The four risk tiers, with examples

Prohibited

Banned outright, whatever the safeguards. Examples: scoring citizens' social behaviour, recognising employees' emotions at work, scraping faces from the internet to build a recognition database. See Prohibited practices.

High-risk

AI that can seriously affect people's health, safety or rights. There are two routes in:

1. 1
   Annex III uses: biometrics; critical infrastructure; education and training; employment and worker management; access to essential services (including credit scoring and life and health insurance pricing); law enforcement; migration and border control; and the administration of justice and democratic processes.
2. 2
   Annex I products: AI that is a safety component of a product already covered by EU safety law, such as medical devices, machinery, toys, lifts or vehicles.

Limited risk (transparency)

AI that talks to people or creates content. People must be told they're dealing with AI, and AI-generated content must be marked. Examples: customer-service chatbots, image generators, deepfakes. See Transparency duties.

Minimal risk

Everything else: spam filters, product recommendations, internal coding assistants, demand forecasting. There are no specific AI Act duties beyond AI literacy, though you may choose to follow voluntary codes.

Things that move a system up a tier

• It makes or strongly shapes a decision about a person.
• It profiles people (always high-risk if the use is in Annex III).
• It is used in a regulated sector such as finance, health or education.
• People can't easily tell it's AI.