EU AI Act — Risk Classification
This page records the risk class of every AI component running on the platform under the EU AI Act (Regulation (EU) 2024/1689), and the reasoning behind each classification. You can cite it in your vendor assessment and in your own compliance file.
| Version | 1.0 |
| Assessment date | 20 September 2026 |
| Scope | All AI components running on the Lunixi platform |
| Reassessment | Annually, and whenever one of the triggers below occurs |
This is a self-assessment. It is our own analysis, not an independent legal opinion or a notified-body assessment. Obtain your own legal confirmation for your own obligations. We state the reasoning behind each classification explicitly on this page so that you can check it.
Scope and our role
The Act binds AI systems placed on the EU market or whose output is used in the EU. To the extent that we serve customers in the EU we are in scope, and this page is prepared on that assumption.
| Component | Our role |
|---|---|
| Payment routing model, fraud engine, scoring platform, identity verification | Provider — we develop the system and offer it under our own name |
| Flow blueprint generation and compliance assistants | Deployer — we use a third-party general-purpose model inside our own system |
We are not a general-purpose model provider: we do not train foundation models and do not offer a general-purpose model under our own name. The provider obligations for the model we use rest with that model's provider.
Classification
| Component | Class | Reasoning |
|---|---|---|
| Payment routing model | Minimal risk | Falls under no Annex III area. It selects the POS terminal a transaction passes through, not an assessment of a person |
| Fraud rule engine | Minimal risk | A deterministic rule engine running from the rules you publish. The fraud-detection exception below also applies |
| Machine learning scoring platform | Minimal risk | Its purpose is financial fraud detection, within the express exception to the Annex III creditworthiness heading |
| Flow blueprint generation | Minimal risk | An internal tool producing suggestions for an operator; the draft is born disabled and publication rests on a human decision |
| Compliance assistants | Minimal risk | Produces explanations for an analyst, not decisions |
| Identity verification — document and face matching | Minimal risk | Biometric verification (1:1), confirming the identity the person claims. Not remote biometric identification (1:N) |
There is no prohibited practice and no high-risk system. Accordingly, conformity assessment, CE marking and EU database registration obligations do not arise for us.
Prohibited practices — one by one
| Prohibited practice | Status |
|---|---|
| Social scoring | None. We do not produce a general "citizen score" for your customers; scores are per transaction and for fraud purposes |
| Subliminal or manipulative techniques | None |
| Exploitation of vulnerability (age, disability, socioeconomic situation) | None |
| Biometric categorisation to infer sensitive attributes | None. Biometrics are used only for identity verification |
| Emotion recognition in the workplace or in education | None |
| Untargeted scraping of facial images | None. Face data is captured only from the user's own session, with consent |
| Individual profiling to predict criminal offences | None |
| Real-time remote biometric identification for law enforcement | None |
The reasoning behind the two exemptions
These are the two points most often misclassified in financial services, so we state our reasoning openly.
The fraud-detection exception
Annex III treats systems used to evaluate the creditworthiness of natural persons or establish their credit score as high-risk. That same provision carries an express exception: AI systems used for the purpose of detecting financial fraud fall outside it.
That is the purpose of our fraud engine and scoring platform. We do not produce an assessment of whether credit should be granted, at what limit or at what price, and we do not permit their use for that purpose.
Verification versus identification
What counts as high-risk is a system that identifies a person remotely through one-to-many (1:N) matching. Our identity verification flow performs one-to-one (1:1) verification: the user states their identity and the system compares the live capture against the identity claimed. Its sole purpose is to confirm the person is who they claim to be, so it does not fall within remote biometric identification.
In addition, automatic approval is disabled in identity verification — the service does not start while that setting is enabled. The outcome rests on human review.
Obligations that apply to us
Even without a high-risk system, the following bind us:
| Obligation | Status |
|---|---|
| AI literacy (competence of staff) | Programme in force — see AI Literacy. The first cycle closes on 31 October 2026 |
| Transparency — a person knowing they are interacting with an AI | No applicable surface: our AI surfaces do not converse with end users; they produce suggestions for operators and analysts |
| Transparency — marking generated content | Flow drafts are stamped with the generating model and prompt version |
| Documenting the risk classification | This page |
| Keeping the classification current | The triggers below |
Reassessment triggers
The classification is redone and this page updated whenever one of the following occurs:
- A model output's decision authority widens — in particular, a score becoming an input to a credit, limit or pricing decision
- A new AI surface is added
- One-to-many matching or automatic approval is enabled in identity verification
- An AI surface begins interacting directly with end users
- Guidance or an implementing act on the application of the Act is published
Related pages
- Responsible AI Policy — principles, human oversight, explainability, monitoring
- Model Review Log — the record of scheduled reviews
- Decision Governance — where the fraud decision is deterministic
- Trust — compliance posture and the documents we can share
Questions
To challenge a classification, request further reasoning for your own compliance file, or for a vendor assessment form: [email protected]