The Five Risk Categories — Where Does Your AI Sit?

Published 26 March 2026 · 1 min read

The EU AI Act classifies every AI system into one of five risk categories. Your category determines your entire compliance workload — so getting this right is essential.

The five categories

Prohibited — banned outright, with fines up to €35M or 7% of global turnover. High-risk — significant obligations for both providers and deployers. Limited-risk — transparency and disclosure requirements. Minimal-risk — AI literacy training only. Out-of-scope — not covered by the AI Act.

High-risk is where the complexity lives

The law lists eight specific domains in Annex III — biometrics, critical infrastructure, education, employment and HR, essential services (including credit scoring, insurance, and emergency triage), law enforcement, migration and border control, and justice and democratic processes. If your AI operates in any of these areas, it is almost certainly high-risk.

A second pathway also exists: AI that serves as a safety component in regulated products like medical devices or machinery.

There is an exception — but it is narrow

Article 6(3) allows certain Annex III systems to avoid high-risk classification if they perform only a narrow procedural task, do not involve profiling, and pose no significant risk. The burden of proof is on you.

The most common mistake

Assuming your system is minimal-risk when it is actually high-risk. Internal use does not reduce risk. AI that assists human decisions (rather than replacing them) can still be high-risk. And your provider’s classification may not match your actual use case.

What’s in the full chapter

Our full chapter includes the complete Annex III breakdown, a 5-step classification flowchart, five common mistakes to avoid, and a self-check worksheet.