The answer, in detail

When is checkout credit high-risk?

• When the AI evaluates the creditworthiness of a natural person or establishes their credit score.
• Its deployer, the lender that uses it, then also performs a fundamental rights impact assessment before first use.
• Article 27 sits in Chapter III, Section 3, which applies from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).
• The sector view, banking and insurance together: is fintech AI high-risk under the EU AI Act?.

• Point 5(b) of Annex III: AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud.
• Article 27(1): before deploying a high-risk AI system referred to in Article 6(2), with the exception of one intended to be used in the area listed in point 2 of Annex III, deployers that are bodies governed by public law, or are private entities providing public services, and deployers of high-risk AI systems referred to in points 5(b) and (c) of Annex III, perform an assessment of the impact on fundamental rights that the use of the system may produce. It consists of a description of the deployer’s processes in which the system will be used in line with its intended purpose; the period of time within which, and the frequency with which, it is intended to be used; the categories of natural persons and groups likely to be affected by its use in the specific context; the specific risks of harm likely to have an impact on them, taking into account the information given by the provider under Article 13; a description of the implementation of human oversight measures, according to the instructions for use; and the measures to be taken if those risks materialise, including the arrangements for internal governance and complaint mechanisms.

What do chatbots and generated images owe?

• Disclosure.
• Article 3, point (60) defines a deep fake as AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful.
• A photorealistic image of a real product can be one; an image that could not falsely appear authentic is not.
• Article 50 applies from 2 August 2026, the general date in Article 113, second paragraph, except that a provider of a system generating synthetic audio, image, video or text content placed on the market before that date has until 2 December 2026 to comply with Article 50(2) (Article 111(4)).

• Article 50(1): the provider of an AI system intended to interact directly with natural persons designs and develops it so that they are informed they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The duty does not apply to systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards, unless they are available for the public to report a criminal offence.
• Article 50(4): a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake discloses that the content has been artificially generated or manipulated. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the duty is limited to disclosing the existence of such content in an appropriate manner that does not hamper the display or enjoyment of the work. A deployer of an AI system that generates or manipulates text published with the purpose of informing the public on matters of public interest discloses that too, unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication. Neither duty applies where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.

Can a shop’s AI be prohibited?

• When it manipulates or exploits in a way that causes or is reasonably likely to cause significant harm.
• Both points carry every condition, and a recommendation is not manipulation by itself.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).

• Article 5(1), first subparagraph, point (a): an AI system that deploys subliminal techniques beyond a person’s consciousness or purposefully manipulative or deceptive techniques, with the objective or the effect of materially distorting behaviour by appreciably impairing a person’s ability to make an informed decision, causing them to take a decision they would not otherwise have taken in a manner that causes or is reasonably likely to cause significant harm, is prohibited.
• Article 5(1), first subparagraph, point (b): an AI system that exploits the vulnerabilities of a natural person or a specific group of persons due to their age, disability or a specific social or economic situation, with the objective or the effect of materially distorting their behaviour in a manner that causes or is reasonably likely to cause significant harm, is prohibited.

Your customer asks. You answer with proof.

1. 1List every AI system
   Illustration · not your dataSystem Customer support chatbotClass Limited risk · Article 50(1)

   Add the AI you use. Each system gets a role, a risk class and the article it rests on.

   Live
2. 2Attach the proof
   Illustration · not your dataDuty Article 26(6), keep the logsProof logging-policy.pdf · page 3

   Link each duty to a file and the page it stands on: a policy, a log setting, a training record.

   Live
3. 3Answer their questionnaire
   Illustration · not your dataQuestion Do you log AI decisions?Answer drafted from your own proof

   Answering a customer's questionnaire inside the app, from the proof you already linked.

   Coming soon

• AI inventoryLive
• Risk classificationLive
• Article mappingLive
• Obligations per systemLive
• DeadlinesLive
• Annex IV documentationLive
• Documentation draftingLive
• Regulatory change monitoringLive
• Named ownersLive
• Export (PDF, JSON, spreadsheet)Live
• Evidence managementLive
• DashboardLive
• AI literacy (Article 4)Live
• Two-factor sign-inLive
• Audit logLive
• Audit packComing soon
• Customer questionnaires (audit room)Coming soon
• Domain-specific guidanceNot supported
• Full risk-management lifecycleNot supported
• Conformity assessment (Article 43)Not supported
• Post-market monitoring (Article 72)Not supported
• Serious incident reporting (Article 73)Not supported
• Fundamental rights impact assessment (Article 27)Not supported
• Declaration of conformity (Article 47)Not supported
• EU database registration (Article 49)Not supported
• ISO/IEC 42001 mappingNot supported
• Vendor managementLive

Read next

• For your own systems, one by one: Get your free readiness review.
• By tool and industry: the EU AI Act by tool, industry and country, and next to this one Is the AI we use in Workday covered by the EU AI Act and Is AI in logistics and warehousing covered by the EU AI Act.
• The role question first: am I a deployer if we just use ChatGPT at work?
• The duties once a use is high-risk: what a deployer owes under Article 26.
• What a classification records: risk classification.