The EU AI Act (Regulation (EU) 2024/1689) is risk-based. Every AI system falls into one of four tiers, and your obligations follow from the tier. Here is how to place yours.
The four risk tiers
- Unacceptable risk (prohibited). Social scoring, manipulative or exploitative AI, untargeted scraping of facial images, and most real-time remote biometric identification in public spaces. These have been banned since 2 February 2025.
- High-risk. AI used in the Annex III areas: biometrics, critical infrastructure, education, employment and HR, access to essential services, law enforcement, migration, and justice, plus AI that is a safety component of a regulated product. This tier carries the heaviest duties: risk management, data governance, technical documentation, logging, human oversight, and conformity assessment. Most obligations apply from 2 August 2026.
- Limited risk (transparency). Chatbots, deepfakes and AI-generated content, and emotion-recognition systems must disclose that the user is interacting with AI or that content is AI-generated (Art. 50).
- Minimal risk. Spam filters, recommendation engines, most business software. No specific obligations.
General-purpose AI (GPAI) is separate
Foundation and general-purpose models have their own regime, with obligations from 2 August 2025. Models with systemic risk (training compute above 10^25 FLOPs) carry additional duties.
The duty almost everyone forgets: AI literacy
Under Art. 4, since 2 February 2025, providers and deployers must ensure their staff have a sufficient level of AI literacy. This applies even if your systems are only minimal or limited risk.
The fines
- Prohibited practices: up to EUR 35M or 7% of global turnover
- Most other obligations (including high-risk): up to EUR 15M or 3%
- Supplying incorrect information to authorities: up to EUR 7.5M or 1.5%
Classify your system in two minutes
-> Run the free AI Act Risk Classifier - answer a short wizard and get your tier plus the obligations that apply.
Source
Regulation (EU) 2024/1689 (AI Act)
Last verified: 21 June 2026.