Understanding the EU AI Act's Tiered Risk Framework

The European Union Artificial Intelligence Act (EU AI Act) is the world's first comprehensive legal framework for artificial intelligence, designed to ensure safety and protect fundamental rights while fostering innovation. This article provides a clear breakdown of how the legislation classifies and regulates AI systems based on a four-tier risk model: unacceptable, high, limited, and minimal risk. It also examines the specific obligations introduced for General-Purpose AI (GPAI) models and the severe penalties for non-compliance.

Unacceptable Risk: Banned AI Practices

AI systems that pose a clear threat to the safety, livelihoods, and rights of people are classified as having unacceptable risk. The EU AI Act strictly prohibits these systems from being deployed or marketed within the European Union.

Banned practices include:

  • Social Scoring: Systems used by governments or companies to evaluate and classify individuals based on their social behavior or personal traits.
  • Subliminal Manipulation: AI that uses manipulative or deceptive techniques to distort a person's behavior and impair their ability to make informed decisions, resulting in significant harm.
  • Exploitation of Vulnerabilities: Systems that target specific vulnerable groups—based on age, disability, or socioeconomic situation—to materially distort their behavior.
  • Biometric Categorization: Systems that infer sensitive data such as race, political opinions, trade union membership, religious beliefs, or sexual orientation from biometric data.
  • Untargeted Facial Recognition Databases: The untargeted scraping of facial images from the internet or CCTV footage to create or expand facial recognition databases.
  • Emotion Recognition: AI used to infer emotions of individuals in the workplace and educational institutions, except for medical or safety reasons.
  • Real-Time Remote Biometric Identification: The use of live facial recognition in publicly accessible spaces for law enforcement, which is banned with very narrow exceptions (such as searching for kidnapping victims or preventing a specific terrorist threat).

High Risk: Strict Compliance and Oversight

High-risk AI systems are permitted on the European market, provided they pass rigorous compliance checks before deployment and maintain strict standards throughout their lifecycle.

A system is considered high-risk if it is used as a safety component in a product already regulated by EU safety laws (such as medical devices, lifts, or aviation) or if it falls into specific standalone categories defined by the Act. These standalone categories include:

  • Critical infrastructure management (e.g., water, gas, electricity, and road traffic).
  • Education and vocational training (e.g., scoring exams or determining admissions).
  • Employment and worker management (e.g., CV-sorting software for recruitment or performance evaluation).
  • Access to essential private and public services (e.g., credit scoring, welfare benefits, or emergency services dispatch).
  • Law enforcement activities that may interfere with fundamental rights (e.g., evaluating the reliability of evidence).
  • Migration, asylum, and border control management.
  • Administration of justice and democratic processes.

Obligations for High-Risk AI Providers: Developers and deployers of high-risk systems must implement a continuous risk management system, ensure high data governance standards to minimize bias, and maintain detailed technical documentation. Furthermore, these systems must feature automatic logging of events (traceability), provide clear information to users, allow for effective human oversight, and meet high standards of accuracy, robustness, and cybersecurity. Before entering the market, high-risk systems must undergo a conformity assessment and be registered in an EU database.

Limited Risk: Transparency Obligations

The limited risk category applies to AI systems that carry a specific risk of manipulation or deceit. The primary regulatory requirement for this tier is transparency, ensuring that humans know when they are interacting with an AI or consuming AI-generated content.

Specific obligations include:

  • Chatbots and Conversational Agents: Users must be explicitly informed that they are interacting with a machine, unless this is obvious from the context.
  • Synthetic Content and Deepfakes: AI systems that generate or manipulate audio, image, video, or text content must clearly mark the output as artificially generated or manipulated in a machine-readable format.
  • Public Interest Text: Text generated by AI and published to inform the public on matters of public interest must be labeled as artificial, unless the content has undergone human review and a person or organization holds editorial responsibility for it.

Minimal or No Risk: Unregulated Innovation

The vast majority of AI systems currently used in the EU fall into the minimal risk category. This includes applications such as AI-enabled video games, spam filters, and inventory management systems.

The EU AI Act imposes no mandatory legal obligations on minimal-risk AI. Providers of these systems are allowed free rein to develop and deploy them, though the European Commission encourages the voluntary adoption of codes of conduct that mirror the trustworthiness principles applied to high-risk systems.

General-Purpose AI (GPAI) Models

Because foundation models and large language models can be adapted for countless downstream tasks, the EU AI Act regulates General-Purpose AI (GPAI) through a dedicated two-tiered approach:

  1. Standard GPAI Models: All GPAI providers must maintain up-to-date technical documentation, provide information and documentation to downstream providers who integrate the model into their own systems, establish a policy to respect EU copyright law, and publish a sufficiently detailed summary of the content used for training the model.
  2. GPAI with Systemic Risk: Models trained using a total computing power of more than \(10^{25}\) FLOPs (floating-point operations) are presumed to carry systemic risk. In addition to standard GPAI rules, providers of these advanced models must perform model evaluations, conduct adversarial testing (red-teaming), assess and mitigate systemic risks, report serious incidents to the European AI Office, and ensure adequate cybersecurity protections.

Penalties for Non-Compliance

Enforcement of the EU AI Act is backed by substantial financial penalties, which are calculated as a fixed amount or a percentage of a company's total worldwide annual turnover in the preceding financial year, whichever is higher:

  • Banned AI Practices: Fines up to €35 million or 7% of global annual turnover.
  • High-Risk and GPAI Violations: Fines up to €15 million or 3% of global annual turnover.
  • Supplying Incorrect Information: Fines up to €7.5 million or 1% of global annual turnover.

For small and medium-sized enterprises (SMEs) and startups, these administrative fines are capped at the lower of the two specified amounts (the percentage or the fixed euro amount) to prevent disproportionate economic harm.