Is AI in a security tool high-risk under the AI Act?

Usually not, but it depends on what the tool decides and about whom. The high-risk categories are defined by use, not by technology: AI used to recruit, promote, monitor or evaluate workers, to assess creditworthiness, or as a safety component in managing critical infrastructure, among others. A tool that spots malware traffic between devices is not in itself one of those uses. It moves closer when its output is used to evaluate individual employees’ behaviour or performance, or when it acts as a safety component of, say, an energy network. So ask two questions of every security tool: does it assess people or machines, and what happens automatically on its output? Ask the supplier for its own classification and the reasoning. NetSenX is designed to watch devices and connections rather than evaluate people, and reports AI use per device and program, not per person. Its AI transparency page describes where it uses AI and what stays under your control; using alerts to judge staff would be your decision and would need its own assessment.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

← All 20 questions on EU law: GDPR, DORA, CRA and AI ActAll topics