EU AI Act risk classification: how the four outcomes work
The EU AI Act does not treat every AI system the same way. Some uses are banned outright — Article 5 bans the practice, not the technology. Some systems are called high-risk and carry the longest list of duties (Article 6). Some have to tell people they are dealing with AI (Article 50), and a system can carry that duty and be high-risk at the same time. Everything else falls outside all three, and the Regulation never gives that group a name. It runs per system, on intended purpose — not on the model, the codebase or the vendor's category. Complipath's classifier runs that sequence as 7 questions and returns the article behind every answer, so the classification is checkable instead of asserted. Run it on your own system — no account; the classification runs in your browser, and your answers leave it only if you choose to keep the result in an account.
Written 12 August 2026 against Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, in our pinned source corpus.
What are the EU AI Act risk categories?
The Regulation does not hand out labels; it builds gates, and the outcome is where your system stops.
- Prohibited. Article 5(1) opens "The following AI practices shall be prohibited:" — ten practices after the 2026 amendment, eight applying since 2 February 2025 and the two newest, points (ba) and (bb), from 2 December 2026 (Article 113, third paragraph, point (a), as replaced by Regulation (EU) 2026/1744). The full list per letter is in the prohibited practices guide.
- High-risk. Two routes under Article 6: a safety-component route tied to the Annex I product legislation (Article 6(1)), and the use-case route — Article 6(2): "In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk." Every Annex III point and letter is a named use case.
- Transparency-obligated. Article 50(1): providers must ensure systems "intended to interact directly with natural persons" are designed so those persons are informed — with siblings for emotion recognition, biometric categorisation and generated content. The tier's duties apply since 2 August 2026 — except that systems generating synthetic content and placed on the market before that date have until 2 December 2026 for 50(2) (Article 111(4)) — and are covered in the limited-risk guide.
- The residual. "Minimal risk" appears nowhere in the Regulation — the residual is the conclusion left when every gate answers no, and what it still owes you is not nothing.
The outcomes carry different dates: the prohibitions are live now, Article 50 since 2 August 2026 — with 2 December 2026 for 50(2) where a synthetic-content system was on the market before that date (Article 111(4)) — and the high-risk requirements apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as amended).
How does high-risk classification work under Article 6?
The use-case route is a list question, then an exemption question. Annex III names the use cases — employment, credit, education, essential services, biometrics, law enforcement among them — and Article 6(2) classifies whatever they name. The exemption, Article 6(3), takes a listed system back out where it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making" — on four named conditions, with one override: an Annex III system that performs profiling of natural persons is always high-risk. Claiming the exemption is not free: Article 6(4) requires a documented assessment and registration, challengeable by an authority.
The product route is narrower than it looks. Article 6(1) requires both conditions at once: the system is a product, or a safety component of one, covered by the Annex I product legislation, and that legislation requires third-party conformity assessment. The 2026 amendment narrowed both limbs — Article 6(1a) puts purely non-safety assistance and convenience functions outside "safety component", Article 6(1b) pulls back in systems whose failure "would endanger health and safety", and Article 6(1c) fails the second condition where third-party assessment is required solely for risks other than health and safety. The decision tree runs both limbs in order.
Classification also never decides who owes the resulting duties. The same high-risk verdict lands the Article 16 obligations on the provider and the Article 26 obligations on the deployer — which one you are is its own question, and it can change: modify a system's intended purpose and you can become the provider. And it attaches to systems, not models: high-risk classification runs by use case under Article 6(2) and Annex III, not on the model underneath — a system built on a general-purpose model is classified by what it is for, while the model carries its own Chapter V duties.
What the whole classification turns on is intended purpose — Article 3, point (12): "the use for which an AI system is intended by the provider, including the specific context and conditions of use", as specified in the information the provider supplies: the instructions for use, promotional or sales materials and statements, and the technical documentation. That is why one codebase can be two systems, and why the classification is run per system, in a fixed five-step order.
What does a defensible risk classification record?
Which systems you hold, what each concluded, and on what basis — the provision that fired, the answers it fired on, and who confirmed them. A score without an article is an opinion with a number on it. Two details separate a record that survives review from one that does not: negatives are recorded too — a decision that a system is not high-risk is still a classification decision — and the record carries its dates, because the law has already changed once and a classification without a date cannot say which law it answered.
Run the classification — real engine output
The block below is not a mock-up. It is rendered from a real run of the Complipath engine, fetched from the live API at every build — the same payload, character for character, that the published example assessment shows in full, with the engine version and the parts the run left undetermined printed rather than trimmed.
The engine is deterministic: fixed rules over your confirmed answers, every verdict traceable to the article it rests on — and where it stops is published, not discovered: what this check can and cannot decide lists both sides, written once by a person, never generated per visitor.
Which outcome does your system land in?
Classify your system now — 7 questions on the main line, plus follow-ups where they apply, no account, and the classification runs in your browser: answers stay there unless you choose to keep the result.
FAQ
How many risk levels does the EU AI Act have? The Regulation names none as levels. It prohibits ten practices (Article 5), classifies listed use cases as high-risk (Article 6 with Annex III), attaches transparency duties to certain systems (Article 50), and leaves a residual it never labels — "minimal risk" appears nowhere in its text.
Is my AI system high-risk? It depends on intended purpose, not technology. If the use case appears in Annex III, Article 6(2) classifies it high-risk unless the Article 6(3) exemption applies — and profiling of natural persons blocks the exemption entirely. The decision tree runs the question in order.
When does risk classification become mandatory? The high-risk requirements in Chapter III, Sections 1 to 3 apply from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as amended by Regulation (EU) 2026/1744). The prohibitions and Article 50 duties are already live — so classification is how you find out whether those nearer duties reach you.
What makes a classification tool trustworthy? Citations and stated limits. Every verdict should carry the provision it rests on, and the tool should publish what it cannot decide instead of deciding it anyway. Complipath publishes a complete example run — including the undetermined parts — and the engine's coverage list, because a tool that will not say where it stops should not be trusted with a classification.
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Articles 3, 5, 6, 50 and 113, and Annexes I and III, as amended by Regulation (EU) 2026/1744 (EUR-Lex) — the corpus this page's every quotation is verified against on every build. Engine output on this page is fetched from the live API at build time; its provenance and holds are printed by the build, never assumed.