The AI Act risk categories are the foundation of the EU Artificial Intelligence Act.
Every AI system used or deployed in the European Union falls into one of four regulatory risk levels, which determine the compliance obligations that companies must follow.
Understanding these categories is the first step for any organization that develops, deploys, or integrates AI systems in Europe.
In this guide we explain:
• the four AI Act risk categories
• real-world examples
• how Annex III defines high-risk systems
• what this means for companies operating in the EU
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
What are AI Act risk categories?
Definition
AI Act risk categories are the classification system used in the EU Artificial Intelligence Act to regulate artificial intelligence systems according to the level of risk they pose to safety, fundamental rights, and society.
The regulation divides AI into four main categories:
| Risk Level | Regulatory Treatment |
|---|---|
| Unacceptable risk | Prohibited |
| High risk | Strict compliance requirements |
| Limited risk | Transparency obligations |
| Minimal risk | No specific obligations |
This risk-based approach is the central regulatory logic of the AI Act.
Instead of regulating every AI system equally, the law focuses regulatory effort where the potential impact on citizens and society is greatest.
Unacceptable Risk AI Systems
Systems that are banned under the AI Act
AI systems classified as unacceptable risk are prohibited in the European Union.
These are systems considered incompatible with EU values and fundamental rights.
Examples include:
• AI systems that manipulate human behaviour in ways that may cause harm
• certain types of social scoring systems
• AI exploiting vulnerabilities of children or vulnerable persons
• specific biometric identification practices in public spaces
The prohibition rules appear primarily in Article 5 of the AI Act.
Companies developing or deploying such systems cannot legally place them on the EU market.
High-Risk AI Systems
The most important category for companies
Most regulatory obligations under the AI Act apply to high-risk AI systems.
These systems are allowed in the EU market but must comply with strict governance and risk management requirements.
Typical examples include AI systems used in:
• recruitment and employee management
• credit scoring
• critical infrastructure
• medical devices
• education systems
• law enforcement applications
Companies operating high-risk systems must implement:
• risk management systems
• data governance measures
• technical documentation
• human oversight mechanisms
• post-market monitoring
These requirements are detailed in Title III of the AI Act.
Limited Risk AI Systems
Transparency obligations
Limited-risk AI systems are subject mainly to transparency requirements.
Users must be informed that they are interacting with AI.
Typical examples include:
• chatbots
• AI-generated content systems
• deepfake technologies
The goal is to ensure that users are aware when AI is involved in a decision or interaction.
Minimal Risk AI Systems
The majority of AI applications
Most AI systems fall into the minimal risk category.
Examples include:
• spam filters
• AI used in video games
• recommendation algorithms for entertainment platforms
These systems are not subject to specific AI Act obligations, although companies may voluntarily adopt codes of conduct.
Annex III High-Risk AI Systems (Overview)
How high-risk AI systems are defined
A large portion of high-risk AI systems is defined in Annex III of the AI Act.
Annex III lists specific areas where AI systems are automatically classified as high risk.
The following table provides an overview of the main domains covered by Annex III and examples of AI systems that may fall into this category.
| Annex III Area | Example AI System | Risk Concern |
|---|---|---|
| Biometric identification | Facial recognition | Privacy and civil liberties |
| Education | AI exam grading | Fair access to education |
| Employment | AI hiring tools | Hiring discrimination |
| Access to essential services | Credit scoring | Financial exclusion |
| Law enforcement | Predictive policing | Due process risks |
| Migration and border control | Visa risk scoring | Human rights impact |
| Administration of justice | AI judicial assistance | Judicial fairness |
AI systems deployed in these domains are subject to the high-risk requirements of the EU AI Act, including risk management, technical documentation, human oversight and post-market monitoring obligations.
Companies operating AI systems in these domains should carefully review Annex III to determine whether their systems fall under the high-risk category.
What Companies Should Do Next
Organizations operating in the EU should begin by mapping their AI systems against the AI Act risk categories.
A simple first step is to create an internal inventory of:
• AI tools used in operations
• third-party AI systems integrated into workflows
• AI-driven decision systems affecting customers or employees
Once the systems are identified, companies can assess whether any of them fall under high-risk classification.
This process will become increasingly important as AI Act obligations gradually enter into force over the coming years.
Download your free AI Act Compliance Tracker for SMEs.
See the AI Act Compliance Tracker for SMEs here to learn what it does.
FAQ: AI Act Risk Categories
What are the four AI Act risk categories?
The EU AI Act classifies artificial intelligence systems into four categories: unacceptable risk, high risk, limited risk, and minimal risk.
What AI systems are banned by the AI Act?
AI systems considered unacceptable risk, such as certain forms of social scoring or manipulative AI systems, are prohibited in the EU.
What is a high-risk AI system?
A high-risk AI system is an AI application that may significantly affect safety or fundamental rights and therefore must comply with strict governance, documentation, and monitoring requirements.
What is Annex III of the AI Act?
Annex III lists specific domains where AI systems are automatically classified as high-risk, such as employment, education, and law enforcement.
