EU AI Act risk tiers: prohibited, high-risk, limited and minimal

The EU Artificial Intelligence Act (Regulation (EU) 2024/1689) takes a risk-based approach. Obligations scale with the potential impact of an AI system on health, safety and fundamental rights — not with marketing labels.

This article summarises the statutory structure. It is not legal advice.

Prohibited practices (Article 5)

Certain AI practices are banned in the Union market. Examples in the Act include social scoring by public authorities based on social behaviour or personal characteristics, untargeted scraping of facial images to build recognition databases, and emotion recognition in workplaces or educational institutions outside narrow exceptions. If a use case sits in Article 5, the compliance answer is not “add more documentation” — it is to stop or redesign.

High-risk AI (Annex I and Annex III)

High-risk systems sit mainly in two buckets:

1. Annex I — AI used as a safety component of products already covered by Union harmonisation legislation (for example certain machinery or medical devices).
2. Annex III — standalone use cases the co-legislators treated as high-risk, including employment and workers’ management, creditworthiness scoring, education admission/assessment, biometrics (where not prohibited), critical infrastructure safety components, law enforcement, migration/asylum/border, and administration of justice.

High-risk providers face a dense set of duties: risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, accuracy/robustness/cybersecurity, and — where applicable — conformity assessment before placing on the market.

Limited risk and transparency (Article 50)

Some systems are not Annex III high-risk but still trigger transparency duties: people must know they are interacting with AI; synthetic audio/image/video content must be labelled in specified cases; emotion recognition and biometric categorisation outside higher-risk contexts carry disclosure rules.

Minimal risk

Systems that fall outside prohibited practices, high-risk annexes and Article 50 triggers remain largely unregulated under the AI Act’s product rules — though other law (GDPR, consumer, sectoral) still applies. Keeping an inventory helps you notice when a “minimal” chatbot quietly expands into employment screening or credit.

GPAI models (Chapter V)

General-purpose AI models have their own chapter. Providers face documentation and transparency-oriented duties; models with systemic risk (including those designated by the Commission or meeting compute thresholds described in the Act) attract additional obligations.

What to do next

1. Inventory systems and intended purposes.
2. Run a structured classification against Articles 5 / Annex III / Article 50 / Chapter V.
3. For high-risk candidates, start evidence and conformity planning early — documentation lags kill go-live dates.

V77 Trust encodes this questionnaire and control crosswalk so teams can move from a slide deck to an auditable record.