Every AI diligence list, procurement questionnaire and board deck now asks the same first question: where do your features fall under the AI Act? The answer is a one-page document we call the classification memo, and after writing dozens, we can describe the method precisely. It takes one focused afternoon.
Step 1. Inventory by feature, not by product
Classification attaches to AI systems and uses, not to your brand. List every feature that runs on a model: the support agent, the scoring engine, the recommender, the generation tool, the internal copilot. One row each. Most companies find 6–12 rows and at least one surprise a vendor turned on by default.
Step 2. Run the prohibition screen first
Check each row against the eight Article 5 patterns (our product-level screen). This tier has applied since February 2025 and fines top the scale; if anything lands here, stop and redesign before finishing the memo.
Step 3. High-risk check, two doors
Annex I door: is the AI a safety component of a regulated product (machinery, medical devices, vehicles)? Then it follows the product’s conformity route, with obligations from August 2028. Annex III door: does the use fall in a listed area; employment and worker management, credit scoring, education, essential services, critical infrastructure, insurance pricing (life/health), border and justice contexts? Then the high-risk regime applies from 2 December 2027, and if you are a deployer in the credit/insurance/public-service categories, a FRIA rides with it.
Step 4. Transparency tier
Anything conversational, generative or emotion/biometric-adjacent picks up the Article 50 duties from 2 August 2026: interaction disclosure, machine-readable marking, deepfake labelling. For most SaaS this is the tier that actually bites first.
Step 5. Role per row
For each feature: are you provider, deployer, importer or distributor? And did any fine-tuning push you into provider territory for a modification (the GPAI boundary)? Roles set which obligations are yours versus your vendor’s; this column is where most memos change the contract to-do list.
Step 6. Date the exposure
Close with one line per row: earliest binding date, owning team, and cost bucket (product change / documentation / contract). Sum the December 2027 rows; that number is your AI Act budget, and boards respond much better to it than to abstract risk language.
The memo skeleton
| Feature | Art. 5? | High-risk door | Art. 50? | Role | Earliest date | Owner |
|---|---|---|---|---|---|---|
| Support agent | No | ; | Yes: disclosure | Deployer | Aug 2026 | Product |
| CV ranking | No | Annex III (employment) | Yes | Deployer | Dec 2027 | HR + Legal |
Date it, sign it, revisit on every release that adds a model-driven feature. A stale memo is almost worse than none: it proves you knew the method and stopped applying it.
We prepare classification memos as a fixed-scope engagement; usually the first document investors open in AI diligence.
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro callMore from Vircon Insights
FRIA Without the Fog: Who Really Needs a Fundamental Rights Impact Assessment, and How to Run One on Top of Your KVKK DPIA
July 13, 2026When the Model Causes Harm: AI Incident Response Across the AI Act, KVKK and the New Product Liability Rules
July 28, 2026Deepfakes and Synthetic Content: Building One Product for Ankara’s Criminal Draft and Brussels’ Labelling Rules
July 17, 2026Türkiye's 12th Judicial Package Through a Technology Lens: The Full Map of Law No. 7589
August 10, 2026Türkiye's DPA Governs by Principle Decision: What the Accident Data and Guest ID Rulings Tell Product Teams
August 5, 2026From the ICTA to the Cybersecurity Presidency: Türkiye's New Digital Authority Map and the Two-Hour Rule
August 4, 2026Related Practice Areas
Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →Employment Law
Employment contracts, ESOP, termination, non-compete, work permits.
View service →