The EU AI Act's risk tiers

What the AI Act is

The EU AI Act is a regulation, which means it applies directly in every EU country without each passing its own law. It's built like EU product safety law: before something risky goes on the market, it has to meet requirements, be checked, and be watched after release. The difference is that the "product" is an AI system, defined broadly as a machine-based system that infers from its inputs how to produce outputs such as predictions, content, recommendations or decisions.

Its central idea: the rules depend on what a system is used for, not on the technology. The same language model can be minimal risk in an email assistant and high-risk in a tool that screens job applicants.

Enlarge (opens the diagram full size)

Close

Tier 1: prohibited

Article 5 bans uses considered an unacceptable risk. Since February 2, 2025, these may not be placed on the EU market or used there:

• Manipulation: subliminal or deliberately deceptive techniques that distort people's behaviour and cause significant harm.
• Exploiting vulnerabilities of age, disability, or social or economic situation.
• Social scoring: rating people on social behaviour or personal traits, leading to unjustified or unrelated bad treatment.
• Predicting crime from profiling alone: judging someone's risk of offending only from their personality or traits.
• Untargeted scraping of faces from the internet or CCTV to build facial recognition databases.
• Emotion recognition at work and in education, except for medical or safety reasons.
• Biometric categorization that infers sensitive traits, such as race, political opinions, religion or sexual orientation.
• Real-time remote biometric identification in public spaces by police, with narrow exceptions (searching for victims, preventing an imminent threat, finding suspects of serious crimes) under authorization.

The Digital Omnibus added two more, from December 2, 2026, with no exemption for systems already on the market: AI systems that generate non-consensual intimate images ("nudifier" apps) or child sexual abuse material. For providers, the ban covers systems built for it, and those where it's a foreseeable outcome without reasonable safeguards.

Tier 2: high-risk

High-risk systems are allowed, with the heaviest duties. A system is high-risk in one of two ways (Article 6):

• Annex I: it's a safety component of a regulated product, or is one: medical devices, toys, lifts, vehicles and the like, already covered by EU product law.
• Annex III: it's used in one of eight areas:

The exemption, and its limit

An Annex III system is not high-risk if it doesn't pose a significant risk of harm and only does something narrow (Article 6(3)): a narrow procedural task, improving the result of work a person already did, spotting patterns without replacing a person's assessment, or a preparatory task. Two conditions come with it:

• Profiling people is always high-risk. If the system profiles individuals in an Annex III area, the exemption doesn't apply.
• Using the exemption still means registering. The provider must document why the system isn't high-risk and register it in the EU database (the Omnibus kept this, with a simpler procedure).

What high-risk means you must do

Providers of high-risk systems (Articles 9 to 17 and onwards) must have:

• a risk management system running across the system's life;
• data governance: training, validation and test data that's relevant, representative and checked for bias;
• technical documentation, and automatic logs of the system's operation;
• instructions for use that tell deployers what it does, its limits and its accuracy;
• human oversight designed in: people able to understand, monitor, and stop or override it;
• appropriate accuracy, robustness and cybersecurity;
• a quality management system, a conformity assessment before release, CE marking, registration in the EU database, post-market monitoring, and reporting serious incidents.

Deployers (Article 26) must use it according to the instructions, give oversight to people with the competence and authority to do it, monitor it, keep its logs for at least six months, and tell workers before using it on them. Public bodies, and private ones doing credit scoring or life and health insurance pricing, must also do a fundamental rights impact assessment first (Article 27).

That list is, almost line for line, what Lessons 2 and 3 described: risk management, data rules, records, testing, a person in the loop. The difference is that here it's law, with an auditor and fines.

Tier 3: transparency

Article 50 applies from August 2, 2026, to systems that interact with people or make content, whatever their risk tier:

• Chatbots and AI assistants must tell people they're dealing with AI, unless it's obvious.
• AI-generated content (text, images, audio, video) must be marked in a machine-readable way, such as a watermark or metadata. Systems already on the market before August 2, 2026 have until December 2, 2026 for this part.
• Deepfakes must be disclosed by whoever publishes them.
• Emotion recognition and biometric categorization (where allowed) must be disclosed to the people exposed to them.

Tier 4: minimal risk

Everything else: spam filters, recommendations, autocomplete, most internal tools, most of the AI in use. No new duties. The Act encourages voluntary codes of conduct, and an AI literacy duty (Article 4) has applied since February 2025: the Omnibus softened it from providers and deployers ensuring their staff's AI competence to the Commission and member states supporting it, but training the people who use AI remains sensible, and expected.

Alongside: general-purpose AI models

General-purpose AI models, the large models others build on, have their own rules (Articles 51 to 56), since August 2, 2025. Their providers must keep technical documentation, give downstream providers information to use the model safely, have a copyright policy, and publish a summary of training content. Models with systemic risk (very large ones, presumed above 10²⁵ floating-point operations of training compute) must also evaluate and test them adversarially, report serious incidents and secure them. A voluntary Code of Practice, published in July 2025, is the main way providers show they comply.

A model and a system are different things here. A company building a hiring tool on someone else's model is the provider of a high-risk system, even though it didn't make the model.

Who you are: roles

Roles can change. A deployer that substantially modifies a high-risk system, puts its own name on one, or uses a system for a high-risk purpose it wasn't meant for, becomes its provider, with all a provider's duties.

