TL;DR: EU AI Act risk categories
- The EU AI Act classifies AI systems into four risk categories: unacceptable, high, limited, and minimal risk.
- High-risk AI systems must meet requirements such as risk management, technical documentation, human oversight, and conformity assessment.
- Limited-risk AI systems are subject to transparency rules, while minimal-risk systems generally have no mandatory obligations under the Act.
- Following a structured classification process helps organizations identify the correct risk category and maintain defensible compliance records.
- Scytale is a leading solution for EU AI Act compliance, helping organizations classify AI systems and maintain continuous compliance.
The EU AI Act is the world’s first comprehensive AI regulation, introducing a risk-based framework for AI systems across the European Union. Instead of applying the same rules to every AI application, the Act classifies systems into four risk categories, each with its own compliance obligations and restrictions.
Correctly classifying an AI system is one of the first and most important steps toward compliance. Whether you’re developing AI products, integrating third-party models, or using AI internally, understanding where your system fits helps you identify the applicable requirements and avoid costly mistakes. In this article, we’ll explore the four EU AI Act risk categories, the obligations that apply to each, and how to classify your AI systems with confidence.
What are the EU AI Act risk categories?
The EU AI Act classifies AI systems into four risk categories: unacceptable, high, limited, and minimal risk, each with different EU AI Act compliance requirements.
The assigned risk category determines whether an AI system is permitted at all, what technical documentation, risk management measures, transparency requirements, and conformity assessments are required, and the penalties organizations may face for non-compliance. EU AI Act compliance starts with correctly classifying an AI system and understanding the obligations that apply.
The rules are being introduced in phases. Provisions banning unacceptable-risk AI systems have applied since February 2025, requirements for general-purpose AI (GPAI) models took effect from August 2025, and most obligations for high-risk AI systems will apply between late 2026 and 2027. Understanding which category your AI system falls into helps you prepare for the applicable requirements and implementation timelines before your obligations take effect.
AI-native GRC for how teams work today.
Unacceptable risk: Prohibited AI systems under the EU AI Act
The unacceptable risk category includes AI systems that the EU AI Act considers to pose an unacceptable threat to people’s safety, fundamental rights, or democratic values. These systems are generally prohibited from being placed on the market, put into service, or used in the EU, except for limited law enforcement exceptions under Article 5.
Common EU AI Act unacceptable risk examples include:
- Social scoring: AI systems that rank people based on their behavior or personal characteristics, leading to unfair treatment.
- Exploitation of vulnerabilities: AI systems that exploit a person’s age, disability, or psychological condition to manipulate behavior.
- Untargeted facial image scraping: AI systems that collect facial images from CCTV or the internet to build facial recognition databases.
- Emotion recognition: AI systems that detect or infer emotions in workplaces or educational institutions, except in limited medical or safety cases.
- Biometric categorization: AI systems that classify people based on sensitive characteristics such as race, religion, political opinions, or sexual orientation.
- Subliminal or deceptive manipulation: AI systems that influence people beyond their conscious awareness in ways that may cause harm.
- Predictive policing: AI systems that predict criminal behavior based solely on profiling or personal characteristics.
- Real-time remote biometric identification: AI systems that identify people in public spaces for law enforcement, except under the narrow Article 5 exceptions.
Violating these prohibitions carries the EU AI Act’s most severe penalties: up to €35 million or 7% of an organization’s total worldwide annual turnover, whichever is higher. Because these rules became enforceable on 2 February 2025, organizations developing or deploying AI systems should assess whether their use cases fall within the unacceptable risk category before placing them on the EU market.
High-risk AI systems: Requirements and compliance obligations
Under the EU AI Act, high-risk AI systems are subject to the Act’s most extensive compliance requirements. Rather than focusing solely on transparency, providers and deployers must establish a documented, auditable AI compliance program that manages risk throughout the AI system’s lifecycle.
AI systems can be classified as high risk through one of two routes:
Route 1: Safety components in regulated products
An AI system is classified as high risk when it serves as a safety component in a product already regulated under EU product safety legislation. This includes sectors such as medical devices, aviation, automotive, lifts, and toys, where AI directly affects the safe operation of the product. For example, an AI model used to detect medical conditions in a diagnostic device or an AI component responsible for vehicle safety functions would fall into this category.
Route 2: Annex III standalone AI systems
Standalone AI systems are classified as high risk when they are used in one of the eight application areas listed in Annex III of the Act. These include biometric identification, critical infrastructure management, education and vocational training, employment and HR decisions, access to essential services, law enforcement, migration and border control, and the administration of justice.
For example, an AI identity-matching system falls under biometric identification, while an electricity grid optimization engine is considered part of critical infrastructure. An automated exam-scoring system is classified under education, an AI CV-screening tool under employment, and a credit-scoring or insurance underwriting system under access to essential services.
Always-on GRC. Built for modern teams.
