier that can lawfully operate, with duties around risk management, data governance, documentation, logging, human oversight and accuracy. The deadline is December 2027, but the controls take months to build properly, so the sensible time to start is while the system is being designed rather than after it ships.
When is ISO/IEC 42001 worth it?
When AI use cases multiply and customers or regulators start asking for evidence of control. One classified use case does not need a management system. A portfolio of them usually does. The AI governance readiness scorecard answers the organisation level question this classifier does not.
What does Intelance charge?
This classifier is free and stores nothing. An expert review of your result costs from £750 + VAT, deducted from any full engagement within three months. The AI Governance QuickScan, a full independent assessment, costs from £15,000 + VAT with every price fixed in writing before work starts.
Get the independent version of this classification
Thirty minutes with a senior adviser on the use case, the tier and the controls it needs. If the self classification is wrong, better to find out before the build than after the incident. A reply within one UK business day.
Keep going
Related tools and services
AI governance readiness scorecard
The organisation level question: are we ready to scale AI? Free, fourteen areas, about five minutes.
Expert review of your result
A senior adviser confirms the tier and the controls, from £750 + VAT, within five working days.
AI Governance QuickScan
The full independent assessment, from £15,000 + VAT in two weeks.
Written and maintained by the Intelance advisory team. Method and sources last reviewed on 27 July 2026. Intelance provides AI governance advisory, assessment and ISO/IEC 42001 implementation to UK organisations.