Reach beyond Europe

The Act applies to (Article 2):

• providers placing systems on the EU market, wherever they're based;
• deployers located in the EU;
• providers and deployers outside the EU when the output of their system is used in the EU.

That last one is why American companies pay attention. A US hiring tool used by a German employer's HR team is covered; so is a US company's system whose decisions are used about people in the EU.

Penalties

Fines are set as a fixed amount or a percentage of worldwide annual turnover, whichever is higher (for small companies, whichever is lower):

• Prohibited practices: up to €35 million or 7%.
• Most other obligations: up to €15 million or 3%.
• Supplying incorrect information to authorities: up to €7.5 million or 1%.

The dates, after the Omnibus

The Omnibus also narrowed what counts as a safety component (AI that only assists or optimizes isn't automatically high-risk if its failure endangers no one), moved machinery mostly out of the Act's direct reach, extended small-company relief to "small mid-caps", allowed processing of sensitive data to detect and correct bias in all AI systems where strictly necessary, and gave the Commission's AI Office direct supervision of systems built on general-purpose models by the same provider.

Does it apply to the mayor check?

Work through it the way a lawyer would, in order. (Still not legal advice.)

1. Is it an AI system? Yes. A model infers a name from a page: that's inference from inputs to an output.
2. Is CivicGrid in scope? It's a US service. It isn't placing an AI system on the EU market, and nobody in the EU uses the check. Its output (a mayor's name) ends up in a data service, and if an EU customer used that data in the EU, the output would arguably be "used in the Union". Assume it could be in scope, and see what that would mean.
3. Is it prohibited? No. Nothing in Article 5 comes close.
4. Is it high-risk? No. It's not in a regulated product (Annex I), and reading a mayor's name off a city's website isn't in any Annex III area: it doesn't decide anything about anyone's job, credit, education, benefits or rights.
5. Transparency? No. It doesn't talk to people, and it doesn't generate content: it extracts a name that already exists, word for word.
6. So: minimal risk. No new duties. AI literacy for the one person running it is, in practice, already there.

But change the use, and the answer changes. If the same model and code ranked city job applicants, the system would be high-risk under Annex III's employment area, whoever made it, and CivicGrid would be its provider. The tier lives in the use.

And keeping the records anyway is worth it: the run logs, the regression cases and the review trail are exactly what a customer, or a regulator, would ask for if the use ever changed.

Spot the problem

Work out what's wrong before you read the explanation.

"A human makes the final decision." A recruiting software company sells a tool to European employers that reads CVs and gives each applicant a fit score from 1 to 100. Recruiters see the ranked list and decide whom to interview. The company's lawyers conclude it isn't high-risk: it only does a "preparatory task", and a human makes every decision, so Article 6(3) applies. They document the reasoning and move on. What's wrong? Scoring each applicant is profiling, and profiling in an Annex III area is always high-risk. Article 6(3)'s exemption explicitly doesn't apply to systems that profile people, and an individual fit score built from a person's CV is exactly that. "A human makes the final decision" doesn't change the classification either: a ranked list shapes whom the recruiter even looks at, which is the automation bias problem from Lesson 1. Three fixes: classify by what the system does to people, not by who clicks the last button; read the exemption's limits before relying on it (and register even when it does apply); and treat a "human in the loop" as a control to design and prove (Lesson 9), not as a way out of the rules.

Where you are now

You can place an AI use in the EU AI Act's tiers, say what each tier requires and since when, tell a provider from a deployer, explain why a US company can be covered, and spot the exemption argument that doesn't hold. The next lesson crosses back to the US: rules for federal agencies, the executive orders of 2025 and 2026, and the fight over state AI laws.

Check yourself

Key terms

• EU AI Act: Regulation (EU) 2024/1689, the EU's law on AI systems and general-purpose models.
• Digital Omnibus on AI: Regulation (EU) 2026/1744, which amended the Act's dates and some of its rules.
• AI system: under the Act, a machine-based system that infers from inputs how to generate outputs that can influence physical or virtual environments.
• Provider and deployer: who makes or puts a system on the market under their name, and who uses it professionally.
• High-risk AI system: one in an Annex I regulated product, or used in an Annex III area, unless the narrow exemption applies.
• Conformity assessment: the check, by the provider or a notified body, that a high-risk system meets the requirements before release.
• Fundamental rights impact assessment (FRIA): an assessment some deployers must do before using a high-risk system.
• General-purpose AI model: a model that can perform a wide range of tasks and is built into other systems.
• Systemic risk: the Act's term for the most capable general-purpose models, with extra duties.
• AI Office: the European Commission's body that supervises general-purpose models and coordinates enforcement.

Go deeper

• The AI Act Explorer (opens in a new tab), with the Act's text and its Digital Omnibus page (opens in a new tab).
• Cooley: the Digital AI Omnibus (opens in a new tab), the final dates and changes.
• Gibson Dunn: the Omnibus agreement (opens in a new tab), and Orrick's eight compliance changes (opens in a new tab).
• Try: classify three AI uses you know: one you think is minimal risk, one that talks to people, and one that decides something about people. Which Annex III area, if any, does the third fall into?
• Try: read Article 6(3)'s four conditions and its profiling exception. Write one system that would qualify, and one that looks like it should but doesn't.