.svg){kind=icon}
.svg){kind=icon}
What are AI risk classes?
AI risk classes are the categories into which the EU AI Act classifies AI applications. The classification is based on potential harm to people, fundamental rights, safety, or society.
An overview of the four classes: Prohibited (social scoring, manipulation, prohibited biometrics), High Risk (critical infrastructure, personnel selection, the judiciary), Limited Risk (chatbots, deepfakes—with transparency requirements), Minimal Risk (all others—no specific requirements).
Classification criteria: Scope of application (Where is AI used?), Potential for harm (What could go wrong?), Context (Who are the affected parties? How much control do they have?), General-Purpose AI (Large models like GPT have their own rules).
For small and medium-sized businesses, this classification means: First, classify each application. Then, determine the appropriate compliance measures. Misjudgments are costly—so proceed carefully and, when in doubt, seek external advice.
Best Practices for Risk Classification
These six principles have proven effective:
- Describe in concrete terms: The more precise the application, the clearer the class.
- Assess conservatively: When in doubt, err on the side of caution—this protects against fines.
- Conduct cross-functional reviews: Involve business units, legal, compliance, and IT together.
- Document the rationale: Why this classification? Make it transparent for audits.
- Reevaluate when changes occur: New use cases or user groups change the class.
- Seek external advice: Borderline cases are common—experience helps with decision-making.
Common Errors in Classification
We frequently encounter these pitfalls:
- Description too general: A vague description of the application leads to misclassification.
- Classified by the department alone: The legal perspective is missing—misclassification is possible.
- Tendency toward underclassification: To save effort—risky during later audits.
- No documentation: Class is known, but rationale is not—weak during an audit.
- One-time classification: Changes to the application are not reevaluated.
Prohibited vs. High vs. Limited vs. Minimal
Comparison of the four classes:
- Prohibited: No use permitted—social scoring, manipulative AI, prohibited biometrics.
- High: Extensive obligations — risk management, documentation, human oversight.
- Limited: Transparency requirements — labeling, disclosure.
- Minimal: No specific obligations — voluntary compliance recommended.
Classifying AI Applications Correctly
In a free initial consultation, we’ll review your AI portfolio and outline a classification approach—complete with a clear roadmap for AI Act compliance.
As an AI partner for small and medium-sized businesses, we handle the classification using legal and technical expertise. Robust documentation, a practical roadmap, and assured compliance.
What We Offer
- AI Consulting — Classification and AI Act Preparation.
- EU AI Act Glossary — the regulatory framework in detail.
- High-Risk AI in the Glossary — the most critical class.
- AI Compliance in the Glossary — Implementation of obligations.
