Platform / Role and classification
Separate what your organisation does from the risk of the system.
Provider, deployer, importer and distributor are not organisation-wide labels. The role and classification need to be reasoned for each system and intended purpose—and they answer different questions.
Product demonstration · 1 minute 59 seconds
Manage the AI lifecycle
Follow a hypothetical AI system through inventory, exposure, role, classification, ownership, obligations, evidence and controlled lifecycle decisions. All organisations, people and systems shown were created for demonstration, and no client data appears.
Watch on its own page with the full transcriptRead the video transcript
An AI system should not move from an idea into live use simply because a team feels ready. EU AI Fit turns that journey into a controlled, reviewable process. The portfolio shows every recorded AI system, its current lifecycle stage, accountable owner, exposure position, and reviewed classification. Teams can see what exists before deciding what should happen next. Inside each system record, accountability is explicit.
An owner is nominated, but responsibility only becomes active when that person accepts it. The record then connects intended use with the organisation's regulatory role, AI Act classification, and current exposure assessment. Before a system can progress, EU AI Fit checks the relevant governance foundations. These can include accepted ownership, approved role and classification decisions, a current exposure check, an obligation and evidence plan, and an operational risk review.
If something is missing, the blocker is shown before a stage request can move forward. A lifecycle change is a controlled decision. The requester records the reason. An owner or administrator reviews the evidence and approves or rejects the transition. The decision, reviewer, date and rationale remain in the history. Production is not the end of governance. Risks stay connected to controls, evidence and accountable people.
Monitoring indicators record what the team will observe, how often it will be reviewed and when escalation is required. Incidents and material changes can trigger reassessment. The result is a clear operating trail from discovery and pilot through production, suspension or retirement. EU AI Fit supports the workflow and evidence record. It does not certify compliance or replace qualified legal or regulatory judgement.
Why this matters
A dropdown answer is not a reviewable classification.
A business may deploy one supplier's tool while providing another AI-enabled product under its own trade mark. Contract terms, intended purpose, modifications and operational control can all affect the analysis.
The classification then considers prohibited practices, high-risk rules, transparency duties and other applicable obligations. EU AI Fit keeps the answers, assumptions and reasoning alongside the selected conclusion.
Who it is for
The people who supply facts, challenge assumptions and approve the conclusion.
- System owners preparing a classification
- Legal, compliance and product reviewers
- SaaS teams that both build and buy AI
- Independent specialists reviewing a frozen record
How the work moves
Reason from the organisation's conduct to the system's classification.
- 01
Establish the operator role
An approved exposure map does not approve the operator role. Examine development, branding, market placement, contractual chain, substantial modification and who uses the system under their authority.
- 02
Test the risk framework
Assess prohibited practices, Annex I and Annex III high-risk routes, exceptions and applicable transparency triggers.
- 03
Record the reasoning
Keep sources, material facts, assumptions, unresolved questions and the rule version behind the proposed conclusion.
- 04
Approve or escalate
Contributors prepare the facts; an Owner or Administrator approves the role before classification can proceed. Classification requires its own approval. The workspace explains the reviewer handoff; specialist review remains a separately arranged step where needed.
In this scenario
A SaaS company adds a third-party model to its own product
The model supplier provides the underlying capability, but the SaaS company defines the feature, intended purpose and customer experience.
The role analysis considers the AI system offered under the SaaS company's name rather than assuming that only the model developer can be a provider.
The classification record then examines the customer's intended use, affected people and any Article 50 interaction or content trigger.
The approval records the conclusion, its scope and the facts that would make it stale. It avoids an unsupported organisation-wide label.
What is retained
Preserve the conclusion and the reasoning that supports it.
Where the facts or interpretation remain uncertain, the same record can be frozen for specialist review.
- Proposed and approved operator role
- Classification conclusion with rationale
- Official sources and rule version
- Assumptions and missing information
- Reviewer, approval and reassessment history
Source basis
The official material behind the workflow.
Source review updated 31 August 2026. Read our editorial and regulatory review policy, check the current source and obtain qualified advice for your circumstances.
- Regulation (EU) 2024/1689
The official consolidated legal text, including the 2026 amendments, and starting point for every assessment.
- Article 6 classification rules
The official high-risk classification routes and documentation requirements.
- Annex III
The listed high-risk use areas and connected provisions.
Next step
Make the conclusion inspectable.
Keep the facts, judgement and approval together so the organisation can explain—and revisit—its position.
Discuss classification review