EU AI Act risk assessment with ISMS Copilot
Classify your AI system, run the Article 9 risk-management system, and prepare a fundamental-rights impact assessment.
Classifying and risk-assessing an AI system (Art. 9)
EU AI Act obligations follow classification, so ISMS Copilot starts there. It walks you through whether a system is prohibited, high-risk, limited-risk, or minimal-risk — and specifically whether it falls within an Annex III use case such as biometrics, critical infrastructure, employment, or access to essential services. Once a system is high-risk, Article 9 requires a risk-management system established, implemented, documented, and maintained across the entire lifecycle. ISMS Copilot helps you identify and analyse known and foreseeable risks, evaluate residual risk after mitigation, and record the iterative review Article 9 demands. For deployers in scope of the fundamental-rights impact assessment (FRIA), the assistant structures the assessment of impact on affected persons. Outputs cross-map to ISO 42001 so AI governance work is not duplicated.
Explore the EU AI Act Copilot →Why AI teams use ISMS Copilot for the EU AI Act
- Determine Annex III high-risk classification before building the compliance file
- Run the Article 9 risk-management system as a documented lifecycle process
- Structure the fundamental-rights impact assessment for in-scope deployers
- Reuse ISO 42001 AI management system controls instead of starting over
Free EU AI Act risk-tier checker
Not sure yet whether your system is prohibited, high-risk, limited or minimal? The free EU AI Act Risk-Tier Checker gives a deterministic graded classification (including the GPAI axis) against Regulation 2024/1689 in a few questions — the entry point to the Article 9 work above.
Open the free EU AI Act Risk-Tier Checker →Frequently Asked Questions
How does it classify my AI system?
ISMS Copilot guides you through prohibited, high-risk, limited-risk, and minimal-risk tiers, checking your use case against the Annex III list of high-risk areas so the classification is defensible.
Does it cover the Article 9 risk-management system?
Yes. For high-risk systems it helps you establish, document, and maintain the Article 9 risk-management system across the lifecycle, including residual-risk evaluation and iterative review.
Can it help with the fundamental-rights impact assessment?
It can. For deployers required to perform a FRIA, ISMS Copilot structures the assessment of impact on affected persons and the mitigation measures the Act expects.
Ready to streamline your compliance work?
Built for speed, accuracy, and audit-ready output.