The risk-based approach
The AI Act doesn't regulate "AI" as a technology. It regulates uses of AI, according to the risk they pose. The same model can be minimal risk in one setting and high risk in another.
Learning objectives
- Name the four risk tiers and what each one requires
- Explain why the intended purpose drives classification
- Describe how general-purpose AI models are treated separately
- Follow a simple classification process for a new AI use case
2.1 Four tiers of risk
| Tier | Where in the Act | What it means | Examples |
|---|---|---|---|
| Unacceptable | Article 5 | Prohibited. Cannot be placed on the market, put into service or used in the EU. | Social scoring; manipulative AI that causes significant harm; emotion recognition at work. |
| High | Article 6, Annexes I & III | Allowed, but providers must meet extensive requirements and complete a conformity assessment; deployers have duties too. | CV screening; credit scoring; AI in medical devices; exam proctoring. |
| Transparency (often called "limited") | Article 50 | People must be told they're dealing with AI or AI-generated content. | Chatbots; deepfakes; AI-generated images and audio. |
| Minimal | — | No specific obligations beyond AI literacy. Voluntary codes of conduct encouraged. | Spam filters; AI in video games; stock forecasting. |
The tiers are not strictly exclusive. A high-risk system that also interacts directly with people — say, an AI interviewer used for recruitment — must meet the high-risk requirements and the Article 50 transparency duties.
Most AI systems in use today fall into the minimal-risk tier. The Act concentrates its heaviest requirements on a relatively small set of uses where the stakes for people's safety and rights are highest.
2.2 Intended purpose drives classification
Classification depends on the intended purpose — what the provider says the system is for, as set out in the instructions for use, marketing and technical documentation — and on how it's actually used.
A facial-analysis model used to blur faces in holiday photos → minimal risk.
The same model used to verify identity for a phone unlock → typically outside the high-risk biometric category (1:1 verification is excluded).
The same model used for remote biometric identification of people in a crowd → high risk, and prohibited in real time for law enforcement in public spaces except in narrow cases.
The same model used to infer employees' emotions at work → prohibited.
2.3 General-purpose AI: a separate track
General-purpose AI (GPAI) models — such as large language models that can perform a wide range of tasks — sit outside the four tiers. They have their own chapter (Chapter V) with two levels:
- All GPAI models: documentation, information for downstream providers, a copyright policy and a public summary of training content.
- GPAI models with systemic risk: extra duties, including model evaluation, adversarial testing, serious-incident reporting and cybersecurity.
When a GPAI model is built into an AI system — a chatbot, for example — that system is then classified under the four tiers according to its use. We cover GPAI in detail in Module 5.
2.4 A practical classification process
When you assess any AI use case, work through these questions in order:
- Is it an AI system at all? Does it infer outputs from inputs? (Module 1)
- Is it in scope? Check the territorial scope and exclusions — military, pure research, personal use.
- Is it prohibited? Check every Article 5 practice. If yes — stop. (Module 3)
- Is it high-risk? Is it a safety component of, or itself, a product under Annex I law that needs third-party conformity assessment? Is it used in an Annex III area — and if so, does the Article 6(3) filter apply? (Module 4)
- Does it trigger transparency duties? Does it interact with people, generate synthetic content, recognise emotions or create deepfakes? (Module 5)
- Otherwise it is minimal risk. Ensure AI literacy and consider voluntary codes.
- Identify your role — provider, deployer, importer or distributor — to know which obligations apply to you.
Use the EU AI Act risk checker to walk through this process for a real or imagined use case.
Key takeaways
- Four tiers: unacceptable (banned), high (strict requirements), transparency (disclosure) and minimal (no new rules).
- The use of AI, not the technology, determines the tier.
- Tiers can overlap — a high-risk system can also carry transparency duties.
- GPAI models follow a separate two-level regime.