AI Risk Classification under EU AI Act
The EU AI Act divides all AI systems into four risk classes. The classification determines which compliance obligations you must fulfill. Understand the criteria – and classify your AI systems correctly.
The 4 Risk Classes in Detail
- Government social scoring systems
- Real-time biometric remote identification in public spaces (with few exceptions)
- AI to manipulate behavior of vulnerable groups
- AI exploiting weaknesses or vulnerabilities
- Predictive policing based on profiling
Prohibited. Such systems may not be deployed or placed on the market in the EU.
- AI in critical infrastructure (energy, water, transport)
- AI in education (access decisions)
- Recruitment AI, promotion decisions
- AI in credit and creditworthiness assessment
- AI in law enforcement and justice
- AI in healthcare (medical devices)
- AI for border control and migration
- Biometric identification systems
Risk management system, full technical documentation, conformity assessment, CE marking, registration in EU database.
- Chatbots and virtual assistants
- Deepfake image and video generators
- AI-generated content (text, audio, video)
- Emotion recognition systems
Users must be informed they are interacting with an AI system. AI-generated content must be labeled as such.
- AI-based spam filters
- AI in video games and entertainment
- AI-supported production planning
- Simple recommendation systems
- AI-supported inventory management
No legal obligations. Voluntary codes and best practices recommended.
Decision Aid: Is My System High-Risk?
How to Classify Your AI System
Frequently Asked Questions about AI Risk Classification
What happens if I misclassify my system?
Incorrect classifications can lead to fines. Underclassifying the actual risk level constitutes non-fulfillment of compliance obligations and is a violation of the EU AI Act.
Can classifications change?
Yes. If the purpose, target group, or functionality of the system changes, the classification must be reviewed. Annex III can also be adjusted by the EU Commission through delegated acts.
Who is responsible for the classification?
As an operator you share responsibility for the classification. Providers bear primary responsibility for systems they develop themselves.
AI Risk Classification with SimpleAct
SimpleAct guides you through risk classification of your AI systems using rule-based logic and automatically generates EU AI Act-compliant documentation.
Classify AI systems now