The answer, in detail

When is legal AI high-risk?

• When it is intended to be used by a judicial authority, or on its behalf, to assist it in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or in a similar way in alternative dispute resolution.
• Chapter III, Sections 1, 2 and 3, which hold the high-risk requirements and the deployer duties of Article 26, apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III, with the exception of Article 6(5) (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744).

• Point 8(a) of Annex III: AI systems intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution.
• Article 6(3): by derogation from Article 6(2), an Annex III system is not considered high-risk where it does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making. That applies where any one of four conditions is fulfilled: the system is intended to perform a narrow procedural task; it is intended to improve the result of a previously completed human activity; it is intended to detect decision-making patterns or deviations from prior decision-making patterns and is not meant to replace or influence the previously completed human assessment, without proper human review; or it is intended to perform a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III. An Annex III system that performs profiling of natural persons is always considered high-risk, and a provider who considers an Annex III system not high-risk documents that assessment before placing it on the market or putting it into service, and is subject to registration under Article 49(2) (Article 6(4)).

What does a firm that builds its own tool owe?

• A firm that offers an AI tool to clients under its own name is its provider (Article 3, point (3)).
• If the tool talks to clients directly, Article 50(1) is the provider’s duty.
• Article 50 applies from 2 August 2026, the general date in Article 113, second paragraph, except that a provider of a system generating synthetic audio, image, video or text content placed on the market before that date has until 2 December 2026 to comply with Article 50(2) (Article 111(4)).

• Article 50(1): the provider of an AI system intended to interact directly with natural persons designs and develops it so that they are informed they are interacting with an AI system, unless this is obvious from the point of view of a natural person who is reasonably well-informed, observant and circumspect, taking into account the circumstances and the context of use. The duty does not apply to systems authorised by law to detect, prevent, investigate or prosecute criminal offences, subject to appropriate safeguards, unless they are available for the public to report a criminal offence.
• Article 50(4): a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake discloses that the content has been artificially generated or manipulated. Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the duty is limited to disclosing the existence of such content in an appropriate manner that does not hamper the display or enjoyment of the work. A deployer of an AI system that generates or manipulates text published with the purpose of informing the public on matters of public interest discloses that too, unless the text has undergone human review or editorial control and a natural or legal person holds editorial responsibility for its publication. Neither duty applies where the use is authorised by law to detect, prevent, investigate or prosecute criminal offences.

What applies to every use?

• Article 4 on AI literacy, for lawyers, paralegals and anyone else working with the tools on your behalf.
• Chapters I and II, which hold Articles 4 and 5, apply from 2 February 2025 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744).
• That point keeps two later dates: Article 5(1), first subparagraph, points (ba) and (bb) apply from 2 December 2026, as do Article 5(1a) and (1b).

• Article 4(1), as replaced by Regulation (EU) 2026/1744: providers and deployers of AI systems take measures to support the development of AI literacy of their staff and of other persons dealing with the operation and use of AI systems on their behalf, taking into account their technical knowledge, experience, education and training and the context of use, and considering the persons or groups of persons on whom the systems are to be used. The obligation does not require them to guarantee any specific level of AI literacy of any individual.

Your customer asks. You answer with proof.

1. 1List every AI system
   Illustration · not your dataSystem Customer support chatbotClass Limited risk · Article 50(1)

   Add the AI you use. Each system gets a role, a risk class and the article it rests on.

   Live
2. 2Attach the proof
   Illustration · not your dataDuty Article 26(6), keep the logsProof logging-policy.pdf · page 3

   Link each duty to a file and the page it stands on: a policy, a log setting, a training record.

   Live
3. 3Answer their questionnaire
   Illustration · not your dataQuestion Do you log AI decisions?Answer drafted from your own proof

   Answering a customer's questionnaire inside the app, from the proof you already linked.

   Coming soon

• AI inventoryLive
• Risk classificationLive
• Article mappingLive
• Obligations per systemLive
• DeadlinesLive
• Annex IV documentationLive
• Documentation draftingLive
• Regulatory change monitoringLive
• Named ownersLive
• Export (PDF, JSON, spreadsheet)Live
• Evidence managementLive
• DashboardLive
• AI literacy (Article 4)Live
• Two-factor sign-inLive
• Audit logLive
• Audit packComing soon
• Customer questionnaires (audit room)Coming soon
• Domain-specific guidanceNot supported
• Full risk-management lifecycleNot supported
• Conformity assessment (Article 43)Not supported
• Post-market monitoring (Article 72)Not supported
• Serious incident reporting (Article 73)Not supported
• Fundamental rights impact assessment (Article 27)Not supported
• Declaration of conformity (Article 47)Not supported
• EU database registration (Article 49)Not supported
• ISO/IEC 42001 mappingNot supported
• Vendor managementLive

Read next

• For your own systems, one by one: Get your free readiness review.
• By tool and industry: the EU AI Act by tool, industry and country, and next to this one Is AI in logistics and warehousing covered by the EU AI Act and Is AI credit scoring high-risk under the EU AI Act.
• The role question first: am I a deployer if we just use ChatGPT at work?
• The duties once a use is high-risk: what a deployer owes under Article 26.
• What a classification records: risk classification.