Yes, you can make an initial assessment of the risk classification as a company. The AI Regulation works with categories: from systems that are prohibited, via systems with high risk and systems with limited transparency obligations, to systems with minimal requirements. For many applications in a typical SME — a chatbot on the website, a recruitment filter, a planning tool — it is possible to determine which category something probably falls into using the text of the Regulation and some research.
The boundary is reached when that assessment remains uncertain or when the outcome is that the system may be high risk. From that point on, it is no longer a matter of reading the text, but of a judgment that has consequences for obligations, documentation and liability. You do not establish that judgment yourself definitively; for that, legal advice or coordination with the supervisory authority is the appropriate route.
What a risk classification precisely entails
The Regulation does not distinguish AI systems by how advanced they are, but by what they do and who is affected by that. A system that co-decides on a job application, a loan or an exam falls under a different category than a system that merely summarizes text. The classification therefore depends on the application, not on the technology behind it. This also means that the same type of software is classified differently in one company than in another, depending on what it is used for.
For this reason, a classification is never a characteristic of the product alone. It is a combination of the product, the intended use and the context in which it is deployed. Anyone purchasing or taking a system from a supplier does well to ask how that supplier assesses the classification themselves, and that conversation is precisely where many companies take their first step. reading the terms from the AI Regulation carefully helps you know which questions to ask.
What you can reasonably do yourself
Making an initial, provisional assessment is feasible for most companies. That starts with an overview: which AI systems are used within your company, for what purpose, and who makes decisions based on them — a person, or the system itself? For systems that clearly do not come close to high risk, such as internal tools for text correction or planning without consequences for individuals, that initial assessment is often sufficient as a basis for proceeding.
It helps to put this overview on paper, even if it is provisional. A brief document with, for each system, the application, the supplier and the provisional assessment provides a foundation for a subsequent conversation with an adviser or in response to a question from a supervisory authority. see in a few questions where your system presumably stands provides an indication with which you can begin that overview, without this being a definitive judgment.
When it is wise to call in help
As soon as a system touches on decisions about people — hiring, dismissal, credit, access to a service — or as soon as doubt exists as to whether a system falls under the high risk category, the time has come to go beyond your own assessment. This also applies when a supplier itself provides no clarity on the classification of the system you are taking, or when the system is deployed in multiple countries with a slightly different application of the rules.
A lawyer or specialized advisor does not only look at the text of the regulation, but also at how similar matters have been assessed so far and at the precise context of your business. That is something different from a general indication, and that distinction is precisely why your own assessment is a starting point and not an endpoint.
Document what you have investigated
Regardless of whether you do it yourself or call in assistance, it is wise to document the steps you have taken: which systems have been reviewed, on the basis of what information, and when. That is not only convenient for yourself, it is also what a supervisory authority asks for if any uncertainty ever arises. Answers to frequently asked questions about this type of file formation can be found on the page with frequently asked questions about the AI Regulation.
Do you want to know where this type of information comes from and how we maintain it on elektropas.com? You can read that on the page that explains how our information is created. Your own assessment is a good start, but it does not replace advice once the outcome points towards high risk or remains uncertain.
Curious about where your own systems roughly stand? Do the free quick-scan or browse through the topics in the knowledge base to see which questions fit your situation.