EU AI Act Risk Classification: The Four Risk Tiers Explained
Director & MLOps Lead
Predictive maintenance specialist, industrial data analysis, vibration-based condition monitoring, applied AI for manufacturing and automotive operations
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 as the world's first comprehensive legal framework governing artificial intelligence. It applies to any AI system placed on the EU market or used within the EU, regardless of the provider's location. Non-compliance penalties reach up to 35 million euros or 7% of global annual turnover for the most serious violations. Understanding the risk classification framework is the starting point for any compliance program.
This article reflects the rules as of October 2026, including the changes made by the Digital Omnibus on AI (Regulation (EU) 2026/1744), which entered into force on 27 July 2026. For the bigger picture of who the Act applies to and how it is enforced, see our EU AI Act guide.
What Is the EU AI Act's Four-Tier Risk Framework?
The EU AI Act classifies all AI systems into four risk tiers. Each tier carries different compliance obligations. When the Act was proposed, the European Commission's impact assessment estimated that roughly 5-15% of AI applications would fall into the high-risk category. The classification is based on the potential harm an AI system can cause to health, safety, fundamental rights, democracy, and the rule of law.
| Tier | Typical examples | Main obligation | Applies from |
|---|---|---|---|
| Unacceptable risk | Social scoring, emotion recognition at work, untargeted facial scraping | Banned | 2 Feb 2025 (new bans 2 Dec 2026) |
| High risk | CV screening, credit scoring, AI in medical devices | Conformity assessment, documentation, oversight | 2 Dec 2027 (Annex III); 2 Aug 2028 (Annex I) |
| Limited risk | Customer-service chatbots, deepfakes, AI-generated text | Transparency (Article 50) | 2 Aug 2026 |
| Minimal risk | Spam filters, AI in video games | None mandatory | n/a |
Classifying your systems is also the first step of Opsio's free EU AI Act readiness assessment, which turns your answers into an AI risk assessment and three other governance documents.
Tier 1: Unacceptable Risk (Prohibited)
Prohibited AI practices are banned outright with no compliance pathway. Since 2 February 2025, eight categories have been prohibited under Article 5: subliminal manipulation; exploitation of vulnerable groups; real-time remote biometric identification in public spaces by law enforcement (with limited exceptions); biometric categorization to infer sensitive attributes (race, politics, religion, sexual orientation, union membership); social scoring by public or private actors; predictive policing based solely on profiling; untargeted biometric data scraping for facial recognition databases; and emotion recognition in workplaces or educational institutions. The Digital Omnibus adds two further bans from 2 December 2026: AI used to create non-consensual intimate imagery ("nudifier" apps) and child sexual abuse material. Our guide to prohibited AI practices under Article 5 covers each ban and its exceptions.
Tier 2: High Risk (Conformity Assessment Required)
High-risk AI systems require conformity assessment, technical documentation, human oversight mechanisms, and post-market monitoring before deployment. Two pathways define high-risk classification. Annex I covers AI used as safety components in products already regulated under EU product safety law (medical devices, machinery, vehicles, aviation equipment). Annex III covers eight categories of standalone high-risk AI: biometric identification; critical infrastructure; education; employment; access to essential services; law enforcement; migration and border control; and administration of justice. Under the Digital Omnibus, high-risk requirements apply from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I products, rather than the original August 2026 date. See high-risk AI systems under Annex III for the full obligation list.
Tier 3: Limited Risk (Transparency Obligations)
Limited-risk systems, primarily chatbots and AI-generated content tools, face transparency obligations only. Providers and deployers must ensure users know they are interacting with an AI system. Deepfakes and AI-generated media must be labeled as such. These Article 50 requirements apply from 2 August 2026 and were not delayed by the Digital Omnibus; providers of generative systems already on the market before that date have until 2 December 2026 to add machine-readable marking. No conformity assessment or technical documentation is mandated, though providers are encouraged to adopt voluntary codes of conduct. Read more about Article 50 transparency obligations.
Tier 4: Minimal Risk (No Mandatory Requirements)
AI systems posing minimal risk, including AI-enabled spam filters, AI in video games, and certain recommendation systems, have no mandatory requirements under the Act. However, providers can voluntarily apply codes of conduct, which the AI Office and Member States encourage under Article 95. Most AI systems in day-to-day business use are expected to fall into the minimal or limited risk categories.
What Are the Key EU AI Act Deadlines?
The EU AI Act applies in phases rather than all at once. As of October 2026, the timeline is: 2 February 2025: prohibited practice bans and AI literacy take effect; 2 August 2025: GPAI model provisions, governance structure and penalties apply; 2 August 2026: Article 50 transparency obligations apply; 2 December 2026: the new prohibitions apply; 2 December 2027: high-risk requirements for Annex III systems apply; 2 August 2028: high-risk requirements for AI in Annex I products apply. Organizations should map their AI portfolio against these deadlines now, as the first three are already in effect. Our EU AI Act timeline explains each date and the transitional rules.
