Does it do any of these? These uses are banned under the EU AI Act. Most systems match none.
Scores people on social behavior or personal traits, leading to unfair treatment
Manipulates people or exploits their age, disability, or financial situation in ways that cause harm
Recognizes emotions of employees or studentsMedical and safety uses are allowed
Infers race, religion, politics, sexual orientation, or union membership from biometric data
Scrapes face images from the internet or CCTV to build facial recognition databases
Predicts whether someone will commit a crime based only on profiling
Identifies people in real time from biometrics in public spaces for law enforcement
Generates sexual images of real people without consent, or child sexual abuse material
None apply? Leave them all unchecked and press Next.
Is it used in any of these areas? These are the high-risk areas. Check any that apply.
EmploymentHiring, promotion, firing, task allocation, monitoring performance
Access to essential servicesPublic benefits, credit scoring, life and health insurance pricing, emergency call triage
EducationAdmissions, grading, assigning level, monitoring tests
Identifies or categorizes people from biometrics, or recognizes emotions
Safety component of a regulated productMedical devices, machinery, toys, vehicles, lifts, and similar
Safety of critical infrastructureEnergy, water, gas, heating, traffic, digital infrastructure
Law enforcement
Migration, asylum, or border control
Courts, legal decisions, or influencing elections
Who it touches Check everything that's true.
People talk to it directly, like a chatbot or voice assistant
It generates images, audio, video, or text that people outside the company see
It creates realistic fake images, audio, or video of people or events
It uses personal data
It makes or supports decisions about people
Customers or the public use it or see its output
What's already in place Check what you have today. Anything missing shows up as a gap.
A named owner who's accountable for it
An acceptable use policy that covers it
Testing before release, or the vendor's test results reviewed
A person reviews outputs before they affect anyone
Inputs and outputs are logged
The vendor contract covers AI, data use, and incidents
A process for AI incidents and complaints
An impact assessment on the people it affects