EUAICheck is an independent self-assessment tool. We are not a law firm and have no link with any official authority.
EUAICheck is an independent self-assessment tool published by Vival Solutions (EI). These examples are simplified and informational: actual classification depends on the system's precise use. They are not legal advice.

20 concrete examples of the EU AI Act in practice

Updated 30 September 2026 · Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744
01 Human resources High risk Annex III, point 4
CV screening software
An ATS automatically analyses applications and assigns a relevance score to each CV before recruiters see them.
Why this classification? Filtering and evaluating applications is explicitly covered by Annex III, point 4. Scoring candidates is profiling: the Article 6(3) exception does not apply. Obligations from 2 December 2027.
Provider: data and bias (Art. 10) Human oversight (Art. 14, 26) Logs kept 6 months (Art. 26) Informing candidates (Art. 26) Right to explanation (Art. 86)
02 Human resources Prohibited Art. 5(1)(f)
Emotion analysis in video interviews
An online interview tool analyses candidates' facial expressions and voice tone to infer their emotions and produce a score.
Why this classification? Emotion recognition in the workplace, including recruitment, is prohibited since 2 February 2025, except for medical or safety reasons.
Prohibited since February 2025 Ceiling: EUR 35M or 7% of turnover Stop the use
03 Healthcare High risk Art. 6(1) and Annex I
AI-assisted diagnosis from imaging
Software analyses X-rays or MRIs to detect anomalies and proposes a result to the doctor.
Why this classification? Diagnostic software is a medical device subject to notified-body assessment (MDR). It is high-risk through Annex I, not Annex III. Obligations from 2 August 2028.
CE marking under the MDR AI requirements built into the MDR assessment Risk management (Art. 9) Human oversight by the doctor (Art. 14)
04 Financial services High risk Annex III, point 5(b)
Credit scoring
An algorithm assesses the creditworthiness of an individual applying for a loan.
Why this classification? Creditworthiness assessment of natural persons is explicitly covered, except for fraud detection. The deployer also carries out a fundamental rights impact assessment.
Fundamental rights impact assessment (Art. 27) Data and bias (Art. 10) Human oversight (Art. 14, 26) Right to explanation (Art. 86)
05 Education High risk Annex III, point 3
Automated exam grading
An AI system evaluates exam papers or written work and proposes a grade.
Why this classification? Evaluating learning outcomes is explicitly covered by Annex III, point 3.
Human oversight of grades (Art. 14, 26) Informing students (Art. 26) Logs (Art. 12, 26) Right to explanation (Art. 86)
06 Public services High risk Annex III, point 5(a)
Eligibility for social benefits
A public body uses an algorithm to assess eligibility for social benefits.
Why this classification? Assessing eligibility for public assistance benefits is explicitly covered. As a public authority, the deployer carries out an impact assessment and registers its use.
Fundamental rights impact assessment (Art. 27) Registration of the use (Art. 49) Human oversight (Art. 26) Right to explanation (Art. 86)
07 Justice High risk Annex III, point 8(a)
Judicial decision support
Software assists a court in researching and interpreting facts and law in a case.
Why this classification? Systems intended to assist a judicial authority in researching, interpreting and applying the law are explicitly covered. The decision remains human.
Technical documentation (Art. 11) Human oversight (Art. 14) Registration in the EU database (Art. 49) Impact assessment (Art. 27)
08 Critical infrastructure High risk Annex III, point 2
AI control of an electricity grid
An AI system balances electricity distribution in real time, with a direct effect on supply safety.
Why this classification? Safety component in the management of electricity supply. A tool merely assisting operators with no risk on failure would not be a safety component.
Robustness and cybersecurity (Art. 15) Human oversight and stop (Art. 14) Risk management (Art. 9) Logs (Art. 12)
09 E-commerce Transparency Art. 50(1)
Customer service chatbot
A chatbot based on a large language model answers customer questions on an online store.
Why this classification? System interacting directly with people: they must know they are dealing with AI, unless obvious. Obligation of the system provider, since 2 August 2026.
State that it is AI From the first interaction Do not pass as human
10 Marketing Transparency Art. 50(2) and (4)
Generated advertising images and videos
A brand uses an AI tool to create realistic images and videos of people and places for its campaigns.
