EU AI Act AI Risk Classification

The EU AI Act defines four risk categories: (1) Unacceptable risk — these AI systems are prohibited, such as social scoring or subliminal manipulation. (2) High risk — AI systems in safety-critical areas like medical devices, recruitment, or creditworthiness assessment, defined in Annex III and Article 6. (3) Limited risk — systems with transparency obligations such as chatbots or deepfake generators. (4) Minimal risk — the majority of AI systems like spam filters or recommendation algorithms, with no specific obligations.

An AI system is classified as high-risk if it either serves as a safety component in a regulated product under Annex I or falls within one of the eight application areas listed in Annex III. These include biometric identification, critical infrastructure, education, employment, access to public services, law enforcement, migration, and administration of justice. Article 6(3) defines exceptions: AI systems for purely procedural tasks or for improving already completed human decisions may be exempt from high-risk classification.

AI systems posing unacceptable risk to fundamental rights and safety are prohibited. Specifically: social scoring by authorities or companies, subliminal manipulation of persons, exploitation of vulnerabilities of specific groups, real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions), emotion recognition in the workplace and educational institutions, and predictive policing based on profiling. These prohibitions have applied since 2 February 2025.

Providers of high-risk AI systems must fulfill comprehensive requirements: a documented risk management system, data quality and data governance requirements, technical documentation, automatic logging, transparency toward users, human oversight, accuracy, robustness, and cybersecurity. A conformity assessment must be conducted before placing the system on the market. Full application of these rules begins on 2 December 2027.

AI systems with limited risk are subject to transparency obligations. Users must be informed that they are interacting with an AI. This applies to chatbots and virtual assistants, emotion recognition systems, biometric categorization systems, and AI-generated or manipulated content (deepfakes). The labeling requirement ensures that people can make informed decisions when interacting with these systems.

ADVISORI guides organizations through the entire classification process: from inventorying all deployed AI systems, through systematic assessment against Annex III and Article 6 criteria, to deriving concrete compliance measures. We create a documented risk assessment, identify high-risk systems, and develop a prioritized implementation plan for regulatory requirements — aligned with the August 2026 deadline.

Implementation follows a phased approach: Since 2 February 2025, prohibitions on AI systems with unacceptable risk apply. From 2 August 2025, rules for general-purpose AI models (GPAI) take effect. On 2 December 2027, obligations for high-risk AI systems become fully applicable, including conformity assessment and market surveillance. Organizations should begin classifying their AI systems now to ensure timely compliance.