Lab — Portfolio Classification Exercise

COMPEL Specialization — AITB-RCM: EU AI Act Risk Classification Specialist Lab 1 of 1

Lab objective

Apply Articles 2, 3, 5, 6, and 50 of Regulation (EU) 2024/1689 to a portfolio of ten AI use cases. Produce a classification-register extract with Article citations, and a one-paragraph derogation memo for any Article 6(3) derogation asserted.

Prerequisites

• Completion of Articles 1–6 of this credential.
• Access to the text of Regulation (EU) 2024/1689 (recommended: the consolidated EUR-Lex version).

Portfolio — ten use cases

Treat each use case as the full scope statement. Where additional facts would change the classification, note the dependency in the register.

Case A. A Spanish retail bank develops an internal large-language-model-based assistant that answers call-centre agents’ questions about product terms. The assistant reads internal policy documents at query time and does not interact with customers.

Case B. A German industrial manufacturer integrates a computer-vision model developed in-house into an autonomous forklift deployed in its warehouse. The forklift moves pallets and uses the model to detect obstacles and human workers in its path.

Case C. A French medical-device company develops an AI-based chest X-ray triage tool marketed under the MDR for Class IIa risk-assessment support. The tool flags likely pneumonia cases to radiologists.

Case D. An Irish subsidiary of a US consumer-tech company deploys a chatbot on its EU-facing customer-service website. The chatbot is powered by a US-based LLM API. The subsidiary does not fine-tune the model; it uses the API with a system prompt.

Case E. A Dutch municipality uses a commercial off-the-shelf AI system that scores citizens applying for housing support on a composite risk indicator. The indicator is used by caseworkers to prioritise home visits.

Case F. An Italian recruitment agency uses an AI tool that scans inbound CVs and pre-sorts them into pipelines based on declared language (EN / IT / other). The tool does not assess candidates; it routes by language field.

Case G. A Polish retailer uses an AI tool that analyses in-store CCTV to infer whether shoppers are adults or minors, for enforcement of age-restricted product access (alcohol, tobacco).

Case H. A Belgian HR technology vendor develops an AI-based workplace-monitoring tool that analyses office-badge entry times and keyboard activity to infer employee wellbeing and flag burnout risk.

Case I. A European aerospace supplier fine-tunes an open-weight foundation model on its own technical documentation and releases the fine-tuned model internally for engineering support. The training compute for the fine-tune is ~10^23 FLOPs on top of the base model.

Case J. A Greek publishing house uses an AI-text-generation tool to draft news-adjacent social-media posts about current events. The posts are published under the publication’s brand without explicit AI disclosure.

Step-by-step method

For each case, run the workflow in the order taught in this credential:

1. Scope and role (Article 2 + Article 3 definitions). Identify the actor role(s) and the Article 2 trigger. Flag any Article 25 substantial-modification transfer.
2. Prohibition screen (Article 5). Run eight parallel screens. For any prohibited unless exception finding, draft a one-paragraph memo.
3. Article 6(1) Annex I pathway. Is the system a safety component of a product covered by Annex I legislation that requires third-party conformity assessment? If yes — classify high-risk with Annex I anchor.
4. Article 6(2) Annex III pathway. Does the system fall within any of the eight Annex III domains, with a specific sub-point anchor?
5. Article 6(3) derogation. Does the system meet one of the four factual tests and not perform profiling and plausibly not pose significant risk?
6. Article 50 transparency. Does the system fall within any of the five Article 50 classes?
7. GPAI layer (Articles 51–55). Is the organisation a GPAI provider or downstream integrator for this use case?
8. Classification register row. Produce the six-field entry from Article 3 of this credential.

Worked answers — assess your own work against these

The answers below represent the classification the Methodology Lead would expect to see. Minor variations in defensible framing are acceptable; major divergences indicate a need to rework the case against the Article text.

Case A — internal call-centre assistant

• Role: deployer (of the upstream LLM) and, arguably, provider of the wrapped system under its own authority but not placed on the market.
• Article 5: no prohibition.
• Article 6(1): no Annex I trigger.
• Article 6(2): no Annex III trigger — agent assistance in a call centre is not itself employment decision-making at the point of Annex III point 4.
• Article 6(3): not reached.
• Article 50: the assistant does not interact directly with natural persons (end customers) — the agent is the human in between. Article 50(1) does not attach.
• GPAI: downstream deployer of GPAI-based product.
• Classification: minimal-risk. Register row: Classification: minimal-risk; Article cites: not covered by Arts. 5, 6, 50 based on scope; Reassessment trigger: if the assistant begins to answer customer queries directly.

