Aeqora Vendor Index
AI Risk Scoring Methodology
Every vendor in the Aeqora index carries a risk score from 1 to 10. This page documents how those scores are derived — so you can assess the methodology, challenge our reasoning, and apply the same framework to tools not yet in the index.
Published: June 2025 — Updated when EU AI Act implementing acts or vendor compliance postures change.
Score Bands
No mandatory EU AI Act obligations for typical use. Governance best practice and inventory documentation recommended.
Article 50 transparency obligations apply where user-facing. Deployers must ensure chatbot disclosure and AI-generated content labeling.
Full Article 26 deployer obligations. Technical documentation, human oversight, post-market monitoring, and incident reporting required.
Scoring Factors
The regulatory classification sets the base band. Three adjustment factors move the score within the band. No factor crosses a band boundary — a minimal-risk tool cannot score above 3 regardless of other factors.
Regulatory classification
Whether the use case triggers Annex III (high-risk), Article 50 (limited risk), or neither (minimal risk) under the EU AI Act as amended by the Digital Omnibus Regulation (EU) 2026/1744. This determines the base score band: high-risk = 7-10, limited = 4-6, minimal = 1-3.
Decision impact on individuals
How consequential the AI output is for real people. Autonomous decisions about employment, credit, or access to services score higher within the band. Informational outputs or internal-only tools score lower.
Provider compliance posture
Whether the vendor has published an EU Declaration of Conformity, technical documentation, or equivalent EU compliance materials. Absence of provider documentation adds 1 point within the tier band.
Deployment autonomy
Whether the AI system operates autonomously (agentic) or under continuous human supervision. Autonomous systems require stronger Article 14 human oversight measures and score 1 point higher within the band.
Limitations and Caveats
Use-case dependence. The EU AI Act risk level is determined by the specific use case, not the tool. The same tool can be minimal risk for one application and high-risk for another. Scores in this index reflect the most common and highest-risk deployment pattern for each vendor.
Digital Omnibus deferral. The Digital Omnibus Regulation (EU) 2026/1744 defers Annex III high-risk obligations to December 2027 for most categories. Article 5 prohibitions remain in force from February 2025. The PLD national transposition deadline is 9 December 2026; liability depends on product dates and the economic operator. Scores reflect the regulatory classification, not the implementation deadline.
Provider documentation currency. EU Declaration of Conformity status reflects information available at the index publication date. Verify current status directly with the vendor before regulatory submissions.
Not legal advice. The index is an operational reference for compliance practitioners. For regulatory submissions or legal decisions, obtain qualified legal counsel.
Full Index
Register your AI systems in Aeqora for a classification tailored to your organization's specific use case.