EU AI Act — System Classification Intake

AIML Partners

AI Machine Learning Partners Ltd. · CRO 809975

Complete this questionnaire to initiate a risk classification assessment of your AI system under the EU AI Act (Regulation 2024/1689). Your responses will determine your system's risk tier, applicable obligations, and recommended compliance actions.

A4C001 · EU AI Act Compliance Manager

Assessment request received

Thank you. Your submission has been securely received and stored in our EU-resident compliance register (Supabase Frankfurt, Germany). An AIML Partners consultant will be in touch within 2 working days to discuss your classification findings and next steps.

Reference: A4C001 ·

It looks like this form may be covering more than one system

Based on your answers, this submission may describe multiple AI systems or deployment contexts. Each must be assessed separately. Please review your answers — if you are describing more than one system, start a new form for each one. If you believe this is a single system, continue — a consultant will clarify before the report is issued.

Before you begin — how many AI systems are you submitting?

This form classifies a single AI system with a single intended purpose — for example, a CV screening tool, a patient chatbot, or a contract analysis system.

If you have more than one AI system to assess, each one needs its own separate form. Risk classification under the EU AI Act depends on what each system does and how it is deployed — and that is different for each system.

I am submitting one AI system

I have one specific system to assess and I understand this form covers only that system.

I have more than one AI system to assess

I need to assess multiple systems. I understand I need to complete a separate form for each one.

I'm not sure — I need help working this out

I'm not certain whether what I have counts as one system or more.

Please complete a separate form for each system

You've indicated you have more than one AI system to assess. To get accurate classifications, each system must be submitted separately. An AIML Partners consultant can help you prioritise and structure your submissions.

Let's help you work that out

A good rule of thumb: if two AI tools do different things, or the same tool is used for different purposes in different parts of your organisation, they are separate systems for EU AI Act purposes.

You can continue — if it becomes clear mid-way that you are describing more than one system, we will flag it. A consultant will also confirm before the report is issued.

Section A — About your organisation and this system

Name of the AI system *

What is this system called? Use the name your organisation or the vendor uses for it.

Your organisation's name *

What is your organisation's relationship to this system? *

Did your organisation build this system, or are you using one built by someone else? The EU AI Act places different legal obligations on builders versus users.

Industry sector *

Which department or team uses this system? *

Select the primary department. If this system is used across multiple departments for different purposes, each use case should have its own form.

Organisation type *

Country where this system is deployed *

What does this system do? *

Describe this specific system in plain language — what it does, who uses it, and what it produces. Focus on this system only. Max 200 words.

Does this system use a general-purpose AI model like ChatGPT, Claude, Gemini, or Llama? *

If your system is built on top of one of these, or calls one via an API, answer Yes. If you built your own model from scratch, answer No.

Section B — Who and what does this system affect?

Answer Yes, No, or I'm not sure for each question. Selecting I'm not sure flags the question for consultant follow-up — it is always better to flag uncertainty than to guess.

Does this system affect real people directly? *

Does it make decisions about, assess, score, or produce outputs that directly affect a specific person — like a patient, job applicant, customer, or student?

Is this system used in a regulated industry? *

Regulated industries include healthcare, banking and finance, insurance, legal services, education, government and public services, law enforcement, and critical infrastructure.

Does this system handle sensitive personal information? *

Sensitive personal data includes: medical or health records, financial information, criminal history, biometric data such as fingerprints or face recognition, genetic data, racial or ethnic origin, political views, or religious beliefs.

Is this system, or the product it is part of, classified as a medical device? *

Medical devices in the EU are regulated under the Medical Device Regulation (MDR) or the In Vitro Diagnostic Regulation (IVDR). If your system is used to diagnose, monitor, or treat patients, answer Yes or I'm not sure.

Is this system available to users in the EU? *

This includes systems accessible via a website or app to EU employees, customers, or citizens — even if your organisation is based outside the EU.

Does this system make or significantly influence important decisions about people? *

For example: deciding whether someone gets a job, a loan, healthcare treatment, or access to a benefit. This question captures an important overlap between GDPR and the EU AI Act — both sets of rules may apply.

Section C — Does your system fall into a high-risk category?

The EU AI Act has a specific list of AI use cases that are automatically considered high-risk. Tick any that describe what your system does. Ticking a box does not automatically mean your system is non-compliant — it means it needs a more detailed assessment.

Recognises or identifies people — uses face recognition, voice recognition, fingerprints, or other physical characteristics to identify or categorise individuals. Also includes emotion recognition.

Runs or protects critical services — is a safety-critical part of energy, water, transport, or digital infrastructure systems.

Used in education or training — decides who can access a course or institution, evaluates student work, assesses learning, or monitors student behaviour.

