EU AI Act scoping: is your AI system covered, and in what role?

Scope the EU AI Act with four questions: does the system meet the Act's definition of an AI system, are you a provider or a deployer, does it fall in a prohibited, high-risk, transparency or minimal tier, and which application dates apply. Dates for high-risk duties moved in July 2026, so check them before you plan.

Question 1: is it an AI system under the Act?

Regulation (EU) 2024/1689 defines AI systems in Article 3. Do not assume every analytics script counts, and do not assume your vendor's label settles it. List each system in a register with purpose, inputs, outputs, who uses it and where. Include tools built by others that you only use, such as a screening product or a chatbot embedded in your site. The register is the base for every later question.

Question 2: provider or deployer?

The Act separates roles. A provider develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark. A deployer uses an AI system under its authority, except for personal non-professional use. One company can be both for different systems, and you can become a provider by putting your own name on someone else's system. Write the role next to each register entry, because the duties differ. Importers and distributors have roles too; check Article 3 if they apply.

Question 3: which tier?

• Prohibited practices (Article 5) have applied since 2 February 2025. Screen your list against them.
• High-risk systems come from two routes. Article 6(1) covers AI that is a safety component of, or is itself, a product under listed EU harmonisation law needing third-party conformity assessment. Article 6(2) covers the areas in Annex III, which include biometrics, critical infrastructure, education, employment and worker management, access to essential services such as credit, law enforcement, migration and the justice system. A provider that concludes an Annex III system is not high-risk under the Article 6(3) exceptions must document that and register it under Article 49(2).
• Transparency duties under Article 50 apply to systems that interact directly with people, among others, so people are told they are dealing with AI unless it is obvious.
• Everything else has no specific obligations beyond AI literacy under Article 4.

Question 4: which dates?

The original text applied most duties from 2 August 2026. Regulation (EU) 2026/1744, published on 24 July 2026, amended the schedule. For high-risk systems under Article 6(2) and Annex III the date is now 2 December 2027, and for Article 6(1) and Annex I systems it is 2 August 2028. The amending regulation also sets 2 December 2026 as the date from which certain new prohibited practice provisions it adds apply, and gives providers of generative systems already on the market before 2 August 2026 until 2 December 2026 to meet the Article 50(2) marking duty. It rewrote Article 4 so that providers and deployers must take measures to support AI literacy without guaranteeing a specific level for any individual. Confirm each date against the Official Journal, since later amendments are possible.

Boundaries to document

Geographic reach (the Act can apply to non-EU providers whose output is used in the EU), exclusions such as purely personal use, and systems still in research. Write each exclusion with a reason, as you would in any scoping record.

What to do

1. Build the AI system register with owner, vendor, purpose and users.
2. Assign a role (provider or deployer) to each entry.
3. Screen every entry against Article 5.
4. Test each entry against Article 6 and Annex III and record the result and reasoning.
5. Flag customer-facing AI for Article 50 transparency.
6. Put the relevant application dates in a plan, and re-check them quarterly.
7. Name an owner for the register and require engineering and procurement to update it.

Quick check

How Safeguard helps automate this

A register is only useful if it stays current. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously, saving your team time for other work. Technical evidence comes from your real code and dependencies: scans, SBOMs and reachability, which can show which AI libraries and model SDKs your products actually include. Autonomous remediation can open tested fix pull requests for vulnerable dependencies; it is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. Classification of your systems is a legal judgement for you and your advisers; Safeguard does not make you compliant. Book a call.

Sources

• Regulation (EU) 2024/1689 (AI Act), EUR-Lex
• Regulation (EU) 2026/1744 amending it, EUR-Lex
• European Commission: AI regulatory framework

Last reviewed: 18 October 2026.