EU AI Act Risk Tier
EU AI Act risk tiers are the four-level classification — unacceptable, high, limited, and minimal/no risk — that determines which obligations apply to an AI system placed on the EU market under Regulation (EU) 2024/1689.
AIDOLS Research Team · Editorial standards
Full definition
Unacceptable-risk systems are banned: Article 5 lists eight prohibited practices, among them social scoring by public or private actors, harmful manipulative techniques, and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions. High-risk systems (AI safety components of Annex I products, and the Annex III uses: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice) face the heaviest obligations — risk management, data governance, technical documentation, human oversight, accuracy, robustness, cybersecurity, and conformity assessment. Limited-risk systems require transparency (e.g., chatbot disclosure, deepfake labeling). Minimal-risk systems have no obligations.
Why it matters
Tier classification drives the entire compliance budget. Misclassifying a system as limited when it is actually high-risk exposes the provider to fines of up to €15 million or 3% of global annual turnover, whichever is higher (Article 99(4)); the 7% tier applies only to prohibited practices. Every EU AI deployment needs a documented tier rationale.
Example
An HR resume-screening tool is high-risk under Annex III §4(a); its provider must complete a conformity assessment, register the system in the EU database and build in human oversight before placing it on the EU market, and the employer using it must assign trained staff to oversee it. A Fundamental Rights Impact Assessment is a deployer duty, required here only when the employer is a public body or a private entity providing public services (Article 27).
Frequently asked questions
Which AI systems are banned outright under the EU AI Act?
Article 5 bans eight practices: harmful manipulative or deceptive techniques; exploiting vulnerabilities linked to age, disability or social or economic situation; social scoring by public or private actors; predicting crime risk solely from profiling; untargeted scraping of facial images for recognition databases; emotion recognition at work or in education (except for medical or safety reasons); biometric categorisation to infer sensitive traits such as race, religion or sexual orientation; and real-time remote biometric identification in public spaces for law enforcement, with narrow exceptions. From 2 December 2026, Regulation (EU) 2026/1744 adds AI that generates non-consensual intimate imagery or child sexual abuse material. These are unacceptable-risk systems — deploying them in the EU carries fines up to €35 million or 7% of global annual revenue.
What makes an AI system high-risk under the EU AI Act?
High-risk systems are AI safety components of products that need third-party conformity assessment under the EU product laws in Annex I (medical devices, for example), plus the uses listed in Annex III: biometrics (remote identification, biometric categorisation, emotion recognition), critical infrastructure (digital infrastructure, road traffic, water, gas, heating and electricity supply), education, employment decisions (CV screening, performance scoring, hiring and firing), access to essential services (credit scoring, life and health insurance pricing, public benefits, emergency-call triage), law enforcement, migration, and administration of justice and democratic processes. If your AI system materially influences decisions in any of these Annex III areas, it is high-risk regardless of how the vendor markets the product; the Article 6(3) carve-out covers only tools that do not (such as narrow procedural or preparatory tasks) and never applies to profiling.
How do you classify an AI system's risk tier under the EU AI Act?
Three-step test: (1) Is the system in Article 5's prohibited list? → Unacceptable risk, banned. (2) Is it an Annex I safety component or an Annex III use case? → High-risk, requiring conformity assessment, EU-database registration, technical documentation, and human-oversight mechanisms. (3) Does it interact with users without disclosing it is AI? → Limited risk, transparency obligations only. Everything else is minimal risk with no mandatory obligations. The common mistake is relying on product marketing — an HR analytics tool that ranks job candidates is high-risk under Annex III §4(a) regardless of what the vendor calls it.
What are the fines for misclassifying an AI system under the EU AI Act?
Deploying a prohibited system: up to €35 million or 7% of global annual revenue (whichever is higher). Failing to meet high-risk obligations — missing conformity assessment, incomplete documentation, no human-oversight mechanism: up to €15 million or 3% of global revenue. Providing inaccurate information to notified bodies: up to €7.5 million or 1% of revenue. Enforcement sits with national market surveillance authorities; the Commission's AI Office enforces the rules for general-purpose AI models and, since Regulation (EU) 2026/1744, for most AI systems built on a provider's own general-purpose model or embedded in very large online platforms and search engines.
Next steps
Related terms
- EU AI ActThe EU AI Act (Regulation (EU) 2024/1689) is the European Union's comprehensive, risk-tiered regulation of AI systems, the world's first horizontal AI law, with obligations phasing in from February 2025: general-purpose AI model rules from 2 August 2025 (Commission fines from 2 August 2026; models already on the market have until 2 August 2027) and, after the Digital Omnibus (Regulation (EU) 2026/1744), high-risk rules from 2 December 2027 (Annex III) and 2 August 2028 (Annex I).
- Fundamental Rights Impact Assessment (FRIA)A Fundamental Rights Impact Assessment (FRIA) is the structured analysis required by Article 27 of the EU AI Act for certain deployers of high-risk AI systems — bodies governed by public law, private entities providing public services, and deployers of credit-scoring AI or of life- and health-insurance risk-assessment and pricing AI (Annex III points 5(b) and 5(c)).
- AI Act Conformity AssessmentA conformity assessment under the EU AI Act is the procedure by which a high-risk AI system is verified to meet the regulation's requirements (Articles 8–15) before being placed on the EU market or put into service.
- AI Risk AssessmentAn AI risk assessment is a structured review of an AI system's potential harms — to individuals, groups, the organization, and society — covering likelihood, severity, affected populations, and mitigation controls across safety, fairness, security, privacy, and compliance dimensions.
More governance & risk terms
Source & further reading
Primary source: European Union — Regulation (EU) 2024/1689 on Artificial Intelligence (2024).
Citation policy: this entry is part of the AIDOLS AI Implementation Glossary and may be quoted for research, journalism, and education with attribution to aidolsgroup.com/en/glossary/eu-ai-act-risk-tier/.