How do you classify an AI system by risk under the EU AI Act?

The Act creates four tiers. Practices that pose an unacceptable risk, such as certain social scoring and manipulative systems, are prohibited. High-risk systems face the full set of requirements. Limited-risk systems, such as chatbots and synthetic content generators, mainly carry transparency duties. Most other systems fall in the minimal-risk tier with no specific obligations.

Annex III lists the high-risk use cases. They include biometric identification, management of critical infrastructure, education and vocational training, employment and worker management, access to essential private and public services such as credit scoring and life and health insurance pricing, law enforcement, migration, and the administration of justice.

Article 6 also allows a provider to conclude that an Annex III system does not pose a significant risk. That conclusion has to be documented before the system is placed on the market, and the system must still be registered. Classification should be recorded per system with the reasoning attached, since an auditor will ask how the decision was reached.

Day 2 of the course walks through risk classification and maps the obligations that follow from each class, using the regulation text as the reference point for every decision.