Once an AI system is classified as high risk, the Act requires providers to meet a series of continuous compliance obligations throughout the system’s lifecycle. Here are some of the key requirements providers must meet:Â
1. Risk management system
Providers must establish and maintain a documented risk management system over time. This includes identifying risks, assessing their impact, implementing risk mitigation measures, validating their effectiveness, and reassessing risks whenever the model, data, or intended use changes.
2. Data governance
Training, validation, and test datasets must be relevant, representative, sufficiently complete, and as free from errors as the intended purpose requires. Providers are also expected to document data sources, quality controls, known limitations, and measures taken to reduce bias.
3. Technical documentation
Providers must prepare and maintain comprehensive technical documentation demonstrating how the AI system complies with the Act. This documentation should describe the system’s intended purpose, design, performance characteristics, data, risk controls, and compliance measures, and must be kept up to date for regulators.
4. Automatic logging
High-risk AI systems must automatically record events that enable post-hoc traceability. These logs help providers investigate incidents, reconstruct system outputs, and demonstrate compliance during regulatory reviews.
5. Transparency to deployers
Providers must supply clear instructions for use so deployers understand the AI system’s intended purpose, capabilities, limitations, operating conditions, human oversight requirements, and expected level of performance.
6. Human oversight
High-risk AI systems must be designed to support meaningful human oversight. Depending on the use case, this may include allowing operators to review outputs, intervene, override decisions, or stop the system when necessary to prevent harm.
7. Accuracy, reliability, and cybersecurity
Providers must ensure high-risk AI systems achieve appropriate levels of accuracy, reliability, and cybersecurity throughout their lifecycle. This includes defining performance thresholds, testing failure scenarios, protecting against cyber threats, and monitoring for performance degradation over time.
8. Conformity assessment
Before placing a high-risk AI system on the EU market, providers must complete a conformity assessment. Depending on the type of system, this may involve either a self-assessment or an assessment by an independent notified body.
9. EU database registration
Most high-risk AI systems must also be registered in the EU database before being placed on the market or put into service, creating a public record of compliance.
10. Post-market obligations
Compliance continues after deployment. Providers must monitor the performance of high-risk AI systems, investigate and address emerging risks, report serious incidents to the relevant National Competent Authority (NCA), and, where required, notify the European AI Office.
Limited risk: Transparency obligations for chatbots and generative AI
Limited-risk AI systems can generally be deployed without extensive compliance obligations, but they must meet specific transparency requirements under the Act. Unlike high-risk AI systems, they do not require a conformity assessment, EU database registration, or ongoing post-market monitoring. Here are the main categories of limited-risk AI systems and the transparency obligations that apply to each:
Chatbots and virtual assistants
Providers must inform users when they are interacting with an AI system, unless this is already obvious from the context. This disclosure helps users understand they are communicating with AI rather than a human.
Deepfakes and synthetic media
AI-generated or AI-manipulated content, including deepfakes, must be clearly labeled so users can distinguish synthetic content from authentic material. These transparency requirements help reduce the risk of misleading users and improve trust in AI-generated content.
General-purpose AI (GPAI) models
Providers of general-purpose AI (GPAI) models are subject to a separate set of obligations under the Act. They must prepare technical documentation, publish a summary of their training data, and comply with EU copyright law. GPAI models that exceed the systemic risk threshold face additional requirements, including model evaluations, adversarial testing (red teaming), incident reporting to the European AI Office, and cybersecurity measures.
If a generative AI model is integrated into a high-risk AI system, the entire application becomes subject to the Act’s high-risk requirements, including risk management, compliance documentation, conformity assessment, and post-market monitoring.
Minimal risk: What qualifies and what’s required
Minimal-risk AI systems cover the vast majority of everyday commercial AI applications. Examples include spam filters, AI-enabled video games, basic recommendation engines, inventory management systems, and similar tools that do not fall into the Act’s unacceptable, high-risk, or limited-risk categories. Organizations are generally free to develop and deploy these systems because the Act does not impose mandatory compliance obligations on this risk tier.
Although there are no mandatory requirements for this category, the Act encourages providers to adopt voluntary codes of conduct and follow ethical AI principles. These practices are not mandatory, but they can help organizations establish stronger AI governance and prepare for future regulatory or customer expectations, particularly when aligning with standards such as ISO 42001.
It is important to note that minimal risk under the Act does not mean zero regulatory risk. Organizations must still comply with other applicable laws, including the GDPR, national data protection legislation, and sector-specific regulations where relevant. Providers should also reassess an AI system’s classification whenever it undergoes significant changes, as new functionality or use cases may move it into the limited-risk or high-risk category and trigger additional compliance obligations.
Streamline GRC workflows with seamless automation.
How to classify your AI system: A step-by-step approach
AI classification should be treated as a documented decision process, not a one-time label. A structured approach helps legal, product, security, and compliance teams build a consistent risk management strategy while maintaining clear documentation for audits, customer due diligence, and regulatory reviews.
