The EU AI Act regulates AI by risk, not by technology — so the whole framework hangs on which of four tiers your system falls into. This guide explains each category with examples and the obligations that come with it. Part of our guide to the EU AI Act.
Rather than regulate all AI the same way, the EU AI Act sorts systems into four tiers by the risk they pose to health, safety and fundamental rights. The higher the tier, the stricter the obligations — so classifying each system correctly is the first and most important compliance step.
Some uses are banned outright because the risk is deemed unacceptable — for example, social scoring by public authorities, manipulative or exploitative techniques that cause harm, untargeted scraping of facial images to build recognition databases, emotion recognition in workplaces and schools, and certain biometric categorisation. Real-time remote biometric identification in public spaces is prohibited with narrow law-enforcement exceptions. These prohibitions have applied since February 2025.
High-risk systems carry the full obligations. They fall into two groups:
After the 2026 Digital Omnibus, high-risk obligations apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. See EU AI Act requirements for high-risk AI.
Systems like chatbots, generative AI and deepfakes fall into the limited-risk tier: they must meet transparency duties under Article 50 — telling people they're interacting with AI, marking AI-generated content in machine-readable form, and labelling deepfakes. These transparency rules apply from August 2026.
Everything else — spam filters, recommendation engines, AI in video games — is minimal risk, with no specific obligations under the Act, though voluntary codes of conduct are encouraged.
Work top-down: is the use prohibited? If not, is it a high-risk use under Annex III or a safety component under Annex I? If not, does it interact with people or generate content (limited-risk transparency)? If none apply, it's minimal risk. Document the decision — the classification and its rationale are part of your compliance evidence. The full sequence is in EU AI Act compliance.
Every obligation flows from the tier. Misclassify a high-risk system as limited-risk and you'll miss the requirements that carry the largest penalties. This is why a documented, defensible classification of every AI system is where EU AI Act compliance begins.
AramGRC classifies your AI systems against the Act's tiers and Annexes, and builds the compliance roadmap that follows from each classification.
Four: unacceptable risk (prohibited), high risk (full obligations), limited risk (transparency duties), and minimal risk (no specific obligations).
AI used in areas like employment, credit scoring, education, essential services, biometrics, law enforcement and critical infrastructure (Annex III), or as a safety component of regulated products like medical devices and vehicles (Annex I).
Practices deemed unacceptable — social scoring by authorities, manipulative techniques, untargeted facial-image scraping, workplace and school emotion recognition, and certain biometric categorisation — banned since February 2025.
Systems like chatbots, generative AI and deepfakes, which must meet transparency obligations — disclosing AI interaction and marking AI-generated content — from August 2026.
What the EU AI Act is, the risk categories, obligations, timeline and penalties.
A step-by-step guide and checklist to comply with the EU AI Act.
The four risk tiers, prohibited practices and high-risk AI systems.
You're here
What providers and deployers of high-risk AI must do.
The phased dates — and what the 2026 Digital Omnibus changed.
Fines up to €35M or 7% of global turnover — the full structure.
AI compliance across the EU AI Act, ISO 42001, NIST AI RMF and India's DPDP.