---
title: "AI Act Risk Classification: the Four Risk Levels | Pitch"
description: "The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in."
url: https://pitch.law/academy/ai-act-risk-classification-explained
---

[pitch](https://pitch.law/) [Academy](https://pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://pitch.law/academy/topics/legal-aspects-of-artificial-intelligence)

# AI Act Risk Classification: the Four Risk Levels

The AI Act sorts AI into unacceptable (prohibited), high, limited (transparency) and minimal risk. How to tell which level your AI system falls in.

- - By [Bart Lieben](https://pitch.law/team/bart-lieben), Attorney-at-Law
  - 25 February 2026

- Updated

  30-10-2026

## The legal framework

The AI Act ([Regulation (EU) 2024/1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689)) attaches obligations to the risk class of a system. Classification is therefore the first legal question, and the answer depends on the intended purpose of the system and the context in which it is used, not on the technology as such.

### Prohibited practices

[Article 5](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_5) prohibits, among others, manipulative or exploitative techniques that cause significant harm, social scoring, untargeted scraping of facial images, emotion recognition in the workplace and education (except for medical or safety reasons) and certain uses of biometric identification. [Regulation (EU) 2026/1744](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32026R1744#art_1) adds two prohibitions on AI systems that generate non-consensual intimate imagery or child sexual abuse material; they apply from 2 December 2026.

### High-risk systems

[Article 6](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_6) gives two routes. First, an AI system that is a safety component of a product, or is itself a product, covered by the EU harmonisation legislation listed in Annex I (machinery, medical devices, toys and others) and that requires third-party conformity assessment. Second, a system listed in [Annex III](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#anx_III), which covers eight areas:

- biometrics;
- critical infrastructure;
- education and vocational training;
- employment and worker management;
- access to essential private and public services, including credit scoring and life and health insurance pricing;
- law enforcement;
- migration, asylum and border control;
- administration of justice and democratic processes.

An Annex III system is not high-risk if, under Article 6(3), it does not pose a significant risk of harm to health, safety or fundamental rights, for example because it only performs a narrow procedural task, improves the result of a previously completed human activity, detects deviations from earlier decision patterns, or performs a preparatory task. A system that performs profiling of natural persons is always high-risk. A provider that relies on the exemption must document its assessment before placing the system on the market and register the system.

### Transparency duties

[Article 50](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_50) requires that people are told when they interact with an AI system, that synthetic audio, image, video or text is marked as artificially generated, that deployers of emotion recognition or biometric categorisation inform the persons exposed, and that deepfakes are disclosed. These duties can apply to a system on top of any other class.

### The remainder

Systems that fall in none of these categories, such as spam filters or AI in video games, carry no specific obligations, but [Article 4](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_4) on AI literacy still applies.

## In practice

A bank uses an AI model to assess consumer credit applications. Creditworthiness assessment of natural persons is listed in Annex III, point 5, and the model builds a profile of the applicant, so the Article 6(3) exemption is not available. The system is high-risk.

The same bank deploys a chatbot for general questions. It is not in Annex III, so it is not high-risk, but Article 50 requires that customers are told they are talking to an AI system.

A logistics company uses an AI tool that sorts incoming invoices into folders. The tool performs a purely preparatory task with no decision about individuals, and in any case it is not in an Annex III area. It carries no specific obligations other than AI literacy.

A recruitment agency uses software that scores CVs. This falls under employment in Annex III and involves profiling, so it is high-risk. See [AI in HR and recruitment](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act).

Each conclusion should be written down with the reasoning. Where a high-risk system processes personal data, a [data protection impact assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment) is often required as well.

A useful way to work is to keep a short classification note per system: the intended purpose, the Annex III area (if any), the reasoning on Article 6(3), the transparency duties that apply and the name of the person who approved the conclusion. When the system or its use changes, the note is revisited.

## Frequently asked questions

### When do the high-risk rules apply?

Following Regulation (EU) 2026/1744, from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Prohibitions and transparency duties are not postponed. See the [timeline](https://pitch.law/academy/ai-act-compliance-timeline).

### Can the Commission change the lists?

Yes. The Commission can amend Annex III by [delegated act](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R1689#art_7) and issue guidelines on classification, so the lists should be monitored.

### What if I am unsure about the class?

Make a documented assessment of intended purpose, area of use and effect on individuals. Where doubt remains, treat the system as high-risk until a lawyer has confirmed otherwise.

### Does the class depend on the model or on the use?

On the use. The same underlying model can be minimal-risk in one application and high-risk in another.

## How this connects

[Our AI Act register](https://pitch.law/technologies/ai-act-governance-toolkit) records each classification together with the articles it relies on, and our [AI Act compliance](https://pitch.law/solutions/ai-act-compliance) service has an attorney confirm it. Once a system is high-risk, the next question is your role, covered in [provider or deployer](https://pitch.law/academy/provider-vs-deployer-ai-act).

## In short

- Classification depends on use, not on the technology
- Eight high-risk areas in Annex III
- Exemption in Article 6(3) needs a documented assessment
- Transparency duties can apply on top

## Related solutions

- [Solutions](https://pitch.law/solutions/ai-act-compliance)
  ### [AI Act Compliance](https://pitch.law/solutions/ai-act-compliance)
  [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://pitch.law/solutions/ai-act-compliance)

## Technology we use

- [Technology](https://pitch.law/technologies/ai-act-governance-toolkit)
  ### [AI Act Register and Assessments](https://pitch.law/technologies/ai-act-governance-toolkit)
  [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://pitch.law/technologies/ai-act-governance-toolkit)
- [Technology](https://pitch.law/technologies/digital-data-protection-impact-assessment)
  ### [Data Protection Impact Assessment](https://pitch.law/technologies/digital-data-protection-impact-assessment)
  [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://pitch.law/technologies/digital-data-protection-impact-assessment)
- [Technology](https://pitch.law/technologies/privacy-register)
  ### [Records of Processing and Compliance Registers](https://pitch.law/technologies/privacy-register)
  [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://pitch.law/technologies/privacy-register)

## More in Legal Aspects of Artificial Intelligence

- ### [EU AI Act Timeline: Every Date from 2024 to 2030](https://pitch.law/academy/ai-act-compliance-timeline)
  [The AI Act applies in stages from 2 February 2025 to 31 December 2030. Every date, what applies and who it affects, with the 2026 high-risk postponement.](https://pitch.law/academy/ai-act-compliance-timeline)
- ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap)
  [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap)
- ### [AI Clauses in Vendor Contracts: 9 Terms to Negotiate](https://pitch.law/academy/ai-clauses-in-vendor-contracts)
  [The AI clauses to negotiate when you buy or supply AI: AI Act roles, training on your data, output ownership, IP indemnity, audit and logs, liability.](https://pitch.law/academy/ai-clauses-in-vendor-contracts)
- ### [AI Act in HR and Recruitment: the High-Risk Rules](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act)
  [Recruitment and HR AI is usually high-risk under the AI Act (from 2 December 2027), and emotion recognition at work is banned. What employers must do.](https://pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act)
- ### [AI and Intellectual Property: Training Data and Copyright](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure)
  [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure)
- ### [The AI Literacy Obligation](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking)
  [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://pitch.law/academy/ai-literacy-obligation-businesses-overlooking)

## Let’s talk

Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free.

[Schedule a meeting](https://pitch.law/schedule)