Image AI-generated. All text human-written.
The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) regulates AI systems using a risk-based approach: the greater the potential harm to people’s safety and fundamental rights, the stricter the rules. In practice, this means every AI system placed on the EU market or used within the EU falls somewhere along a four-tier hierarchy — unacceptable risk, high risk, limited risk, and minimal risk. Getting this classification right is the foundation of an organization’s entire compliance program, because every downstream obligation flows from it.
Tier 1: Unacceptable Risk — Prohibited Outright
At the top of the hierarchy are AI practices the EU considers fundamentally incompatible with its values and fundamental rights. These are banned outright across the European Union, with no compliance pathway, no conformity assessment, and no safeguards that make them acceptable.
Article 5 of the Act lists the prohibited practices, which include:
- Subliminal or manipulative techniques designed to distort a person’s behavior in a way that causes harm
- Exploiting the vulnerabilities of children, people with disabilities, or specific social/economic situations
- Social scoring of individuals by public or private actors
- Most forms of real-time remote biometric identification in publicly accessible spaces for law enforcement (with narrow, judicially supervised exceptions)
- Emotion recognition in workplaces and educational institutions
- Untargeted scraping of facial images to build facial recognition databases
These bans have been in force since 2 February 2025.
Tier 2: High Risk — Strict Governance Obligations
Systems in this tier aren’t banned, but they carry the heaviest compliance burden short of prohibition. A system is generally high-risk if it either (a) is a safety component of a product already regulated under EU product-safety law (Annex I — think medical devices, machinery, or toys), or (b) falls within one of the sensitive use cases listed in Annex III, which include:
- Biometrics and biometric categorization
- Critical infrastructure (energy, water, transport)
- Education and vocational training
- Employment, worker management, and access to self-employment (e.g., CV-screening or hiring tools)
- Access to essential public and private services (credit scoring, insurance, benefits)
- Law enforcement
- Migration, asylum, and border control
- Administration of justice and democratic processes
High-risk systems require a formal conformity assessment, technical documentation, risk-management processes, human oversight mechanisms, data governance measures, and registration in an EU database before they can be deployed.
Important timeline note: these Annex III obligations were originally set to apply from 2 August 2026. However, the Digital Omnibus on AI (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026) amended this. High-risk obligations for Annex III systems now apply from 2 December 2027, and for Annex I safety-component systems from 2 August 2028. Two additional prohibited practices — covering AI-generated non-consensual intimate imagery and AI-generated child sexual abuse material — were also added to Article 5, applying from 2 December 2026. Organizations should treat these as the current, legally binding dates rather than the originally-publicized August 2026 deadline. Note that this deferral applies only to the high-risk regime: Article 5 prohibitions, Article 50 transparency duties, and GPAI provider obligations remain on their original schedules.
Tier 3: Limited Risk — Transparency Obligations
Limited-risk systems don’t require conformity assessments, but they do trigger disclosure duties under Article 50. The core obligation is simple: people must be told they are interacting with AI, or that content was AI-generated.
Typical examples include:
- Chatbots and virtual assistants (must disclose they are AI, not a human)
- Systems that generate or manipulate synthetic audio, video, image, or text (deepfakes), which must be labeled as artificially created — with exceptions for content that is obviously creative, artistic, or entertainment in nature
- Emotion-recognition or biometric-categorization systems that don’t meet the high-risk threshold
Tier 4: Minimal Risk — No Mandatory Obligations
The great majority of AI systems in commercial use today — spam filters, AI-enabled video games, basic recommendation engines — fall here. The AI Act imposes no mandatory requirements on these systems beyond the general AI-literacy obligation in Article 4, which asks organizations to ensure staff have a sufficient understanding of the AI tools they use. Voluntary codes of conduct are encouraged but not required.
The Executive Alert: Where Organizations Get Classification Wrong
Regulatory advisors consistently point to the same failure pattern: organizations mislabel a system as “limited” or “minimal” risk when it actually falls within an Annex III category and legally triggers high-risk obligations. Because classification determines every subsequent compliance step — documentation, oversight, registration, audits — an error at this stage doesn’t stay contained. It cascades: a misclassified system skips the conformity assessment, skips the EU database registration, and skips the human-oversight design work, leaving the organization exposed once enforcement begins.
A few practical safeguards reduce this risk:
- Classify by function and purpose, not by product marketing. An HR tool that ranks candidates is high-risk under Annex III regardless of how the vendor describes it.
- Treat classification as an ongoing process, not a one-time task — a system’s purpose, user population, or deployment context can shift it into a different tier over time.
- When a system’s status is genuinely ambiguous (multi-purpose tools, systems embedded in larger regulated products), document the reasoning and seek legal input rather than defaulting to the lower-obligation tier.
Why This Foundation Matters
If the initial risk classification is wrong, everything built on top of it — governance frameworks, audit trails, human-oversight mechanisms, regulatory filings — is built on the wrong foundation. Given the scale of potential penalties (fines for deploying prohibited systems can reach the higher of €35 million or 7% of global annual turnover), getting the classification right at the outset isn’t a bureaucratic formality. It’s the difference between demonstrable compliance and a foundational gap that surfaces only once a regulator, customer, or auditor starts asking questions.
EU AI Act Compliance Disclaimer This article is provided for general informational and educational purposes only and should not be considered legal, regulatory, or compliance advice. The EU AI Act is evolving, and its requirements can vary depending on the organisation, AI system, role, and specific use case. For professional advice and guidance on EU AI Act compliance, visit www.exclevelai.eu