Need expert help with eu ai act risk classification: the four risk tiers explained?
Our cloud architects can help you with eu ai act risk classification: the four risk tiers explained — from strategy to implementation. Book a free 30-minute advisory call with no obligation.
What Are General Purpose AI (GPAI) Model Rules?
The EU AI Act introduced specific provisions for General Purpose AI models, covering foundation models like GPT-4, Claude, and Gemini that can perform diverse tasks. Since 2 August 2025, all GPAI providers must maintain technical documentation, put in place a policy to comply with EU copyright law, and publish a summary of training content (models already on the market before that date have until 2 August 2027). GPAI models with systemic risk, presumed when training compute exceeds 10^25 FLOPs, face additional requirements: model evaluation including adversarial testing (red-teaming), serious incident reporting to the AI Office, and cybersecurity protection measures. The systemic risk tier currently applies to the most powerful frontier models.
How Does Risk Classification Work in Practice?
Risk classification is not automatic. Organizations must assess each AI system against the Annex I and Annex III criteria, document their classification rationale, and implement compliance measures appropriate to the determined risk tier. The classification must be reviewed when the AI system is significantly modified. A change in intended use can move a system from minimal risk to high risk. For example, a recommendation engine used for entertainment is minimal risk, but the same system used to determine access to healthcare services is high risk under Annex III.
The most common misclassification we encounter is treating AI systems that make automatic decisions about individual benefits, credit, or employment as minimal risk because they include a human approval step. The EU AI Act's high-risk classification under Annex III applies to the intended purpose of the AI system, not its workflow position. An AI credit scoring system used for loan decisions is high-risk even if a human approves every output. Once a system is classified, the next step is building the controls around it; our AI governance framework for the EU AI Act shows how.
What Are the Penalties for Non-Compliance?
The EU AI Act's penalty framework (Article 99) scales by infringement type. Violations of prohibited AI practice bans: up to 35 million euros or 7% of global annual turnover, whichever is higher. Violations of high-risk AI obligations, transparency duties or GPAI requirements: up to 15 million euros or 3% of global turnover. Providing incorrect or misleading information to authorities: up to 7.5 million euros or 1% of global turnover. For SMEs and startups, the lower of the two amounts applies. National market surveillance authorities enforce the Act, with coordination by the EU AI Office established within the European Commission.
Frequently Asked Questions
Does the EU AI Act apply to non-EU companies?
Yes. The Act uses an effects-based jurisdiction approach: it applies to any provider placing an AI system on the EU market, any deployer using an AI system in the EU, and any provider or deployer established outside the EU whose AI system output is used within the EU. Non-EU providers of high-risk AI systems must also appoint an authorized representative established in the EU.
Is existing AI software automatically covered by the EU AI Act?
Not automatically. High-risk systems placed on the market before their applicable date (2 December 2027 for Annex III, 2 August 2028 for Annex I) only fall under the high-risk rules if they are significantly changed in design afterwards, while public-authority deployers have until 2 August 2030. The prohibited practice bans applied from February 2025 with no transition relief, so existing systems should already have been reviewed.
Has the EU AI Act been delayed?
Partly. The Digital Omnibus (Regulation (EU) 2026/1744), in force since 27 July 2026, moved the high-risk deadlines to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). It did not delay the prohibitions, the GPAI rules or the Article 50 transparency obligations, which apply from 2 August 2026.
Where can organizations find official EU AI Act guidance?
The European Commission publishes official guidance, standardization requests, and the GPAI Code of Practice at digital-strategy.ec.europa.eu. The full regulation text is on EUR-Lex. CEN-CENELEC is developing harmonized standards under a mandate from the European Commission, which will create a presumption of conformity when published.
Classify Your AI Systems in One Sitting
Knowing the four tiers is the easy part; applying them to every tool in your organization takes structure. Take the AI Act gap assessment: about 40 minutes of questions, a maturity score across ten governance areas, and four editable Word documents (AI Governance Framework, AI Acceptable Use Policy, AI Vendor Due Diligence Checklist and AI Risk Assessment Template) written from your answers. Free, no card, no obligation. For hands-on support, our AI governance consulting team can help.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744.
Read more about soc 2 compliance from Opsio.
About the Author
Director & MLOps Lead
Vaishnavi leads machine learning operations initiatives at Opsio, enabling ML and predictive capabilities for industrial and automotive operations. Her expertise spans predictive maintenance, industrial data analysis, vibration-based condition monitoring, and applied AI — with a focus on practical, experiment-driven solutions designed for real operational environments.
Editorial standards: This article was written by a certified practitioner and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.