Every AI diligence list, procurement questionnaire and board deck now asks the same first question: where do your features fall under the AI Act? The answer is a one-page document we call the classification memo, and after writing dozens, we can describe the method precisely. It takes one focused afternoon.
Step 1. Inventory by feature, not by product
Classification attaches to AI systems and uses, not to your brand. List every feature that runs on a model: the support agent, the scoring engine, the recommender, the generation tool, the internal copilot. One row each. Most companies find 6–12 rows and at least one surprise a vendor turned on by default.
Step 2. Run the prohibition screen first
Check each row against the eight Article 5 patterns (our product-level screen). This tier has applied since February 2025 and fines top the scale; if anything lands here, stop and redesign before finishing the memo.
Step 3. High-risk check, two doors
Annex I door: is the AI a safety component of a regulated product (machinery, medical devices, vehicles)? Then it follows the product’s conformity route, with obligations from August 2028. Annex III door: does the use fall in a listed area; employment and worker management, credit scoring, education, essential services, critical infrastructure, insurance pricing (life/health), border and justice contexts? Then the high-risk regime applies from 2 December 2027, and if you are a deployer in the credit/insurance/public-service categories, a FRIA rides with it.
Step 4. Transparency tier
Anything conversational, generative or emotion/biometric-adjacent picks up the Article 50 duties from 2 August 2026: interaction disclosure, machine-readable marking, deepfake labelling. For most SaaS this is the tier that actually bites first.
Step 5. Role per row
For each feature: are you provider, deployer, importer or distributor? And did any fine-tuning push you into provider territory for a modification (the GPAI boundary)? Roles set which obligations are yours versus your vendor’s; this column is where most memos change the contract to-do list.
Step 6. Date the exposure
Close with one line per row: earliest binding date, owning team, and cost bucket (product change / documentation / contract). Sum the December 2027 rows; that number is your AI Act budget, and boards respond much better to it than to abstract risk language.
The memo skeleton
| Feature | Art. 5? | High-risk door | Art. 50? | Role | Earliest date | Owner |
|---|---|---|---|---|---|---|
| Support agent | No | ; | Yes: disclosure | Deployer | Aug 2026 | Product |
| CV ranking | No | Annex III (employment) | Yes | Deployer | Dec 2027 | HR + Legal |
Date it, sign it, revisit on every release that adds a model-driven feature. A stale memo is almost worse than none: it proves you knew the method and stopped applying it.
We prepare classification memos as a fixed-scope engagement; usually the first document investors open in AI diligence.
Sources. Regulation (EU) 2024/1689 (AI Act).
This article is for general information only and does not constitute legal advice. It reflects the position as of July 2026.
Author
More from Vircon Insights
The Regulator Will See You Now: How Startups Get Into the AI Act Sandboxes (Deadline Moved to August 2027)
August 25, 2026Your Users Are Younger Than Your Terms Say: Children, Age Assurance and AI Products
August 31, 2026Will Insurance Pay When the Model Is Wrong? E&O, Cyber and Product Liability for AI Companies
August 28, 2026A 12-Month Cap on Off-Exchange Share Sales: Rebuilding the Post-IPO Exit Plan
September 1, 2026Three Ways to Move Up the IPO Queue: Türkiye's New Priority Criteria
September 1, 2026English Is No Longer the Exception on KAP: The Process to Build Before 1 October 2026
August 31, 2026Related Practice Areas
Corporate Law
Share transfers, capital increases, board structuring, governance.
View service →US Company Formations & Flip-Ups
Delaware C-Corp, flip-up structures, SAFE/convertible notes, 83(b).
View service →Employment Law
Employment contracts, ESOP, termination, non-compete, work permits.
View service →