The AI Act's Risk Levels

A risk-based regulation

The European regulation on artificial intelligence, often called the AI Act, was adopted in 2024. It is a regulation: it applies directly in all Member States, without transposition. Its goal is twofold: to protect people’s health, safety, and fundamental rights, and to create a single market for AI with common rules.

Its logic is simple: the more risk a use of AI poses to people, the stronger the obligations. The regulation does not regulate “AI” as a whole, but uses. The same model can be used to sort emails (minimal risk) or to sort job applications (high risk).

Its obligations come into application in stages: the prohibitions apply first, the heaviest obligations later. Check the timeline currently in force for each obligation.

This course presents the established principles of the European regulation on artificial intelligence. It does not constitute legal advice. The regulation applies in stages and may be clarified or adjusted by supplementary texts: always check the version and timeline currently in force on official sources (European Commission, Official Journal of the European Union, national authorities) and rely on your legal department or your data protection officer.

Level 1: prohibited practices

Certain practices are deemed unacceptable and are prohibited. Among the main ones:

• social scoring of people leading to unjustified unfavorable treatment;
• manipulation techniques or exploitation of vulnerabilities (age, disability, social situation) to alter a person’s behavior to their detriment;
• emotion recognition in the workplace and in educational institutions, except for medical or safety reasons;
• building facial recognition databases through untargeted scraping of images from the Internet or from video surveillance;
• certain biometric categorizations aimed at inferring sensitive characteristics, and certain uses of real-time remote biometric identification in public spaces for law enforcement purposes, governed by strict exceptions.

Level 2: high-risk systems

A system is high risk when it can have a significant effect on people’s health, safety, or rights. Two families:

• systems that are safety components of products that are already regulated (medical devices, machinery, toys…);
• systems used in areas listed by the regulation, notably: biometrics, critical infrastructure, education (admission, assessment), employment (recruitment, CV screening, promotion or dismissal decisions, performance evaluation), access to essential services (creditworthiness assessment for a loan, certain insurance, public benefits), law enforcement, migration, justice.

These systems are not prohibited, but they are subject to strong requirements: risk management, data quality, technical documentation, logging, transparency toward users, human oversight, accuracy, and robustness. The text provides for limited exceptions for systems that, in these areas, perform only an ancillary task: they are analyzed case by case.

Level 3: transparency obligations

Some systems mainly present a risk of deception. They are subject to information obligations, for example:

• informing people that they are interacting with an AI (a chatbot), unless it is obvious;
• flagging deepfakes: images, sounds, or videos generated or manipulated that resemble real people or events;
• marking generated content in a detectable way, for providers of generative systems.

Level 4: minimal risk

The vast majority of uses (spam filters, spell checkers, reading recommendations, internal writing assistance) are subject to no specific obligation under the regulation. Other rules remain applicable (GDPR, labor law, consumer law), and good governance practices remain useful.

The regulation also provides a specific regime for general-purpose AI models (the large models on which assistants are built), which weighs mainly on their providers: documentation, a copyright compliance policy, and reinforced obligations for models presenting a systemic risk.

Provider or deployer?

Obligations depend on the organization’s role:

• the provider develops an AI system (or has it developed) and places it on the market or puts it into service under its own name;
• the deployer uses an AI system under its authority, in a professional capacity.

A company that buys CV-screening software is the deployer of a high-risk system: among other things, it must use it in accordance with its instructions for use, assign human oversight to competent people, monitor its operation, and keep the logs that are under its control. If it substantially modifies the system or markets it under its own name, it may become a provider.

Finally, providers and deployers must take measures to ensure a sufficient level of AI literacy among their staff: this is one of the reasons for this course.