Qualify an AI system and the role of each entity

The published method shows the order of the tests. The client record retains the facts, evidence, provision applied and reasoning leading to the conclusion. Another reviewer must be able to understand what was decided, for which version and within which limits.

Object

One bounded system, version and use

Conclusion

In scope, out of scope or point for determination

Authority

Provision, source and consultation date

Review

Named trigger, owner and due date

A product name, the presence of a model or the word “AI” in a contract does not define the boundary. We isolate the chain that receives inputs, infers how to produce an output and influences a physical or virtual environment, then test the material and territorial scope under Article 2.

Architecture

Components, rules, models, data and interfaces

Autonomy

Independence of action from human intervention

Inference

Mechanism that determines how the output is produced

Effect

Influential prediction, content, recommendation or decision

Intended purpose comes from the provider; actual use comes from operation. We record them separately before reaching a risk conclusion. The sector alone is not enough: Annex III identifies specific use cases and conditions.

• System — identify the function and version under review.
• Action — state what the output recommends, triggers or executes.
• Population — name the people or groups affected.
• Context — specify the process, territory and operating conditions.
• Human — establish who interprets, confirms, contests or stops the output.

Each gate produces an answer, a regulatory basis and a record. A “no” does not always end the analysis: a system that is not high-risk may still fall under a prohibited practice, a transparency duty or another body of law.

• Scope — Article 2: operator, territory, placing on the market, putting into service and exclusions.
• Definition — Article 3(1): the seven elements of an AI system.
• Prohibitions — Article 5: purpose, capabilities, actual use and exceptions.
• Annex I — Article 6(1): safety component or product and third-party assessment.
• Annex III — Article 6(2)–(4): listed use, filter, profiling and documented rationale.
• Additional regimes — Article 50, general-purpose AI models, GDPR and sector law.

For an Annex III use case, the exception first requires no significant risk to health, safety or fundamental rights, including no material influence on decision-making. One of the following four conditions must then be demonstrated.

A role is not assigned to a corporate group as a whole. It is qualified for one legal person, one system and one market or operating act. The same organisation may therefore hold different roles for different objects.

Purchasing or configuring a tool does not automatically transfer provider duties. For high-risk systems, Article 25 identifies precise role changes that must be established from evidence.

Qualification identifies the regime; the date determines which provisions already apply, transitional measures and the next deadline. Regulation (EU) 2026/1744 notably separated the two high-risk routes.

The deliverable separates established facts, regulatory analysis and points for determination. It becomes the baseline for the requirements–controls–evidence matrix and remains tied to the version actually in operation.

• Technical reference — identifier, architecture, components and versions.
• Use — intended purpose, actual use, population and decision influenced.
• Entities — role reached, triggering act and corresponding records.
• Regimes — tests performed, provisions applied and reasoned exclusions.
• Conclusion — result, uncertainty, approver and date.
• Review — change trigger, owner and next review.