Used in hiring, managing, or evaluating employees — screens CVs, analyses job interviews, assesses performance, allocates tasks, or contributes to promotion or dismissal decisions.

Decides access to essential services — assesses eligibility for healthcare, welfare benefits, credit or loans, insurance, or prioritises who gets emergency services.

Used by or for law enforcement — assesses the risk of someone committing a crime, profiles individuals, or supports police or judicial investigations.

Used in immigration or border control — assesses people crossing borders, verifies documents, or contributes to asylum decisions.

Used in legal or democratic processes — assists courts in making decisions, supports legal judgements, or could influence how people vote.

None of these apply to my system.

Section D — What does your system do and how much does it act on its own?

Tick every capability that applies — including secondary functions.

For each capability you tick, you will be asked how much human oversight is in place for that specific capability. The risk classification will be based on the highest-risk combination identified — not just the main function.

If you are not sure about the level of oversight for any capability, select I'm not sure — a consultant will follow up before the report is issued.

What we can tell so far — preliminary risk indicators

Section E — Security and attack surface

AI systems can be targeted by attackers in ways that traditional software cannot — for example by feeding them misleading data, manipulating their training, or overwhelming them with requests. These questions assess how exposed your system is to these kinds of attacks, independently of what the system does. If you answer Yes to several questions, your overall risk classification may be adjusted upward.

What goes into the system?

Does this system read or process content from the internet, external files, or third-party sources?

For example: web scraping, documents uploaded by users, emails, or data feeds from outside your organisation. These are the main ways attackers can feed misleading or malicious content into an AI system.

Was this system trained on data that your organisation did not fully control or audit?

For example: the AI model was pre-trained by a vendor on internet data, or fine-tuned on datasets you did not thoroughly check. This creates risk that the model has absorbed biased, incorrect, or maliciously planted patterns.

What does the system do with its outputs?

Does this system automatically trigger actions in other systems?

For example: it sends emails automatically, updates a database, creates a legal document, or initiates a financial transaction without a human approving each action first.

Do this system's outputs go directly to people outside your organisation without a human checking them first?

For example: customers, patients, or citizens receive AI-generated responses or decisions directly, with no human filter before it reaches them.

How is the system connected?

Does this system call external AI services or APIs to function?

For example: it sends data to OpenAI, Google, or another AI provider to get a response. External dependencies introduce supply chain risk and potential data exposure.

Can people outside your organisation access this system via a website or API?

External access means attackers can probe and attempt to manipulate the system at scale, including flooding it with requests or injecting harmful instructions through user inputs.

What are the consequences if something goes wrong?

Is this system used in a regulated or safety-critical environment?

Healthcare, finance, legal, government, law enforcement, or critical infrastructure. In these contexts, a security failure has regulatory consequences on top of operational ones.

Would it cause serious harm if this system were manipulated or taken offline?

Think about the worst realistic scenario. If an attacker corrupted the system's outputs or brought it down, would this cause serious harm to patients, clients, your operations, or your organisation's reputation or finances?

Attack surface score

Answer the questions above to see your attack surface score.

Regulatory gap note: The EU AI Act's cybersecurity requirements (Article 15) formally apply only to high-risk systems. However, your attack surface profile indicates elevated risk for a system that may receive a lower functional classification. AIML Partners will include proportionate security guidance in your classification report regardless of formal risk tier.

Section F — Your details

Your full name *

Your job title or role *

Your work email address *

When are you available for a follow-up call?

Important notice: This questionnaire is an AI-assisted governance intake tool. Completing it does not mean your system is legally compliant. The outputs are advisory and a starting point for a proper compliance assessment. They do not constitute legal advice, regulatory approval, or conformity assessment under the EU AI Act. AI Machine Learning Partners Ltd. accepts no liability for decisions made solely on the basis of this tool's outputs.

Your data is stored securely in an EU-resident database (Supabase Frankfurt, Germany) and processed solely for the purpose of delivering your compliance assessment. Data controller: AI Machine Learning Partners Ltd., CRO 809975, Cork, Ireland. For data queries contact info@aimlpartners.com.

AIML Partners | Registered in Ireland | CRO No. 809975info@aimlpartners.com | www.aimlpartners.com

Poppyfields, Farnahoe, Innishannon, T12C3NC, Cork, Ireland | Director: John O'Sullivan

CONFIDENTIAL: This document is intended solely for the named recipient(s). It may contain proprietary or legally privileged information. Any unauthorised review, use, disclosure, or distribution is strictly prohibited. All content is provided for informational purposes only and does not constitute professional, legal, or regulatory advice. © 2026 AIML Partners. All rights reserved.