Case B — autonomous forklift computer-vision model

• Role: provider of the AI system (under own name or trademark) and provider of the composite product.
• Article 5: no prohibition.
• Article 6(1): Annex I — Machinery Regulation (EU) 2023/1230. Obstacle-avoidance vision is a safety component of the machinery. Machinery class requires third-party conformity assessment depending on the harmonised-standard coverage; even where internal assessment suffices under the machinery regime, the AI Act obligations of Articles 9–15 apply.
• Article 6(2): not primary pathway; Article 6(1) captures.
• Article 6(3): not applicable; Annex I not subject to 6(3).
• Article 50: no trigger.
• Classification: Annex I high-risk. Register row: Classification: Annex I high-risk; Article cites: Art. 6(1); Annex I: Machinery Regulation (EU) 2023/1230; Reassessment trigger: change to intended purpose or safety-component boundary.

Case C — AI-based chest X-ray triage tool

• Role: provider.
• Article 5: no prohibition.
• Article 6(1): Annex I — Medical Devices Regulation (EU) 2017/745, Class IIa. MDR requires notified-body involvement at Class IIa. Third-party conformity assessment applies.
• Article 6(2): Annex III point 5(c) essential-services (health) is secondary; Article 6(1) primary classification.
• Article 50: no trigger.
• Classification: Annex I high-risk (MDR Class IIa). Register row: Classification: Annex I high-risk; Article cites: Art. 6(1); Annex I: MDR (EU) 2017/745 Class IIa; Reassessment trigger: intended-purpose change, re-training, Class reclassification.

Case D — EU-facing customer-service chatbot on US LLM

• Role: deployer of the upstream GPAI system (Article 26); the upstream provider is a GPAI provider subject to Articles 53–55 and Article 54 authorized representation.
• Article 2: Article 2(1)(c) long-arm reach — the US LLM provider is in scope for output used in the EU.
• Article 5: no prohibition (no subliminal / manipulation / emotion-in-workplace).
• Article 6(1): no Annex I.
• Article 6(2): depends on the business of the Irish subsidiary. If the “consumer-tech” sits within essential services (Annex III point 5), the chatbot could be high-risk. Absent further facts, not presumed.
• Article 50(1): triggers. Provider must design the chatbot to disclose AI nature to the user unless obvious from context.
• GPAI: upstream provider has Chapter V duties. The Irish subsidiary is downstream deployer and has Article 26 duties.
• Classification: limited-risk (Article 50 transparency). Register row: Classification: limited-risk; Article cites: Art. 50(1); Reassessment trigger: change of business scope into Annex III point 5, or substantial modification of the system.

Case E — municipal housing-support risk score

• Role: deployer (the municipality); provider is the commercial vendor.
• Article 5(1)(c) social scoring screen: public authority — yes. Risk score — yes. Leading to detrimental treatment in unrelated contexts — depends on facts. If the indicator is used only in the housing-support context (the context from which the data were generated), 5(1)(c) arguably does not attach. If it leaks into unrelated enforcement contexts, it does.
• Article 6(2): triggers. Annex III point 5(a) — access to public services — captures public-authority eligibility / priority tools. This is high-risk absent the Article 6(3) derogation.
• Article 6(3): not available — the tool influences the caseworker decision (risk-based prioritisation of home visits). The tool therefore fails the “no significant risk” / “profiling” counter-exception.
• Article 50: no trigger.
• Classification: Annex III high-risk. Register row: Classification: Annex III high-risk; Article cites: Art. 6(2), Annex III point 5(a); Reassessment trigger: change of intended purpose, removal of profiling logic, expansion to unrelated contexts (Art. 5(1)(c) revisit).
• Article 27 FRIA is required before first use.

Case F — CV language-routing tool

• Role: deployer.
• Article 5: no prohibition.
• Article 6(2): Annex III point 4 (employment, workers management). The tool is used in recruitment.
• Article 6(3): possibly defensible. Test: narrow procedural task (routing by declared-language field). The tool does not assess candidates; it sorts by a single factual field the candidate provided. No profiling counter-exception.
• Article 6(3) registration: required before first use.
• Classification: Article 6(3) derogation — not high-risk. Register row: Classification: Annex III-derogated non-high-risk; Article cites: Art. 6(2), Annex III point 4; Art. 6(3) test (a) narrow procedural task; Derogation memo: one paragraph; Reassessment trigger: any change to include candidate assessment rather than routing.

