EU AI Act Risk Tiers: Complete Breakdown
Your obligations are entirely determined by which risk tier your AI system falls into. Here is what each tier covers, what qualifies, and what you must do.
Unacceptable risk
Banned · Feb 2, 2025Article 5 prohibits AI practices considered a clear threat to safety, livelihoods, and fundamental rights.
Subliminal, manipulative, or deceptive techniques that materially distort behavior and cause significant harm
Exploiting vulnerabilities of people due to age, disability, or social or economic situation
Social scoring of individuals by public or private actors leading to detrimental treatment
Predicting criminal offences based solely on profiling or personality traits
Untargeted scraping of facial images from the internet or CCTV to build facial recognition databases
Emotion recognition in workplaces and educational institutions (except for medical or safety reasons)
Biometric categorization to infer race, political opinions, trade union membership, religion, or sexual orientation
Real-time remote biometric identification in publicly accessible spaces for law enforcement, with narrow exceptions
High risk
Compliance · Aug 2, 2026A safety component of a product under EU harmonization law (Annex I), or used in one of eight sensitive domains in Annex III.
Biometrics
Remote biometric identification, categorization, and emotion recognition systems not otherwise banned.
Critical infrastructure
Safety components in digital infrastructure, road traffic, and water, gas, heating, and electricity supply.
Education and training
Admissions, assessing learning outcomes, monitoring exams, and determining access to education.
Employment and HR
Recruitment, CV screening, promotion and termination decisions, task allocation, and performance monitoring.
Essential services
Creditworthiness assessment, life and health insurance pricing, public benefits eligibility, emergency dispatch.
Law enforcement
Evidence reliability evaluation, risk assessments of victims or offenders, and profiling in investigations.
Migration and border control
Risk assessments of travelers, examining asylum and visa applications, and identifying individuals.
Justice and democracy
Assisting judicial authorities in interpreting law, and systems intended to influence elections.
Risk management system
A continuous, documented process to identify, evaluate, and mitigate risks across the AI system's lifecycle.
Data governance
Training, validation, and test data must be relevant, representative, and examined for bias.
Technical documentation
Detailed documentation proving compliance, prepared before the system is placed on the market.
Record-keeping and logging
Automatic logging of events to ensure traceability throughout the system's operation.
Transparency to deployers
Clear instructions for use covering capabilities, limitations, accuracy, and required oversight.
Human oversight
Design measures that allow natural persons to monitor, interpret, and override the system.
Accuracy, robustness, and cybersecurity
Appropriate performance levels declared and maintained, with resilience against errors and attacks.
Quality management and conformity assessment
A quality management system, conformity assessment, CE marking, and EU database registration.
Step-by-step implementation is covered in the Compliance Guide.
Limited risk
In force · Aug 2, 2026Transparency obligations under Article 50. People must know when they are dealing with AI.
Chatbots and conversational AI
Users must be informed they are interacting with an AI system, unless obvious from context.
Deepfakes
Image, audio, or video resembling real people, places, or events must be disclosed as artificially generated or manipulated.
AI-generated content
Providers of generative AI must mark outputs in a machine-readable format so they are detectable as AI-generated.
Emotion recognition & biometrics
Where permitted, people exposed to these systems must be informed.
Minimal risk
No mandatory requirementsSpam filters, inventory forecasting, AI in video games, and most recommendation engines.
No mandatory obligations
The vast majority of AI systems in use today fall into this tier and face no mandatory obligations under the Act.
Voluntary codes of conduct
Organizations are encouraged to adopt high-risk-style principles such as transparency, human oversight, and environmental sustainability.
Not sure which tier applies? Check the key dates and FAQ.
Track every regulatory milestone in one place with the EU AI Act Deadline Tracker.
Know where your AI systems stand before August 2026.
The 2-minute readiness assessment maps your AI deployments to the EU AI Act's risk tiers and shows where your compliance gaps are.