EU AI Act risk classification

Article 5 of the AI Act bans a defined set of practices outright. The Commission counts nine prohibited practices, covering harmful manipulation, exploiting vulnerabilities, social scoring, criminal risk prediction based solely on profiling, untargeted scraping of facial images, emotion recognition at work and in education, sensitive biometric categorisation, real-time remote biometric identification for policing, and non-consensual intimate imagery and child sexual abuse material. Eight of these have applied since 2 February 2025. The ninth, added by Regulation (EU) 2026/1744, applies from 2 December 2026.

• Legal basis: Article 5, with Chapter I definitions and the Article 113 application dates.
• Application date: Eight prohibitions from 2 February 2025; the ninth from 2 December 2026.
• Main duty: Do not place, put into service or use a banned practice. There is no conformity route that makes a banned system lawful.
• Fine tier: EUR 35 million or 7% of worldwide annual turnover, whichever is higher, under Article 99.
• Exceptions: Some prohibitions carry narrow law enforcement exceptions, so confirm the exact conditions in the text before relying on one.

Check whether any feature in your product touches a listed practice, including emotion inference in hiring tools, customer analytics that exploit vulnerability, or face matching built on scraped images.

AI systems fall into high risk under Article 6(2) when they serve one of the eight use areas in Annex III, such as biometrics, critical infrastructure, education, employment, access to essential services like credit scoring and insurance pricing, law enforcement, migration and justice. The Article 6(3) exemption can remove a system from this tier when it performs only a narrow procedural or preparatory task, improves completed human work, or detects decision patterns without replacing human review. Systems that profile people are always high risk.

• Legal basis: Article 6(2) and Annex III, with the exemption in Article 6(3).
• Application date: From 2 December 2027, as amended by Regulation (EU) 2026/1744. The original date was 2 August 2026.
• Main duties: Risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and robustness, quality management and registration, with the Articles 8 to 15 requirements applying.
• Exemption documentation: A provider relying on Article 6(3) must document the assessment before placing the system on the market and register it under Articles 6(4) and 49(2).
• Fine tier: EUR 15 million or 3% of worldwide annual turnover, whichever is higher, under Article 99.

Before relying on the exemption, check the draft Commission guidelines of 19 May 2026, which remain labelled draft at the Commission's last update.

Article 6(1) makes an AI system high risk when it is a safety component of a product covered by the Annex I harmonisation legislation, or is itself such a product, and that legislation requires third-party conformity assessment. Typical examples include machinery, medical devices and other regulated products that already pass a notified body process under their own rules. These obligations sit on top of product law rather than replacing it.

• Legal basis: Article 6(1) and Annex I, with Article 43 on conformity assessment routes.
• Application date: From 2 August 2028, as amended in 2026. The original date was 2 August 2027.
• Main duties: The same Articles 8 to 15 requirements that apply to Annex III systems, integrated into the existing product conformity procedure.
• Assessment route: Depends on the Annex I legislation. Ask the notified body or the product regulator which procedure applies to your product.
• Fine tier: EUR 15 million or 3% of worldwide annual turnover, whichever is higher, under Article 99.

Confirm with your product compliance team whether the AI component sits inside a product that already requires third-party assessment, because that answer decides both the route and the date.

Systems in the transparency tier include chatbots, generators of synthetic content, emotion recognition systems and deepfakes. Article 50 requires users to be told when they interact with an AI system, and requires providers to mark synthetic output and deployers to disclose deepfakes and certain AI-generated text. These duties apply whether or not the system is also high risk, so a high-risk system can carry both sets of obligations.

• Legal basis: Article 50, with the Commission's transparency guidance and the Article 113 dates.
• Application date: From 2 August 2026, subject to the Article 50 grace period introduced by Regulation (EU) 2026/1744. Confirm the exact grace period and which systems it covers in the amended text.
• Main duties: Disclose AI interaction to people, mark synthetic outputs in machine-readable form, and disclose deepfakes and AI-generated public-interest text.
• Evidence: Design records of disclosure screens, marking tests, and logs showing that labels reached the end user.
• Fine tier: EUR 15 million or 3% of worldwide annual turnover, whichever is higher, under Article 99.

For each customer-facing feature, check whether a disclosure or marking duty applies, and confirm the date against the amended text.

The Commission describes a fourth level for systems with minimal or no risk, which the AI Act does not regulate. Its examples include AI-enabled video games and spam filters. Such systems carry no AI Act obligations beyond the general AI literacy duty that applies to providers and deployers, and they stay outside the high-risk and transparency tiers. Other laws, including the GDPR and consumer protection rules, still apply to them.

