The first mistake is treating “AI in the company” as a single whole. According to iagovernance.com and Umbrex, you should first identify a specific system or use case: a product, a feature, an internal tool or a vendor solution, and only then check its place in the AI Act classification.
The Act is based on four levels: prohibited practices, high-risk systems, systems subject to transparency obligations and other low-risk uses. Industry sources analysing Regulation (EU) 2024/1689, including iagovernance.com and Gazeta Prawna, describe it the same way.
Start by inventorying all AI uses, including those hidden in vendor software. According to iagovernance.com, classification cannot be done without a complete list of systems, because otherwise it is easy to miss a solution that triggers AI Act obligations.
Next, check the prohibited practices in art. 5 before proceeding with further assessment. If a use case falls under a prohibition, the project should not be deployed or used in the EU; iagovernance.com and Umbrex emphasize this point.
The next step is to verify whether the system falls into the high-risk category under art. 6 and Annex III. According to iagovernance.com and Gazeta Prawna, this concerns cases linked to the areas indicated in the AI Act, not any tool the company considers “business important.”
In the self-assessment it is worth recording not only the result but also the reasoning. Umbrex indicates that you should collect product documentation, workflow, result samples, model description, industry context and legal assumptions, and then note why the system was considered prohibited, high-risk, subject to transparency or low-risk.
If the system is neither prohibited nor high-risk, check the transparency obligations. According to iagovernance.com and Gazeta Prawna, this applies to, among others, chatbots, AI-generated content and deepfakes, where the user should be informed they are interacting with AI or synthetic material.
Finally, translate the self-assessment result into actions: controls, documentation, tests, approvals, training and monitoring. Umbrex stresses that classification should lead to concrete operational steps, not end with a risk label.
In practice this means a simple sequence:
Lub System helps B2B companies implement AI, automation and IT solutions end-to-end - from strategy to deployment. See our services or get in touch to discuss your case.
Source: https://iagovernance.com/en/blog/classify-ai-systems-by-risk/