Does the system do any of: social scoring of individuals, manipulative or exploitative influencing, untargeted facial-recognition scraping, or real-time remote biometric identification in public spaces?
Is it used in a high-stakes domain: creditworthiness, insurance pricing, recruitment or worker management, education, essential public or private services, biometrics, critical infrastructure, law enforcement, migration or justice?
Is the AI a safety component of a product already regulated under EU product-safety law (for example medical devices, machinery, vehicles)?
Does it interact directly with people (a chatbot or assistant) or generate or manipulate image, audio, video or text content (including deepfakes)?