AI System Risk Categories

The EU AI Act leverages existing EU product-safety frameworks to classify risk into categories:

• Unacceptable Risk

• High risk

• Limited Risk

• Minimal/no Risk

Is my AI system 'unacceptable risk'?

Your business is in particular danger of using an 'unacceptable risk' system if it uses an AI system for the following activities:

• manipulating user behaviour;

• exploiting specific user vulnerabilities;

• using biometrics to categorise individuals by sensitive characteristics (listed in Article 5(1)(g));

• social scoring; or

• inferring emotions in professional environments.

This list is non-exhaustive and it may be useful to consult a professional to ensure that your AI system use is not banned in Europe.

If your AI system is of 'unacceptable risk' it is entirely banned from deployment under Article 5 of the EU AI Act. Failure to comply with this ban can lead to penalties up to €35 million or 7% of global turnover, whichever is higher (Article 99(3))

Is my AI system 'high-risk'?

You can expect the following applications of AI systems to suggest your system is classified as 'high-risk' under the EU AI Act:

• Systems involved in

  • biometrics

  • critical infrastructure

  • education and vocational training

  • employment

  • access to and enjoyment of essential private and public services/ benefits

  • law enforcement

  • migration, asylum and border control management

  • administration of justice and democratic processes

• A safety component in a regulated product

For example, an AI system that screens CVs and ranks them to aid hiring processes is a high risk system since it plays a substantial role in employment.

Is my AI system 'limited risk'?

Your business is likely engaging a 'limited risk' system if it is using:

• a chatbot/ AI agent;

• AI generated images, audios or video; or

• AI generated text.

A customer chatbot would be a typical example of a limited risk system.

Also, if your business uses an AI system which interacts with employees or users in ways which have the potential to mislead them, it is likely a limited risk system.

Deploying a limited risk system means certain transparency obligations apply to ensure that anyone interacting with the system is aware they are interacting with an AI system.

Is my AI system 'minimal' or 'no risk'?

If your system does not fall into any of the categories above, it is possible that it is a 'minimal' or 'no risk' AI system.

In general, a minimal risk system will perform a background task which does not make consequential decisions and does not have the potential to mislead users.

Typical examples of minimal risk systems include:

• spam email filters;

• stock forecasting;

• grammar and spell checker;

• recommendation engine; and

• route optimisation.

However, if any of the above systems are deployed in a high risk context such as healthcare or employment, this means the system becomes a high risk system.