Know what applies to you
Know which risk level each system you use is at, and why, with the rationale in writing.
Each system is placed at its risk level (P0–P6, Alethexis’s internal taxonomy, not the AI Act’s nomenclature), with the AI Act's own logic — prohibited practices and high risk — documented by the platform, case by case, with the rationale recorded.
Classification is what drives the rest of the product: it sets which controls apply, whether the FRIA is triggered and which transparency obligations there are. What is classified is what is in the inventory, so every active system in the inventory needs a current classification.
The DPIA is not decided by the classification: the criterion is the outcome of the Art. 35 GDPR screening recorded in the DPIA section. The FRIA and the DPIA are independent instruments.
For each system, the assistant goes through six steps —use, prohibited practices, data, context, autonomy, and transparency and general-purpose models— and the validator then applies the order from most to least serious: the first level that applies is the result. The capabilities you marked in the inventory suggest some answers: they come pre-ticked and you can untick them.
The platform calculates the classification with a validator. If your answers suggest one category but a rule of the Regulation redirects it —for example, a prohibited practice leads to P6—, the assistant explains why and the validator's result prevails. This avoids optimistic classifications.
Each paragraph of Art. 50 is labelled according to your organisation's role in the system: paragraphs 1 and 2 bind the provider and paragraphs 3 and 4 the deployer. Only a paragraph that binds what your organisation is leads to P3; one that binds the other party stays as verification diligence (IM) and does not raise the level. The role comes from the system and, if it has none, from the organisation; if it appears in neither, it is not presumed: the system stays at P3 and the section goes into review.
The rationale is built from your answers and you can edit it before closing. When the level derives from an article of the AI Regulation, the text cites it. Levels P1, P2 and P4 are Alethexis's own rules, an internal methodological control, and the text labels them “Alethexis classification”.
On confirming, a new version is saved and the previous one is archived, with a trace of both. If a capability of the system changes after it was classified, the classification goes into review until you redo it. The Owner and the AI Officer classify and close the section: on closing, the declaration is recorded with name, role, date and the hash of the content, and the label changes to “Approval recorded”.
The controls in the Alethexis catalogue that this feature helps to document, with their legal basis where they have one, and their nature.
For each system, persist the reasoning that leads to the final phase (P1 to P6): which nodes of the tree were answered yes or no, and why. Without traceable reasoning, a favourable classification cannot be defended before an audit or an authority.
Legal basis
No direct basis in law.
Determine, for each system, whether the organisation acts as deployer, provider or both (Articles 3(3) and 3(4)). The assessment governs which obligations apply and is persisted in the inventory for all subsequent workflows.
Legal basis
No direct basis in law.
Identify in the inventory which systems could fall within one of the eight points of Annex III (biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice and democratic processes). It is the step before risk classification (VIS-2).
Legal basis
No direct basis in law.
Data from the controls catalogue. The labels show the regulatory nature of each control; they are not a statement of compliance.