Why this classification? The tool must mark its outputs in a machine-readable way (provider). Realistic content that could pass as authentic is a deepfake the advertiser must disclose (deployer). No retroactive marking of content created before 2 August 2026.
Marking by the tool (provider) "AI-generated" label for deepfakes Until 2 December 2026 for tools already on the market
11 Surveillance Prohibited Art. 5(1)(e)
Face database built by scraping
A system builds a facial recognition database by untargeted scraping of images from the internet or CCTV footage.
Why this classification? Untargeted scraping of facial images to create or expand facial recognition databases is prohibited since 2 February 2025.
Prohibited since February 2025 Ceiling: EUR 35M or 7% of turnover GDPR applies in parallel
12 E-commerce Minimal risk Art. 4
Product recommendation engine
An algorithm suggests products based on purchase and browsing history.
Why this classification? No Annex III use, no interaction requiring Article 50. The GDPR applies to browsing data; very large platforms also have DSA obligations.
Team AI literacy (Art. 4) GDPR Voluntary good practice
13 Cybersecurity Minimal risk Art. 4
Spam filter
A machine learning model filters unwanted emails in a business mailbox.
Why this classification? Operational tool with no significant effect on people's rights. No Annex III category.
Team AI literacy (Art. 4) GDPR if personal data
14 Transport High risk Annex I, Section B
Driver assistance (emergency braking)
An on-board system analyses the vehicle's surroundings and triggers emergency braking.
Why this classification? Safety component of a vehicle subject to type approval. Vehicles fall under Annex I, Section B: AI requirements are integrated through sectoral legislation.
Vehicle type approval AI requirements via sectoral acts Robustness and safety testing
15 Insurance High risk Annex III, point 5(c)
Health insurance pricing
An algorithm assesses risk and sets an individual's health insurance premium.
Why this classification? Risk assessment and pricing in life and health insurance are explicitly covered. The deployer carries out a fundamental rights impact assessment.
Fundamental rights impact assessment (Art. 27) Data and bias (Art. 10) Right to explanation (Art. 86) GDPR: health data
16 Law enforcement Prohibited (with exceptions) Art. 5(1)(h)
Real-time facial recognition in public spaces by police
Cameras linked to a facial recognition system identify people in the street in real time, on behalf of law enforcement.
Why this classification? Prohibited for law enforcement, except strictly framed exceptions (searching for victims, imminent terrorist threat, suspects of serious crimes) with prior authorisation. Outside law enforcement, remote biometric identification is high-risk (Annex III, point 1).
Prohibited except legal exceptions Prior authorisation required Ceiling: EUR 35M or 7% of turnover
17 Human resources High risk Annex III, point 4(b)
Employee productivity monitoring
Software tracks remote employees' activity and produces productivity scores used to evaluate them.
Why this classification? Monitoring and evaluating employee performance and behaviour is explicitly covered. If it infers emotions, the tool becomes a prohibited practice.
Informing employees and representatives (Art. 26) Human oversight (Art. 26) Logs (Art. 26) Employment law and GDPR
18 Software Minimal risk Art. 4 and 50
AI assistant in a CRM
A CRM offers an assistant that drafts emails, summarises calls and estimates the likelihood of closing a deal.
Why this classification? Productivity tool with no Annex III use. Article 50 obligations sit with the vendor (user interaction, marking); a sales email reviewed and sent by a salesperson need not be labelled.
Team AI literacy (Art. 4) Vendor transparency obligations (Art. 50) GDPR: customer data
19 Agriculture Minimal risk Art. 4
Crop disease detection
An app analyses plant photos taken by a farmer to flag diseases.
Why this classification? Decision support tool with no effect on people's rights and outside Annex III.
User AI literacy (Art. 4) Field validation of results
20 Wellbeing Transparency (to watch) Art. 50(1)
Mental health support chatbot app
An app offers conversations with a chatbot to help manage stress and anxiety.
Why this classification? Interaction with potentially vulnerable people: disclosure required. If the app claims to diagnose or treat, it may become a medical device, hence high-risk through Annex I.
State that it is AI (Art. 50) Do not present as a health professional GDPR: health data If medical purpose: MDR

Does your system look like one of these examples?

17 questions for a first indicative estimate. Free.

Start the pre-assessment
← What is the EU AI Act? Home