EU AI Act Quick Assessment
Fast triage tool (15-25 minutes) for preliminary AI Act classification and compliance assessment. Produces a preliminary output and routes to detailed skills for full analysis.
Disclaimer (show at session start, do not block)
Important: This is a preliminary AI Act assessment based on Regulation (EU) 2024/1689, designed for rapid triage. It is not legal advice and does not replace a full assessment — validate results with a full risk-tier classification, an Art. 6 high-risk depth analysis where the high-risk branch is plausible, a role determination, an obligation mapping, a formal report, and qualified legal counsel. Effective dates for high-risk obligations reflect the AI Omnibus 2026 postponement (Annex III: 2 December 2027; Annex I: 2 August 2028).
When to Search the Web
On activation — search for:
EU AI Act latest enforcement updates [current year]
EU AI Act Commission guidelines status [current year]
Quick Assessment Workflow
Phase 1: Quick Context (Adaptive 2-Batch Flow)
Gather context through a conversational 2-batch approach. Maximum 2 interaction turns — 1 if the user is detailed, 2 if gaps remain.
Batch 1: Essential Questions (always asked)
Present these three questions with a natural, conversational welcome:
Let's get started with a quick EU AI Act assessment.
You can answer in your own words — a short paragraph, bullet points, whatever works. I'll ask follow-up questions only if I need more detail.
1. What does the AI system do? (2-3 sentences: what it does, how it works at a high level, what outputs it produces)
2. Where is the system deployed? (For reference: EU/EEA market, Switzerland with EU reach, outside EU but outputs used in EU, or no EU connection)
3. What is your organization's relationship to it? (For reference: developed in-house, purchased/licensed, modified/finetuned, distribute/import, or evaluating for acquisition)
Coverage Analysis (internal — not shown to user)
After the user responds to Batch 1, silently check whether their answer covers each of the 8 required fields. Be generous with extraction — e.g., "German Mittelstand" covers both jurisdiction (DE) and organization size (medium); "CV screening tool" covers sector (HR/employment) and affected persons (employees/job applicants).
| # | Field | Extract from |
|---|
| 1 | System description | Batch 1 Q1 |
| 2 | Deployment context | Batch 1 Q2 |
| 3 | Organization role | Batch 1 Q3 |
| 4 | Sector | Often inferable from system description |
| 5 | Affected persons | Often inferable from system description + sector |
| 6 | Modifications | Often inferable from organization role |
| 7 | Organization size | Sometimes mentioned in context |
| 8 | Jurisdiction(s) | Often inferable from deployment context |
Mark each field: Covered / Partially covered / Not covered.
Batch 2: Adaptive Follow-Up (only if gaps remain)
- All 8 fields covered → Skip Batch 2. Briefly confirm your extractions and proceed to Phase 2.
- Gaps remain → Send ONE follow-up message covering ONLY the missing or partially covered fields, conversationally framed. Do not re-ask what was already answered.
- Partially covered fields → Use confirmation prompts, not full re-asks. Example: "You mentioned healthcare — is this specifically in the medical devices sector?"
- Unclear fields → If still unresolvable after Batch 2, mark as
[UNCLEAR — proceeding with cautious assumptions] and note the assumption made.
Example follow-up (if sector, size, and jurisdiction are missing):
Just a few more details to round out the picture:
- What sector does this fall into? (e.g., healthcare, financial services, HR/employment, education, public administration, other)
- Roughly how large is your organization? (e.g., under 50 employees, 50-249, or 250+)
- Which EU/EEA country or countries are involved?
Information Normalization (internal — before Phase 2)
Before proceeding to Phase 2, normalize all gathered information into the structured 8-field format so the Phase 2 gate sequence can reference fields consistently:
- System description — free text
- Deployment context — one of: EU/EEA market, Switzerland with EU reach, Outside EU but outputs used in EU, No EU connection
- Organization role — one of: Developed in-house, Purchased/licensed, Modified/finetuned, Distribute/import, Evaluating
- Sector — mapped to: Healthcare/medical devices, Financial services, HR/employment, Education, Law enforcement/justice, Critical infrastructure, Public administration, Consumer/retail, Other
- Affected persons — one or more of: Employees/workers, Customers/consumers, Citizens/public, Students, Patients, Internal only
- Modifications — one of: No modifications, Configuration within intended range, Finetuning/retraining, Changed intended purpose, Own brand applied
- Organization size — one of: Micro (<10), Small (10-49), Medium (50-249), Large (250+)
- Jurisdiction(s) — list of EU/EEA Member States or Switzerland
Phase 2: Rapid Classification (6-Step Gate Sequence)
Read references/quick-decision-tree.md for the condensed classification logic.
