What are the four risk tiers in the EU AI Act?

The Act uses a risk-based pyramid: prohibited practices that are banned outright, high-risk systems with strict obligations, limited-risk systems with transparency duties only, and minimal-risk systems with no specific obligations. Most everyday AI falls into the minimal-risk tier.

What makes an AI system high-risk?

A system is high-risk if it is a safety component of a regulated product, or if it falls under one of the Annex III use cases — such as biometric identification, critical infrastructure, education, employment, essential services, law enforcement, migration, or administration of justice — and poses a significant risk to health, safety, or fundamental rights.

What are prohibited AI practices?

Article 5 bans practices including untargeted facial-recognition scraping, social scoring by public authorities, manipulative subliminal techniques that cause harm, exploitation of vulnerabilities, certain emotion recognition at work and school, and most real-time remote biometric identification in public spaces by law enforcement.

Does this tool give legal advice?

No. It implements the public decision logic of the Act as an educational triage aid. The real classification depends on detailed facts, the final text of the Regulation, delegated acts, and guidance. Always confirm with qualified legal counsel before relying on any tier.

What about general-purpose AI models?

General-purpose AI (GPAI) models have their own dedicated rules, including transparency and documentation duties, with stricter obligations for models presenting systemic risk. This tool flags GPAI separately because the GPAI regime layers on top of the four use-case risk tiers.

What is the EU AI Act Risk Classifier?

Answer a decision-tree questionnaire about your AI system's purpose, deployment context, and affected people to determine whether it is prohibited, high-risk, limited-risk, or minimal-risk under the EU AI Act. Built for AI developers, legal teams, and compliance officers preparing for enforcement. It runs free in your browser on Gera Tools, with nothing uploaded.

EU AI Act Risk Classifier

Name: EU AI Act Risk Classifier
Creator: Gera Tools
License: https://creativecommons.org/licenses/by/4.0/

Get one useful tool a week

Like this tool? Enter your email and we'll send you one genuinely useful Gera tool a week — plus a link to come back to this one. No spam, one-click unsubscribe any time.

The EU AI Act regulates artificial intelligence using a risk-based pyramid. The obligations that apply to your system — and the penalties for getting them wrong — depend entirely on which tier it lands in. This classifier walks the public decision logic of the Act to triage your system into prohibited, high-risk, limited-risk, or minimal-risk.

Why the classification matters

The EU AI Act is the world’s first comprehensive legal framework for AI. It entered into force in August 2024 and applies in phases: prohibitions from February 2025, GPAI and governance rules from August 2025, and high-risk obligations from August 2026. Getting the tier wrong is not academic — penalties can reach EUR 35 million or 7% of global turnover for prohibited practices, EUR 15 million or 3% for other violations.

Even a “minimal-risk” determination is useful: it documents that you assessed the system and found no obligations, which is itself a reasonable compliance posture under a framework that will see enforcement ramp up.

How it works

The tool follows the same order of evaluation the Act uses:

1. Is it a prohibited practice (Article 5)?      → PROHIBITED, stop.
2. Is it general-purpose AI?                      → GPAI rules also apply.
3. Is it a safety component of a regulated
   product, or an Annex III use case posing
   significant risk?                              → HIGH-RISK.
4. Does it interact with people, generate
   media, or use emotion/biometric categorisation?→ LIMITED-RISK (transparency).
5. Otherwise                                       → MINIMAL-RISK.

Prohibited beats everything; high-risk beats limited-risk; limited-risk beats minimal-risk. The classifier evaluates the gates top to bottom and reports the first tier that matches, plus the GPAI flag where relevant.

What each tier means in practice

Prohibited systems cannot be placed on the EU market at all — for example, social scoring by public bodies or real-time biometric identification in public spaces by law enforcement (with narrow exceptions).

High-risk is where compliance obligations are most demanding. Annex III lists eight domains that trigger high-risk status, including biometrics, critical infrastructure, education and vocational training, employment decisions, access to essential services, law enforcement, migration management, and administration of justice. If your system is safety-relevant within any EU product safety directive, that is also a high-risk path.

Limited-risk systems carry transparency duties only. A chatbot must tell users it is AI. Deepfake or AI-generated content must be labelled. These requirements took effect with the prohibited-practices date.

Minimal-risk — the vast majority of AI applications, such as content recommendation, spam filters, and most business analytics tools — face no mandatory obligations under the Act, though the Commission encourages voluntary codes of conduct.

Notes on general-purpose AI (GPAI)

GPT-style foundation models and other general-purpose AI have their own rules that layer on top of the use-case tiers. All GPAI providers must provide technical documentation and comply with copyright rules. Models above a certain compute threshold (currently defined as training above 10^25 FLOPs) face stricter systemic-risk obligations. The classifier flags this separately because a GPAI model may itself be minimal-risk while the application built on it is high-risk.

This tool is an educational triage; the binding classification rests on the final Regulation text and qualified legal review.