Key Takeaways: EU AI Act Risk Classification
The EU AI Act (Regulation 2024/1689) establishes the world's first comprehensive, legally binding framework for artificial intelligence. Its risk-based classification system assigns every AI system to one of four tiers: unacceptable, high, limited, or minimal risk, based on intended purpose and deployment context. Penalties reach up to €35 million or 7% of global annual turnover. Enforcement began in February 2025 for prohibited practices, with high-risk obligations phasing in through August 2027. Compliance teams must inventory all AI systems, classify each by use case, and implement tier-specific controls.
What is the EU AI Act?
The EU AI Act (formally Regulation (EU) 2024/1689) is the European Union's horizontal regulation laying down harmonised rules on artificial intelligence. It was published in the Official Journal of the European Union on 12 July 2024 and entered into force on 1 August 2024. The regulation adopts a risk-based approach, imposing obligations proportionate to the level of risk an AI system poses to health, safety, and fundamental rights. Source: EUR-Lex, Regulation (EU) 2024/1689
What is risk-based classification in AI regulation?
Risk-based classification is a regulatory methodology that assigns compliance obligations based on the potential harm an AI system may cause, rather than regulating the technology itself. The EU AI Act defines four tiers: unacceptable risk (Article 5, prohibited), high risk (Articles 6 to 51, heavily regulated), limited risk (Article 50, transparency obligations), and minimal risk (no specific requirements). This approach mirrors established product-safety frameworks in EU law. Source: EUR-Lex, Regulation (EU) 2024/1689
What is a conformity assessment under the EU AI Act?
A conformity assessment is the process by which a provider of a high-risk AI system demonstrates that the system meets the requirements set out in Chapter III, Section 2 of the EU AI Act. Depending on the system category, this may be a self-assessment or require involvement of a notified body. The assessment covers risk management, data governance, technical documentation, accuracy, robustness, and cybersecurity. Source: EUR-Lex, Regulation (EU) 2024/1689, Articles 40 to 43
What is a general-purpose AI (GPAI) model?
A general-purpose AI model is an AI model (including large generative models) trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks. GPAI providers face transparency obligations from August 2025, and models posing systemic risk face additional requirements including adversarial testing and incident reporting. Source: EUR-Lex, Regulation (EU) 2024/1689, Articles 51 to 56
Statistics and Market Context
According to the EU AI Act final text (Recital 1), the regulation aims to ensure AI systems placed on the Union market are safe and respect fundamental rights. The penalty framework in Article 99 establishes three fine tiers: up to €35 million or 7% of global turnover for prohibited practices, up to €15 million or 3% for high-risk non-compliance, and up to €7.5 million or 1% for supplying incorrect information. According to a 2024 IAPP survey, fewer than 25% of organizations had begun formal AI inventorying by mid-2024 (IAPP). A 2024 McKinsey Global Survey found that 72% of organizations had adopted AI in at least one business function, up from 55% in 2023 (McKinsey, The State of AI 2024). The European Commission's impact assessment estimated that approximately 15% of AI systems deployed in the EU would fall under the high-risk category.
Frequently Asked Questions
What are the four risk tiers under the EU AI Act?
The EU AI Act classifies AI systems into four tiers: Unacceptable Risk (prohibited outright under Article 5), High Risk (permitted but heavily regulated under Articles 6 to 51, requiring conformity assessments, risk management systems, and human oversight), Limited Risk (subject to transparency obligations under Article 50, such as disclosing AI-generated content), and Minimal Risk (no specific regulatory requirements). Classification depends on the intended purpose and deployment context, not the underlying technology. Source: EUR-Lex, Regulation (EU) 2024/1689
What are the maximum fines under the EU AI Act?
The EU AI Act establishes a three-tier penalty framework under Article 99. Deploying a prohibited AI system carries fines of up to €35 million or 7% of annual global turnover, whichever is higher. Non-compliance with high-risk obligations triggers fines of up to €15 million or 3%. Supplying incorrect information to notified bodies or national authorities can result in fines of up to €7.5 million or 1%. For SMEs and startups, fines are capped at the lower of the two amounts. Source: EUR-Lex, Regulation (EU) 2024/1689, Article 99
When do EU AI Act enforcement deadlines begin?
Enforcement is phased over a 36-month period from entry into force (1 August 2024): February 2, 2025: prohibited AI practices (Article 5) become enforceable. August 2, 2025: obligations for general-purpose AI model providers apply. August 2, 2026: high-risk obligations for Annex III systems (standalone high-risk AI). August 2, 2027: high-risk obligations for Annex I systems (AI embedded in regulated products). Source: EUR-Lex, Regulation (EU) 2024/1689, Article 113
Is emotion recognition in the workplace banned under the EU AI Act?
Yes. Under Article 5(1)(f) of the EU AI Act, emotion recognition systems deployed in workplace and educational settings are classified as unacceptable risk and are prohibited, except when used for medical or safety purposes. This prohibition has been enforceable since February 2, 2025. Organizations should audit existing HR technology, video interview platforms, and employee engagement analytics tools for embedded emotion detection features, which vendors may have marketed as "sentiment analysis" or "engagement scoring." Source: EUR-Lex, Regulation (EU) 2024/1689, Article 5
How does the EU AI Act classify the same AI model used in different contexts?
Classification under the EU AI Act is use-case dependent, not technology-dependent. The same large language model could be classified as limited risk when deployed as a customer service chatbot (requiring only transparency disclosures under Article 50) but as high risk when used for employee performance evaluation or creditworthiness assessment (requiring full conformity assessments under Articles 6 to 43). This means organizations cannot classify their AI inventory once: every new deployment context requires a fresh risk assessment. Source: EUR-Lex, Regulation (EU) 2024/1689, Article 6
What compliance obligations apply to high-risk AI systems?
Providers of high-risk AI systems must implement: a risk management system (Article 9), data governance measures (Article 10), technical documentation (Article 11), record-keeping and automatic logging (Article 12), transparency and information provision to deployers (Article 13), human oversight measures (Article 14), and standards for accuracy, robustness, and cybersecurity (Article 15). They must also conduct a conformity assessment (Articles 40 to 43), register the system in the EU database (Article 49), establish a quality management system (Article 17), and implement post-market monitoring (Article 72). Source: EUR-Lex, Regulation (EU) 2024/1689, Chapter III
EU AI Act Risk Tier Comparison
| Risk Tier | EU AI Act Articles | Key Obligations | Maximum Penalty | Enforcement Date |
|---|
| Unacceptable | Article 5 | Outright prohibition; must cease deployment | €35M or 7% turnover | February 2, 2025 |
| High | Articles 6 to 51 | Conformity assessment, risk management, human oversight, technical documentation, EU database registration | €15M or 3% turnover | August 2, 2026 / August 2, 2027 |
| Limited | Article 50 | Transparency disclosures (e.g., inform users they are interacting with AI, label AI-generated content) | €15M or 3% turnover | August 2, 2026 |
| Minimal | No specific articles | No mandatory requirements; voluntary codes of conduct encouraged | N/A | N/A |
