The EU AI Act's Risk Tiers, With Examples

Regulation (EU) 2024/1689 — the AI Act — does not regulate AI. It regulates uses, sorted into bands by the harm the use could do. The band decides everything: whether you may ship at all, whether you need a conformity assessment, or whether you need only tell people they are talking to a machine.

The four bands, and what the pyramid gets wrong

Almost every explainer draws a pyramid with four levels. It is a useful picture and it is not how the Act is written. The text has a list of banned practices in Article 5, a classification rule for high-risk systems in Article 6 that points at two annexes, a set of transparency duties in Article 50 that attach to particular system types regardless of risk band, and a separate chapter for general-purpose models. There is no article that says “minimal risk”; that band is simply everything the other rules do not reach.

Two consequences follow, and both catch people out. A system can carry Article 50 transparency duties and be high-risk — the duties stack rather than replace each other. And a general-purpose model is regulated by its own chapter whether or not any particular application built on it is high-risk.

Prohibited practices (Article 5)

Article 5 is short, exhaustive and absolute. There is no conformity assessment that makes these lawful and no consent that cures them. The eight practices, with systems that plainly fall inside each:

• Subliminal, manipulative or deceptive techniques that materially distort behaviour and cause or are likely to cause significant harm. A recommendation loop tuned to push a gambling product on people it has identified as recently relapsed is the textbook case.
• Exploiting vulnerabilities due to age, disability or a specific social or economic situation. A voice agent that adapts its script when it detects cognitive impairment in an elderly customer, to close a sale.
• Social scoring by public or private actors, where the score leads to detrimental treatment in a context unrelated to the data, or treatment disproportionate to the behaviour. A landlord platform scoring tenants on social media activity and using the score to refuse tenancy.
• Predicting criminal offending based solely on profiling or personality traits. Note the carve-out: a system that supports a human assessment already grounded in objective, verifiable facts directly linked to a criminal activity is not caught.
• Untargeted scraping of facial images from the internet or CCTV to build or expand facial recognition databases. This one is aimed squarely at a business model that already existed.
• Emotion inference in the workplace or in education, except for medical or safety reasons. A meeting tool that scores attendees on engagement is the everyday version and it is the one most likely to be running inside an ordinary company today.
• Biometric categorisation to deduce race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.
• Real-time remote biometric identification in publicly accessible spaces for law enforcement, subject to three narrow and exhaustively listed exceptions, each requiring prior authorisation.

The Commission published guidelines on prohibited practices in February 2025. They are not binding on a court, but they are the interpretation the market surveillance authorities will start from, and the emotion recognition section is the one worth reading if you sell anything with a camera or a microphone pointed at staff.

High risk: two separate routes in

Article 6 has two limbs and they behave differently. Under the first, a system is high-risk if it is a safety component of a product covered by the Union harmonisation legislation listed in Annex I, or is itself such a product, and that product must undergo a third-party conformity assessment. Medical devices, machinery, lifts, toys, in vitro diagnostics, vehicles and aviation all sit here.

Under the second limb, a system is high-risk if it falls into one of the eight areas of Annex III. Those areas, with an example that is plainly inside each:

Two things about credit scoring are worth pulling out because they get missed. The insurance entry is limited to life and health insurance, not motor or property. And the creditworthiness entry has an exception for systems used to detect financial fraud, which is a different purpose from deciding whether to lend.

The Article 6(3) escape, and when it is closed

Landing in Annex III does not settle it. Article 6(3) says a system in one of those areas is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. Four conditions are listed, and meeting any one of them opens the escape:

1. The system performs a narrow procedural task. A classifier that routes an inbound email into one of six queues.
2. It improves the result of a previously completed human activity. A tool that tidies the grammar of a decision a human has already made and written.
3. It detects decision patterns or deviations from prior patterns and is not meant to replace or influence the previous human assessment without proper human review. A flag that says “this assessment is unlike your last two hundred”.
4. It performs a preparatory task to an assessment relevant to the Annex III use case. Transcribing an interview so a human can read it.

The escape is closed in one situation regardless: a system that performs profiling of natural persons is always high-risk when it falls within Annex III. If your “narrow procedural” classifier builds a profile of the applicant to do its routing, the derogation is not available to you.

Article 6(4) is the part people skip and the part an auditor will ask for. A provider who concludes that its Annex III system is not high-risk must document that assessment before placing the system on the market, and register the system in the EU database. The escape is not silent. It produces a filing.

Transparency obligations (Article 50)

Article 50 attaches to system types rather than to risk. Four obligations sit in it:

• Providers of systems intended to interact directly with natural persons must design them so people are informed they are interacting with an AI system, unless that is obvious to a reasonably well-informed person in the circumstances.
• Providers of systems generating synthetic audio, image, video or text must mark outputs in a machine-readable format and make them detectable as artificially generated or manipulated. Note this is a duty on whoever provides the generator, which usually means the model provider, not you.
• Deployers of emotion recognition or biometric categorisation systems must inform the people exposed to them. Where the processing involves personal data this sits on top of the GDPR duties, not instead of them.
• Deployers generating or manipulating deep fakes must disclose that the content is artificially generated. For text published to inform the public on matters of public interest, the same disclosure applies unless the content underwent human review and somebody holds editorial responsibility.

Minimal risk: where most software sits

A spam filter, a document search tool, an internal code assistant, a demand forecast, a product recommendation on a retail site: none of these is in Annex I or Annex III, none is an Article 5 practice, and the only Article 50 duty likely to bite is telling users a chat interface is a machine. The Act imposes nothing else on them.

The one duty that does reach every band is Article 4, the AI literacy obligation, which applies to providers and deployers of AI systems generally. It has applied since February 2025 and it is the obligation an ordinary company is most likely to be in breach of right now, because it applies to systems nobody classified as anything.

General-purpose models are an axis, not a band

Chapter V regulates general-purpose AI models directly: documentation, information for downstream providers, a copyright policy and a public summary of training content, with heavier duties for models classified as carrying systemic risk. That classification is about the model, not about what anyone builds with it. A general-purpose model with systemic risk can be used to build a minimal-risk application, and a small unremarkable model can be used to build a high-risk one.

If you call a hosted model through an API, those duties are usually the model provider’s. What reaches you is the information they must give you, and what they must hand downstream is worth knowing precisely, because it is the raw material for your own documentation.

What each band costs to get wrong

Article 99 sets three ceilings, each expressed as a fixed sum or a percentage of total worldwide annual turnover for the preceding financial year, whichever is higher. For SMEs, whichever is lower.

Providers of general-purpose models have their own ceiling, in a separate article, enforced by the Commission rather than by national authorities. The practical point for everyone else is that the middle row is the one that applies to ordinary commercial deployment, and the way you get there is not malice but a missing document.