A step-by-step guide to determining where your AI product sits in the EU AI Act risk tiers, with the classification test, worked examples, and common mistakes to avoid.
This article is educational guidance for practitioners, not legal advice. For compliance decisions, consult a qualified legal or regulatory professional.Why Classification Comes First
Before you can comply with the EU AI Act, you need to know which tier your system sits in. The obligations vary dramatically: a minimal-risk system needs almost nothing from you, while a high-risk system requires conformity assessments, technical documentation, human oversight mechanisms, and EU database registration.
The classification question is also the one engineering and product teams get most wrong. The most common mistake is assuming a system is low-risk because it feels innocuous, without checking whether it falls into one of the eight Annex III categories.
The Four Risk Tiers
| Tier | What it covers | Your obligations |
|---|---|---|
| Prohibited (Article 5) | AI systems that pose unacceptable risk — social scoring by public authorities, real-time remote biometric ID in public spaces, subliminal manipulation, exploitation of vulnerability, predictive policing on personal characteristics | You cannot deploy these. Systems in use before Feb 2, 2025 must have been discontinued or modified. |
| High-risk (Article 6) | AI used as safety components in regulated products (Annex I), or stand-alone AI in eight sensitive domains (Annex III) | Full compliance: conformity assessment, technical documentation, human oversight, registration, incident reporting. |
| Limited risk (Article 50) | Chatbots, deepfakes, AI-generated content, emotion recognition systems used in other contexts | Transparency obligations only: disclose to users they are interacting with AI. |
| Minimal risk (all others) | Spam filters, inventory optimisation, recommendation systems, most internal productivity tools | No mandatory requirements. Voluntary codes of practice encouraged. |
The Two Routes to High-Risk
Route 1: Safety Component in a Regulated Product (Annex I)
If your AI system is used as a safety component of a product covered by specific EU harmonisation legislation, it is high-risk — regardless of what it does. The listed legislation includes: medical devices (MDR, IVDR), machinery, radio equipment, civil aviation, automotive, railway, marine equipment, and a few others.
The practical test: if your AI system would need CE marking as part of the product it sits in, it is almost certainly Annex I high-risk. The conformity assessment for the AI system is conducted as part of the existing CE marking process for the product.
If you build AI for a medical device, industrial machinery, or vehicle ADAS system, stop here. You are Annex I high-risk and need to work through the CE marking pathway. Your notified body will guide the AI-specific documentation requirements.Route 2: Stand-Alone AI in Eight Sensitive Domains (Annex III)
These are the categories that catch most software companies off-guard. An AI system is high-risk under Annex III if it falls into one of eight domains:
| Annex III Category | Examples of systems in scope |
|---|---|
| 1. Biometric identification and categorisation | Systems that identify or categorise people by biometric data. Note: post-hoc biometric ID in law enforcement requires court authorisation. Real-time remote biometric ID in public spaces is largely prohibited under Article 5. |
| 2. Critical infrastructure | AI managing or controlling road traffic, water supply, gas, electricity, or heating networks. |
| 3. Education and vocational training | AI used to determine access to educational institutions, assign students, evaluate exam performance, or monitor students during exams. |
| 4. Employment and workers management | Recruitment AI (CV screening, interview scoring), task allocation systems, performance monitoring, promotion/termination decisions. |
| 5. Essential private and public services | Credit scoring, insurance risk assessment, emergency services dispatch prioritisation, public benefit entitlement assessment. |
| 6. Law enforcement | Risk assessment tools used on individuals, polygraph-like tools, tools to evaluate reliability of evidence, crime analytics targeting natural persons. |
| 7. Migration, asylum, and border control | Risk assessment of applicants, identity verification of travel documents, visa and asylum application processing. |
| 8. Administration of justice and democratic processes | AI tools used by courts to research or interpret facts, AI influencing election outcomes. |
The Filtering Mechanism You Probably Did Not Know About
Article 6(3) added a significant narrowing filter in the final Act text that many practitioners miss. An AI system in Annex III is NOT high-risk if it does not pose a significant risk of harm to the health, safety, or fundamental rights of natural persons.
Providers can self-assess this exclusion and document it. If you conclude your Annex III system falls under this filter, you register that conclusion in the EU AI system database.
The filter does NOT apply to Category 5 (essential services including credit scoring and public benefits) or Category 6 (law enforcement). Those are always high-risk if they fall within Annex III scope. Categories 1 through 4 and 7 through 8 can use the filter.The filter is useful if, for example, your recruitment AI only pre-screens for administrative eligibility (e.g., does the applicant have the required qualifications?) rather than ranking or scoring candidates. Document your reasoning carefully — national market surveillance authorities will scrutinise these self-assessments.The Classification Test: Step by Step
- Is the system prohibited under Article 5? If yes, stop — it cannot be deployed.