Process the answers through the 6-step gate sequence internally (do not ask additional questions unless critical information is missing). Output the result as a single assessment.
Gate 1: Scope Check (Art. 2)
- If deployment context is "No EU connection" → likely out of scope → note and proceed cautiously
- Check for military, personal use, pure R&D exclusions based on system description
Gate 2: AI System Test (Art. 3(1))
- Quick determination based on system description
- Apply simplified 3-question test: (1) machine-based? (2) infers/generates beyond rules? (3) influences environment?
Gate 3: Prohibited Practice Screen (Art. 5)
- Rapid screen based on system description and sector
- Flag any potential Art. 5 concern for detailed review
Gate 4: High-Risk Assessment (Annex I + III)
- Map sector + use case to Annex I/III categories
- Use sector answer as primary trigger indicator
- If Annex III triggered: quick Art. 6(3) exception check
- For a full Art. 6 high-risk depth assessment (Commission Guidelines-grounded), follow this triage with a dedicated high-risk depth analysis (Annex I + Annex III examples, Art. 6(3) exception) when the high-risk branch is plausible.
Gate 5: GPAI Check
- Based on system description: does it use a general-purpose AI model?
- If yes: note GPAI obligations
Gate 6: Transparency Triggers (Art. 50)
- Check for direct human interaction, synthetic content generation, emotion recognition, deep fakes
Phase 3: Preliminary Output
Generate a consolidated preliminary assessment using the following structure:
## AI Act Quick Assessment — PRELIMINARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠ PRELIMINARY ASSESSMENT — Full analysis required for compliance decisions
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
System: [name/description]
Date: [date]
Assessment Type: PRELIMINARY (Quick Assessment)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CLASSIFICATION SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
AI System (Art. 3(1)): [Likely YES / Likely NO / Unclear — full test needed]
Scope (Art. 2): [In scope / Likely excluded — Art. 2(x)]
Risk Tier: [Likely Prohibited / Likely High-Risk / Likely GPAI / Likely Limited / Likely Minimal / Unclear]
Classification Basis: [Likely Art. 5(1)(x) / Likely Annex III Nr. X / Likely Art. 50 / Likely minimal]
Confidence: [High / Medium / Low]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ROLE ASSESSMENT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Likely Role: [Provider / Deployer / Quasi-Provider / Importer / Distributor]
Quasi-Provider Risk: [None / Possible — [trigger]]
Key Concern: [if any — e.g., finetuning may trigger Art. 25]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TOP OBLIGATIONS (if high-risk or GPAI)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| # | Obligation | Article | Urgency | Effort Estimate |
|---|-----------|---------|---------|-----------------|
| 1 | [top obligation] | [Art. X] | [Immediate/Short-term/Ongoing] | [Low/Medium/High] |
| 2 | [second obligation] | [Art. X] | [Immediate/Short-term/Ongoing] | [Low/Medium/High] |
| 3 | [third obligation] | [Art. X] | [Immediate/Short-term/Ongoing] | [Low/Medium/High] |
| 4 | [fourth obligation] | [Art. X] | [Immediate/Short-term/Ongoing] | [Low/Medium/High] |
| 5 | [fifth obligation] | [Art. X] | [Immediate/Short-term/Ongoing] | [Low/Medium/High] |
For ALL risk tiers:
| - | AI competence (Art. 4) | Art. 4 | Immediate (since Feb 2025) | Low-Medium |
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
COMPLIANCE TIMELINE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Applicable Deadline: [2 Feb 2025 / 2 Aug 2025 / 2 Dec 2027 (Annex III — Omnibus) / 2 Aug 2028 (Annex I — Omnibus)]
Days Remaining: [X days]
Urgency: [OVERDUE / CRITICAL / HIGH / MEDIUM / LOW]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
JURISDICTION FLAGS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[Jurisdiction-specific flags based on deployment country, e.g.:]
[DE: Works council co-determination likely required (BetrVG §87)]
[FR: CSE consultation required before deployment]
[Finance sector: BaFin/[regulator] AI model governance requirements apply]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FINANCIAL EXPOSURE (PRELIMINARY)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Maximum penalty: [EUR XM or X% turnover — Art. 99(X)]