• Legal basis: The absence of an obligation in Articles 5, 6 and 50, read with the Commission's risk-level description.
• Application date: No tier-specific date. The AI literacy duty has applied since 2 February 2025.
• Main duties: None under the high-risk or transparency rules. Keep the AI literacy measures that the Act requires of your staff.
• Fine tier: Not applicable to the tier itself, since the Act sets no obligation for it.
• Boundary risk: A spam filter used to make decisions about people, or a game that uses manipulative techniques, can move into another tier.

Document why each system falls here, and recheck the classification whenever the use case, the users or the outputs change.

General-purpose AI models sit in Chapter V, not in the system tiers. Every provider of such a model has documentation, copyright policy and training-summary duties. Models trained with more than 10^25 FLOP are presumed to present systemic risk, which adds evaluation, risk mitigation and incident reporting duties. The AI Office supervises these rules, and the rules have applied since 2 August 2025.

• Legal basis: Articles 51 and 53 for all models, with the systemic-risk duties in Article 55.
• Application date: Since 2 August 2025. Enforcement by the AI Office runs under Article 88.
• Main duties: Technical documentation, information for downstream providers, a copyright policy, and a public training-content summary.
• Systemic risk: The 10^25 FLOP threshold creates a presumption that the provider must be able to rebut.
• Fine tier: Fines for general-purpose model providers are set in Article 101, so confirm the exact tier and ceiling in the amended text.

If you fine-tune or build on a model, check whether the Act treats you as a model provider or only as a downstream system provider.

Your legal, compliance and product owners hold the classification decision. The organization decides whether each AI system is prohibited, high-risk under Article 6(1) or 6(2), exempt under Article 6(3), subject only to Article 50 transparency duties, or outside the Act, and it must record the reasoning. Where a system is claimed to fall under the Article 6(3) exemption, the provider must document that assessment before market placement and register the system, so the signed record is the central piece of evidence.

• Named decision owner: A single accountable role, usually the legal or compliance lead with product input, signs each classification and its date.
• Reasoning on file: The record states the Annex III area or Annex I product legislation, the facts relied on and the rule applied, not only the outcome.
• Re-review triggers: Changes to intended purpose, data, users or deployment context reopen the classification.
• Counsel involvement: Borderline cases go to in-house or external counsel, whose written view you retain.
• Draft guidance: Commission guidelines on high-risk classification were published as drafts on 19 May 2026, so the record should cite them as drafts.

Confirm with your counsel which classifications require a second signature under your governance policy.

An implementation partner such as DeployOpen can prepare the material your decision owners need. Work typically covers building an inventory of AI systems and their components, drafting the classification file with the facts for each system, mapping the evidence sources, and setting up the record-keeping so the signed decision can be retrieved later. The partner does not decide the legal outcome, and it does not issue a legal opinion or a certificate on classification.

• System inventory: Listing each AI system, its provider or deployer role, intended purpose, users and affected people.
• Classification file preparation: Assembling the facts, data flows and use descriptions that the decision owner reviews.
• Evidence setup: Configuring logging, versioning and document storage on self-hosted platforms inside your own infrastructure.
• Record-keeping workflow: Defining where classification records, reviews and sign-offs live and who can change them.
• Scope boundaries: Agreeing in writing which tasks are preparation and which remain with your counsel and staff.

Check that the statement of work says the partner prepares systems and evidence only, and that the final classification is signed by your organization.

National market surveillance authorities enforce the Act for AI systems. Their view on a contested classification carries enforcement weight, because they can request documentation, investigate and impose fines. The Commission's AI Office enforces the general-purpose AI model rules and, under Article 75(1) as amended in 2026, is exclusively competent for AI systems built on a provider's own general-purpose model and for AI in very large online platforms and search engines. Independent assessors and notified bodies play a different role: they assess conformity for the systems that require third-party assessment, and they do not replace the classification decision.

• Market surveillance authority: Enforces the Act for AI systems in its member state and can challenge a classification.
• AI Office: Supervises general-purpose AI model duties and the AI Office-exclusive cases described in Article 75(1).
• Notified bodies: Assess some biometric systems and Annex I products under Article 43, which depends on the route that applies.
• Auditors: Test whether your records support the claimed classification, but they do not certify it.
• Fines: Article 99 sets maximum fines of EUR 35 million or 7% of worldwide turnover for prohibited practices, and EUR 15 million or 3% for most operator obligations, whichever is higher.

Ask your counsel which national authority is competent for your systems and whether it has published guidance.