Case G — CCTV age-verification for restricted products

• Role: deployer.
• Article 5(1)(g) biometric-categorisation-to-infer-sensitive-attribute screen: age-range categorisation may or may not count as a sensitive attribute; the Commission’s guidance will refine. Absent categorisation by the specific attributes enumerated (race, political opinions, etc.), 5(1)(g) does not prima facie attach. Screen is marginal, not prohibited.
• Article 6(2): Annex III point 1 — biometrics. Triggers.
• Article 6(3): not available — the system directly determines whether the shopper can purchase, so it materially influences the outcome of decision-making on the individual. Derogation fails.
• Article 50(3): deployer transparency duty — must inform natural persons exposed to the biometric categorisation.
• Classification: Annex III high-risk (Annex III point 1) with Article 50(3) duty. Register row: Classification: Annex III high-risk; Article cites: Art. 6(2), Annex III point 1, Art. 50(3); Reassessment trigger: switch to non-biometric age-verification.

Case H — workplace-monitoring wellbeing/burnout tool

• Role: vendor is provider; customer employer is deployer.
• Article 5(1)(f) emotion-recognition-in-workplace screen: the tool infers wellbeing / burnout risk. “Emotion recognition” under Article 3(39) covers inferring emotions or intentions of persons from their biometric data. The tool uses badge-entry and keyboard data, not biometric data strictly speaking. 5(1)(f) turns on whether the inputs are biometric; marginal screen.
• The Italian Garante’s position suggests that affective-computing in employment carries a near-insurmountable proportionality challenge even where 5(1)(f) does not formally attach.
• Article 6(2): Annex III point 4 (workers management, performance / behaviour evaluation). Triggers.
• Article 6(3): not available — profiling of natural persons is the entire function.
• Classification: Annex III high-risk (point 4) with likely Article 5(1)(f) exposure requiring legal review. Register row: Classification: Annex III high-risk (with Art. 5(1)(f) exposure to resolve); Article cites: Art. 6(2), Annex III point 4, possible Art. 5(1)(f); Reassessment trigger: Commission guidance on 5(1)(f) inputs.

Case I — fine-tuned open-weight foundation model for internal use

• Role: the organisation is provider of the derivative model via Article 25 substantial-modification transfer if the fine-tune changes intended purpose or materially changes behaviour.
• GPAI threshold: 10^23 FLOPs for the fine-tune is well below the 10^25 systemic-risk threshold. The organisation is not a GPAI-with-systemic-risk provider.
• Whether the organisation is a GPAI provider at all depends on the scope definition in Article 3(63) — does the fine-tuned model display significant generality? If yes, the organisation is a GPAI provider with Article 53 duties for the derivative. If the fine-tune narrows the model’s capability substantially, it is an AI system, not a GPAI model, and the organisation holds system-level obligations instead.
• Internal use — Article 2(1)(b).
• Classification: scope-dependent; register the fine-tune and set a reassessment trigger for external release. Register row: Classification: under review; Article cites: Art. 3(63), Art. 25, Art. 53 (if applicable); Reassessment trigger: external release, or capability expansion post fine-tune.

Case J — AI-generated news-adjacent social-media posts

• Role: deployer (the publishing house).
• Article 5: no prohibition.
• Article 6(2): not presumed — journalistic AI content is not enumerated in Annex III.
• Article 50(4): deployers of AI systems generating or manipulating text published to inform the public on matters of public interest must disclose that the text is AI-generated — unless the text has undergone human review and someone holds editorial responsibility. Triggers.
• Classification: limited-risk (Article 50(4)). Register row: Classification: limited-risk; Article cites: Art. 50(4); Reassessment trigger: introduction of human editorial review sufficient to displace the duty, or expansion to content influencing specific persons falling into other regimes.

Scoring

Submission

Submit the classification-register extract (ten rows) and the per-case derogation or prohibition memos (where applicable) to the in-platform exam system. Auto-grading covers the Article citations; Methodology Lead reviewers cover the memos.