SME proportionality: [Applies / Does not apply]
Penalty tier: [Tier 1/2/3]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
FLAGS & WARNINGS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
[List any flags, e.g.:]
[PROHIBITED PRACTICE RISK — Art. 5(1)(x) — immediate legal review required]
[QUASI-PROVIDER RISK — finetuning may trigger Art. 25]
[PROFILING DETECTED — may affect Art. 6(3) exception]
[GDPR OVERLAP — DPIA likely required under Art. 35 GDPR]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ASSESSMENT CONTEXT (paste into next skill)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
System: [name]
Classification: [risk tier]
Basis: [legal basis]
Role: [role]
Quasi-Provider: [risk level]
Sector: [sector]
Jurisdiction: [list]
Org Size: [size]
Art. 50: [applicable triggers]
GPAI: [yes/no, systemic risk]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
RECOMMENDED NEXT STEPS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. → Do a full risk-tier classification with documented reasoning
[Priority: HIGH / MEDIUM — based on preliminary findings]
2. → Do a detailed role determination (provider/deployer/importer/distributor)
[Priority: HIGH if quasi-provider risk detected / MEDIUM otherwise]
3. → Do a complete obligation mapping with RACI
[Priority: HIGH if high-risk / MEDIUM if limited risk]
4. → Generate formal assessment documentation
[Priority: HIGH for regulatory files / MEDIUM for internal tracking]
5. → Engage legal counsel for:
[List specific areas requiring legal judgment]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚠ This preliminary assessment was generated using the AI Act Quick
Assessment tool. It provides directional guidance only. All
determinations marked "Likely" require validation through the
detailed assessment skills listed above.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Phase 4: Template Offer (Optional)
After presenting the preliminary assessment, offer:
"Would you like me to generate a preliminary version of any of the following templates? These will be marked as preliminary and should be finalized after running the full assessment skills."
- Classification Record (Prüfprotokoll) — preliminary audit trail
- Compliance Register Entry — preliminary obligation tracker
- Management Briefing (Entscheidungsvorlage) — preliminary decision document
If requested, produce these as preliminary versions of the standard compliance-documentation templates, and mark all outputs prominently as "PRELIMINARY — Full assessment recommended."
Critical Reminders
- This is a triage tool — always recommend a full assessment (classification, role determination, obligation mapping, formal report) before any compliance decision
- "Likely" is not "confirmed" — preliminary determinations require validation
- Err on the side of caution — if uncertain between risk tiers, flag the higher risk tier as possible
- Flag uncertainty explicitly — Low confidence ratings require immediate follow-up with a full assessment
- National requirements matter — always flag jurisdiction-specific obligations using [references/jurisdiction-flags.md]
- Compliance timeline — reference [references/compliance-deadlines.md] for deadline urgency
- Enforcement exposure — for penalty context, note the Art. 99 tiers: up to €35M / 7% of worldwide annual turnover for Art. 5 prohibited-practice violations, and €15M / 3% for other infringements
Part of the EU AI Act suite
This skill works on its own, but it's designed to interlock with my other EU AI Act skills — install any individually, or use them together for an end-to-end workflow:
- EU AI Act System Classifier — risk-tier classification across all five tiers
- EU AI Act High-Risk Classifier — depth Annex I / Annex III assessment
- EU AI Act Role Determination — provider / deployer / importer / distributor (incl. Art. 25)
- EU AI Act Obligations Mapper — obligations by role and risk tier
- EU AI Act Examination Report Generator — audit-ready compliance report
- EU AI Act Knowledge Base — Q&A over the Act + Commission guidelines
Each is available as a separate skill — install only what you need.