How Obligia decides
A structured way to find out what the EU AI Act asks of your organisation, system by system: whether you are a provider or a deployer, which risk tier each system falls into, the obligations that attach and when, and what you will need to have ready.
It is built for the moment someone asks “we’ve started using AI — what does the AI Act mean for us?” and you need to get from a vague description to a structured answer without missing anything. It is an initial assessment. A Dentons lawyer can review it with you and turn it into advice.
The five questions it works through
These are asked in order, because each one can end the analysis.
Art. 2Is the Act engaged at all?Whether there is an EU nexus — the system is placed on the EU market, put into service or used in the Union, or its output is used here — and whether one of the general exclusions applies, such as pure research, pre-market testing or military use. If not, the analysis stops.
Art. 3(1)Is this actually an “AI system”?A great deal of what gets called AI is not, as a matter of law. Rule-based automation, ordinary statistics, optimisation and classical heuristics fall outside the definition. Getting this wrong in either direction wastes everyone’s time.
Art. 5Is the practice prohibited?The eight practices banned since February 2025, plus the new ban on generating intimate imagery or child sexual abuse material, which applies from 2 December 2026. These carry the highest penalties. The one that catches ordinary businesses is inferring employees’ emotions in the workplace.
Art. 6Is it high-risk?Both routes: systems embedded in regulated products, and the eight listed areas — biometrics, critical infrastructure, education, employment, essential services such as credit scoring and insurance pricing, law enforcement, migration, and the administration of justice. Where a listed system genuinely does something narrow or merely preparatory, the tool also puts the exception to you — and tells you what relying on it then costs in documentation and registration. It also asks whether the system is already in service, because the Digital Omnibus leaves existing systems outside the high-risk rules unless their design changes.
Art. 50Does anything have to be disclosed?The transparency duties — telling people they are talking to a machine, marking AI-generated content, disclosing deepfakes and AI-written material published on matters of public interest. In force since 2 August 2026, so live law today rather than a future deadline, and they apply whatever the risk classification.
Provider or deployer — who owes what
Most of the difficulty in practice is not the risk class. It is working out whether your organisation is the provider of a system or merely its deployer, because almost every substantive obligation follows that distinction, and organisations are routinely wrong about which one they are. Obligia works it out from how you obtained the system and what you did with it, and shows you the reasoning. Four traps it is specifically built to catch:
Art. 3(11)Building something only for internal use still makes you a provider.“Putting into service” expressly covers supply for your own use. A tool you built for your own staff, and never sold to anyone, still carries provider obligations. This is the single most commonly missed answer.
Art. 25(1)(c)Repurposing a bought tool can flip you into being its provider.Take a general-purpose tool, point it at something in the high-risk list — screening CVs is the classic — and you become the provider of a high-risk system, with the whole provider regime attaching. The vendor’s compliance paperwork will not cover you for that new purpose, although Art. 25(2) now obliges the vendor to cooperate unless its terms excluded high-risk use.
Art. 50(1)–(2)Buying a tool does not hand you the vendor’s duties.Marking generated content and disclosing the AI interface are the provider’s obligations. If you merely deploy the tool you do not owe them, and putting them on your action list would simply be wrong. Obligia separates these out and reframes them as a point to check with the vendor.
Art. 3(63)Using a model through an API does not make you a model provider.Prompting, retrieval and wrapping a third-party model in an interface stay far below the threshold at which someone becomes responsible for the model itself. Those obligations sit upstream.
What you get at the end
VerdictA classificationWith the reasoning that produced it and the date from which it bites, so you can see and challenge the logic rather than take it on trust. While anything is unanswered it says so.
DutiesAn obligations tableEvery duty that attaches, against the Article it comes from, marked as yours as provider or as deployer, with its date and whether it is already in force.
EvidenceWhat to have readyThe documents, records and sign-offs that would have to exist, obligation by obligation. Tick what you already hold; what is left is the gap.
Open pointsWhere the law is unsettledAnd where the answer turns on a judgement that a lawyer should make with you rather than the tool alone.
The result can be printed, copied into a document, or sent to Dentons for review.
How it decides — and why that matters
The language model gathers the facts. Fixed rules decide the law.When you describe your systems in your own words, the model does one job: it turns your description into structured facts and asks the next useful question. It never decides the risk class, never chooses an obligation and never supplies a date. That is done by rules written against the Regulation. The same facts therefore always produce the same answer, every conclusion points at an Article, and the tool cannot invent a duty that does not exist.
Anything you have not said is shown as an open question rather than quietly assumed — so a thin description produces an openly incomplete assessment, not a confident wrong one. Where the model has read a high-risk area or a banned practice out of your words, the verdict says “likely” or “possible” until you confirm it. Questions that are pure legal judgement are marked your call and put to you directly; the model is not allowed to answer them. You can also ignore the conversation entirely and simply click through the questions. The assessment is identical either way.
Where it stops
- It covers the Regulation, not national law. Which authority supervises, how penalties are set and where notifications go differ by Member State, and several are still late. That needs local counsel in each jurisdiction.
- It does not do the sectoral overlay — medical devices, vehicles, financial services and the rest — or a data protection analysis beyond noting where the impact assessment hooks in. Products regulated under Section B of Annex I are flagged and left to sectoral advice.
- It is an initial assessment, not legal advice. It structures the analysis from the facts you enter; it does not replace a lawyer’s judgement on those facts, and using it does not create a lawyer–client relationship. Dentons lawyers can review the result with you.
Who is behind it
Obligia is operated by Dentons Europe Innovation & Intelligence, working with the firm’s Intellectual Property, Data and Technology lawyers across Europe. If you would like the assessment reviewed, use Talk to Dentons at the top of the page or at the end of any report.
Law stated as at 20 September 2026 — Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since 27 July 2026.