- Is the AI system used as a safety component in a product covered by Annex I legislation (medical devices, machinery, vehicles, aviation, etc.)? If yes, it is high-risk via Route 1.
- Does the AI system fall within one of the eight Annex III categories? If no, it is limited-risk or minimal-risk — check Article 50 transparency obligations.
- If yes to step 3: Is this Category 5 (essential services) or Category 6 (law enforcement)? If yes, it is always high-risk — no filter applies.
- For other Annex III categories: does the system pose a significant risk of harm to health, safety, or fundamental rights? If yes, it is high-risk. If no, document your reasoning and register the exclusion.
Worked Examples
| AI System | Classification | Reasoning |
|---|---|---|
| CV screening tool that ranks job applicants | High-risk (Annex III, Category 4) | Employment/workers management. Ranking candidates directly affects access to employment. No filter applies to ranking systems. |
| Internal HR chatbot that answers employee FAQ questions | Minimal risk | Does not make decisions about employment conditions. No Annex III category applies. Article 50 transparency required if users might not know it is AI. |
| Loan default risk scoring engine for a bank | High-risk (Annex III, Category 5) | Essential private services / credit scoring. Filter does not apply to Category 5. |
| Content recommendation engine on a streaming platform | Minimal risk | No Annex III category applies. Not a safety component. Standard transparency obligations around personalisation may apply under other legislation. |
| AI proctoring software used during online university exams | High-risk (Annex III, Category 3) | Education — monitoring students during exams is explicitly in scope. Filter could potentially apply if system only flags anomalies for human review (document carefully). |
| AI-based CAPTCHA solver for internal QA testing | Minimal risk | Internal tooling, no decisions affecting natural persons in high-risk domains. |
| Emotion detection AI built into a call centre platform sold to insurance companies | High-risk (Annex III, Category 5) | Emotion recognition in insurance risk context. Category 5 filter does not apply. |
| General-purpose AI assistant (e.g., coding copilot) deployed internally | Minimal risk / GPAI considerations | Not Annex III. If built on a GPAI model (Chapter V), model provider obligations apply. Deployer obligations are minimal for non-high-risk use cases. |
Common Classification Mistakes
- Assuming 'we use an off-the-shelf model so we are not responsible.' If you deploy an AI system in a high-risk domain, you are the provider or deployer — with obligations regardless of which model underpins it.
- Treating the Annex III categories as exhaustive descriptions. The categories are defined by the domain and the function, not the technology. A novel AI architecture can still fall into a decades-old category.
- Applying the Article 6(3) filter without documentation. The filter requires you to write down why your system does not pose significant risk. A verbal decision is not sufficient.
- Confusing GPAI model compliance with deployer compliance. If you use a GPAI model (Claude, GPT-4, Gemini, etc.) in a high-risk use case, the model provider has their own obligations — but you as the deployer have separate high-risk system obligations.
- Assuming B2B deployment removes high-risk status. If your system is used in an Annex III domain and affects natural persons, the classification follows the function, not the sales channel.
If You Are High-Risk: What Is Required
This article focuses on classification. Once confirmed as high-risk, your obligations under Articles 8 through 15 include:
- Risk management system (Article 9): documented, continuous, covering known and foreseeable risks.
- Data governance (Article 10): training, validation, and testing data must meet quality criteria.
- Technical documentation (Article 11 + Annex IV): comprehensive documentation of system design, data, testing, and performance.
- Record-keeping (Article 12): automatic logging of AI system operation.
- Transparency and user information (Article 13): clear documentation for deployers and users.
- Human oversight (Article 14): technical measures enabling meaningful human oversight.
- Accuracy, robustness, and cybersecurity (Article 15): performance and security requirements.
- Conformity assessment (Article 43): self-assessment or third-party assessment depending on category.
- EU AI systems database registration (Article 71): before deployment.
The EU AI Office publishes guidance notes on specific Annex III categories. These are free to download and more practical than the legislative text for category-specific questions.Quick Reference: Classification at a Glance
| Question | If Yes | If No |
|---|---|---|
| Is it prohibited under Article 5? | Cannot deploy | Continue |
| Is it a safety component in an Annex I product? | High-risk (Route 1) | Continue |
| Does it fall in an Annex III category? | Continue | Limited or minimal risk |
| Is it Category 5 or 6? | Always high-risk | Apply filter test |
| Does it pose significant risk of harm to people? | High-risk | Document + register as non-high-risk |