Step 1: Check for prohibited applications
Start by checking whether the AI system falls into the Act’s unacceptable-risk category. If the system performs social scoring, biometric categorization to infer sensitive attributes, or real-time remote biometric identification in public spaces without meeting the narrow Article 5 exceptions, it may be prohibited. If a use case is banned, it cannot be deployed in the EU, regardless of the system’s technical safeguards or business value.
Step 2: Check against Annex III
If the system is not prohibited, assess whether it falls into one of the eight Annex III high-risk areas: biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration and border control, or administration of justice. A match places the system in the high-risk category and triggers the full set of pre-market compliance obligations, including compliance risk management, technical documentation, logging, human oversight, conformity assessment, and, where required, EU database registration.
Step 3: Assess transparency and GPAI requirements
If the system is not high risk, check whether it is a chatbot, virtual assistant, deepfake generator, synthetic media tool, or general-purpose AI (GPAI) model. These systems may still be deployable, but they can trigger transparency or GPAI obligations, such as informing users they are interacting with AI, labeling AI-generated content, preparing required documentation, publishing training data summaries, and complying with copyright requirements.
Step 4: Document the classification decision
Record the methodology used, criteria applied, evidence reviewed, and final classification outcome. The documentation should explain why the system was classified as unacceptable, high, limited, or minimal risk and be updated whenever the system’s intended purpose, functionality, data, or deployment context changes.
Pay particular attention to borderline scenarios. For multi-function AI systems, apply the highest applicable classification to the system as a whole rather than treating each feature in isolation. For GPAI models integrated into downstream applications, assess both the base model and the application separately to ensure obligations are identified at each layer. Maintaining this record supports a consistent classification process and strengthens AI policy and governance during audits or regulatory reviews.Â
4 steps to classify your AI system
| Step | Assessment | Required action |
| 1. Check for prohibited applications | Determine whether the AI system performs any prohibited use cases under Article 5. | If applicable, the system cannot be placed on the EU market or put into service. |
| 2. Check against Annex III | Assess whether the AI system falls within one of the eight Annex III high-risk application areas. | If classified as high risk, comply with all applicable pre-market obligations before deployment. |
| 3. Assess transparency and GPAI requirements | Determine whether the system is subject to transparency obligations or GPAI requirements. | Implement the applicable transparency, documentation, and copyright requirements. |
| 4. Document the classification decision | Record the methodology, evidence, and final risk classification, including any borderline assessments. | Maintain an auditable record and review the classification whenever the system changes. |
How Scytale simplifies EU AI Act compliance
Scytale’s AI GRC platform simplifies EU AI Act compliance by helping organizations classify AI systems, automate evidence collection, and continuously monitor compliance requirements in one place. AI-powered automation keeps evidence current, surfaces compliance gaps, and reduces the manual effort required to maintain ongoing AI governance.
Scytale also supports cross-framework mapping across AI governance, security, and privacy programs, enabling teams to manage EU AI Act, ISO 42001, GDPR, and other compliance requirements from a single platform. AI agents continuously identify gaps, keep evidence up to date, while dedicated GRC experts help organizations maintain an audit-ready compliance program as AI systems change.
FAQs about EU AI Act risk categories
How are the four EU AI Act risk categories different in practice?
The four EU AI Act risk categories differ by the level of risk they pose and the legal requirements that apply to each. Systems may be prohibited altogether, subject to extensive compliance obligations, required to meet transparency rules, or have no mandatory obligations under the Act.Â
Which AI systems are considered high risk under the EU AI Act?
High-risk AI systems include AI used in regulated products and standalone AI systems within the Act’s Annex III application areas. These areas cover biometrics, critical infrastructure, education, employment, essential services, law enforcement, border control, and administration of justice.
What happens if my AI system falls under the unacceptable risk category?
If your AI system falls under the unacceptable risk category, you cannot deploy it in the EU except for narrow law enforcement exceptions. This category carries the Act’s highest penalty level, with fines reaching up to €35 million or 7% of global annual turnover.
Do limited-risk AI systems need to register in the EU AI database?
No, limited-risk AI systems do not need to register in the EU AI database. They usually face transparency duties, such as disclosing chatbot use or labeling synthetic media, but they do not face the high-risk registration and conformity assessment requirements.
How do I determine which EU AI Act risk category applies to my AI system?
You determine the right category by checking prohibited uses first, then testing the system against Annex III, then reviewing transparency and GPAI obligations. Top AI GRC platforms like Scytale help teams document this process, preserve evidence, and keep classification decisions current as systems change.
Does generative AI always count as high risk under the EU AI Act?
No, generative AI does not always count as high risk under the EU AI Act. Standalone GPAI models usually follow documentation, training data summary, copyright, and systemic risk rules, while integration into a high-risk application triggers the full high-risk regime.
Do minimal-risk AI systems have any compliance obligations?
Minimal-risk AI systems have no mandatory obligations under the EU AI Act, but organizations may still need to comply with GDPR, national data protection laws, and internal governance standards. Scytale’s AI GRC platform helps organizations manage these requirements by centralizing AI governance, documentation, and continuous compliance in one place.
