PricingLog in

The AI Act’s four risk levels.

Reviewed

Short answer

The AI Act sorts AI systems into four levels of risk: unacceptable risk (banned practices, Article 5), high risk (strict obligations, Article 6 and Annex III), transparency risk (disclosure and marking duties, Article 50) and minimal or no risk (no new rules). General-purpose AI models are regulated separately on top, with extra duties for models with systemic risk.

Official source: European Commission: AI Act, risk-based approach

The four levels

AI Act risk levels
LevelExamplesWhat it meansFromGuide
UnacceptableSocial scoring; untargeted scraping of faces; emotion recognition at work or in schools; predicting crime from profiling aloneBanned2 February 2025 (two more bans 2 December 2026)Article 5
HighRecruitment and HR tools, credit scoring, life and health insurance pricing, exam scoring, AI safety components of regulated productsRisk management, data governance, documentation, human oversight, conformity assessment, registration2 December 2027 (Annex III); 2 August 2028 (Annex I)High-risk AI
TransparencyChatbots and voice agents, AI image or text generators, deepfakes, emotion recognition and biometric categorisationTell people, mark outputs, label deepfakes and certain text2 August 2026Article 50
Minimal or no riskAI in video games, spam filtersNo new rules under the AI Act——

The Commission says the vast majority of AI systems used in the EU fall into the minimal-risk category. The levels can overlap: the transparency duties of Article 50 apply in addition to the high-risk requirements, not instead of them (Article 50(6)), and AI literacy (Article 4) applies to providers and deployers of all AI systems.

Where general-purpose AI models fit

A general-purpose AI model, such as a large language model, is not itself one of the four levels: Articles 53 to 55 give its provider separate duties (documentation, copyright policy, a training-data summary), with more for models with systemic risk. An AI system built on such a model is then classified like any other system, by what it does. See general-purpose AI obligations.

How to place a system

  1. Is it a practice listed in Article 5? Then it is banned (with the narrow exceptions written there).
  2. Is it a safety component of a product, or a product, under the laws in Annex I that requires a third-party conformity assessment? Then it is high-risk under Article 6(1).
  3. Is it used for a purpose listed in Annex III? Then it is high-risk under Article 6(2), unless one of the four conditions of Article 6(3) applies, for example a narrow procedural task; a system that profiles people always stays high-risk.
  4. Does it interact with people, generate content, or recognise emotions or categorise people biometrically? Then the transparency duties of Article 50 apply.
  5. None of these? Minimal risk: no specific obligations, though AI literacy still applies.

A provider who decides that an Annex III system is not high-risk under Article 6(3) must document that assessment before placing the system on the market and register it in the EU database (Article 6(4)).

Questions

Is a chatbot high-risk?
Usually not: a chatbot is in the transparency level, so its provider must tell people they are interacting with an AI (Article 50(1)). It becomes high-risk if it is used for a purpose listed in Annex III, for example to evaluate job candidates or to decide on access to essential public benefits.
What is limited risk?
It is the common name for the transparency level. The Commission’s own overview calls it “transparency risk”: AI systems whose risks are addressed by disclosure and marking duties under Article 50.

Sources

Last reviewed by Volkan Çatak, Founder, Proofcan.

Not legal advice. This page explains official texts in plain words and links each one; check the sources, or a lawyer, before relying on it for a decision.