EU AI Act risk categories: the four levels explained

The EU AI Act does not regulate "AI" as a whole, but specific use cases, according to the risk they pose to people and to fundamental rights. The same technology can be classified completely differently depending on what it is used for: a language model used as a brainstorming aid is a different matter from the same model used in a recruitment process.

Level 1: Minimal risk

The vast majority of AI applications fall into this category: spam filters, product recommendations, spell checkers. The AI Act sets practically no requirements here. Even so, it is worth keeping these systems in your AI inventory too. When an audit comes round, if not before, you will want to be able to show that you have checked your classification.

Level 2: Limited risk

This level is mainly about transparency. Chatbots, generated text, AI-generated images: users must be able to recognise that they are dealing with AI. Deepfakes must be labelled as such. The obligations under Article 50 are manageable, but they have been binding since August 2026 and are often forgotten.

Level 3: High risk

Now things get serious. High-risk AI is found wherever decisions are made about people: applicant scoring, credit checks, access to education, medical applications. Anyone who provides or deploys such systems has to meet a whole package of obligations:

• Risk management throughout the entire lifecycle
• Technical documentation and conformity assessment
• Logging and traceability of results
• Human oversight: a person must be able to intervene
• Registration in the EU database for high-risk systems

The timeline has recently changed: following the postponement under the Digital Omnibus, these obligations apply to most use cases from 2 December 2027 instead of from August 2026, as originally planned. If you use high-risk AI, you should still make good use of the time, because the package of obligations is extensive.

The most important question is not "Do we use AI?" but "What does our AI make decisions about?" Almost everything depends on that.

Level 4: Unacceptable risk

These applications have simply been prohibited since February 2025: social scoring, manipulative techniques that exploit vulnerabilities, emotion recognition in the workplace and in educational institutions, untargeted scraping of facial images. There is no transition period here and no exemption for small businesses.

So where does your AI stand?

Classification is the first and most important step in any AI Act compliance, because everything else follows from it. The good news: for most applications, the answer is "minimal" or "limited", and the obligations are quickly met.

How Klaus classifies your AI

If you do the classification yourself, you have to weigh Annex III, the exceptions in Article 6(3) and the list of prohibitions in Article 5 against each other. That is exactly what Klaus takes off your hands: first, in the free AI check-up, Klaus records your AI inventory and screens every tool for signs of high-risk use. For a definitive answer, you then start an assessment project, in which Klaus runs every system through the same cascade of checks that lawyers use:

Two features make this assessment reliable. First, Klaus checks twice: the assessment from the initial inventory is only provisional and is systematically redone in the regulatory assessment. If the cascade shows that no high-risk area applies, the system is downgraded. So Klaus does not classify everything as high-risk just to be on the safe side, a common mistake of one-size-fits-all advice that saddles you with a package of obligations you do not actually need. Second, you get more than just a label at the end: the result states the risk category with the reasons for it, your GDPR status, whether a data protection impact assessment is needed, and the specific tasks, tailored to your role as deployer or provider.