What do you actually have to do for minimal-risk AI under the EU AI Act?
Updated 9 August 2026 for Regulation (EU) 2026/1744.
Minimal-risk AI under the EU AI Act owes three things. The Article 4 AI literacy duty, binding since 2 February 2025 regardless of risk level — and rewritten in 2026 into a duty to support the development of AI literacy; voluntary codes of conduct under Article 95; and the Article 6(4) documentation and registration duties if your system escaped Annex III via the Article 6(3) derogation.
Quick answer
- "Minimal risk" appears nowhere in Regulation (EU) 2024/1689 — not even in a recital. The residual: not prohibited, not high-risk on either route, no Article 50 trigger.
- One duty survives the residual: Article 4 AI literacy binds providers and deployers of AI systems — no risk qualifier — since 2 February 2025 under Article 113, third paragraph, point (a). Regulation (EU) 2026/1744 replaced the article's text with effect from 27 July 2026; the date did not move, the standard did.
- Codes of conduct are voluntary. Article 95 lets non-high-risk systems apply Chapter III, Section 2 requirements by choice; nothing obliges you to sign one.
- "Minimal with homework": a system taken out of Annex III via Article 6(3) still carries the Article 6(4) documented assessment and Article 49(2) registration, challengeable under Article 80.
- Recording the reasoning is discipline, not law — no article obliges documenting the true residual. Record it anyway.
Does the AI Act define a "minimal risk" category?
No. A full-text sweep of the Regulation returns zero hits for "minimal risk" — not even in a recital. (Its sibling "limited risk" at least surfaces once, in a recital's "pose only limited risks".) The risk pyramid with a "minimal risk" base comes from Commission communications, not the Regulation's text.
The Act builds gates instead: the Article 5 prohibitions, the two high-risk routes under Article 6, the Article 50 transparency triggers. Minimal risk is what remains when every gate answers no — a conclusion you reach, not a label you look up. And every gate presumes the thing meets the Article 3(1) definition of an AI system: software outside the definition is not "minimal risk", it is outside the four risk tiers altogether. The sequence is in how to classify your AI system; the decision tree gets you a first answer.
What is the Article 4 AI literacy duty — and does it apply to you?
Yes, whatever your systems' tier — and it is the one duty that survives the residual, which is why it now has its own page. In outline: Article 4 carries no risk qualifier, it has bound providers and deployers since 2 February 2025 under Article 113, third paragraph, point (a). Regulation (EU) 2026/1744 then replaced it in its entirety with effect from 27 July 2026 — turning a duty to "ensure, to their best extent, a sufficient level of" AI literacy into a duty to take measures that support the development of it, with the new text saying expressly that no specific level in any individual has to be guaranteed. The date did not move; the standard did. A company whose entire inventory is residual still owes it.
Are the Article 95 codes of conduct mandatory?
No — voluntary by design. Article 95(1) tasks the AI Office and the Member States with encouraging and facilitating codes "intended to foster the voluntary application" to non-high-risk AI systems of some or all of the requirements in Chapter III, Section 2 — the high-risk requirements, applied by choice. Article 95(2) extends the mechanism to all AI systems, listing elements from environmental sustainability to inclusive design — notably including promoting AI literacy, looping back to Article 4.
Who writes them? Under Article 95(3), individual providers or deployers, organisations representing them, or both; Article 95(4), amended in 2026, requires the specific interests and needs of "SMEs, including start-ups, and SMCs" to be taken into account. Whether usable codes exist for your sector today is not answerable from the Regulation alone — ask your industry association before building your own.
When is "minimal risk" really minimal-with-homework?
When you got there through the derogation. A system matching an Annex III use case but posing no "significant risk of harm" under one of the four Article 6(3) conditions is not high-risk — unless it performs profiling of natural persons, which is always high-risk — but not obligation-free. Article 6(4) requires the provider to document the assessment before the system is placed on the market or put into service, to register under Article 49(2) in the EU database referred to in Article 71, and to produce the documentation on request.
That paper trail has teeth: under Article 80, a market surveillance authority that considers the system high-risk can re-evaluate the classification against the Article 6(3) conditions and require full compliance. There are two ways of being "minimal": the true residual, which never touched Annex III, and the derogated system, with two duties and a standing audit risk.
One timing point, changed in 2026: Article 6 sits in Chapter III, Section 1, and Regulation (EU) 2026/1744 moved Sections 1, 2 and 3 of that chapter to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems (Article 113, third paragraph, point (c), as amended). So the Article 6(3) route and the Article 6(4) duties that hang off it are not live today — they bite on 2 December 2027 for an Annex III-listed use case. Article 49 was not moved; it sits in Chapter III, Section 5, which the amendment left on the general date. Whether a registration duty can be discharged before the classification rule it depends on applies is not something the Regulation's text answers, and no guidance settling it is in our source corpus as of 12 August 2026 — verify before relying; build to 2 December 2027 and keep the assessment dated.
One more boundary: a system that talks to people, generates content or infers emotions is not residual — Article 50 attaches, putting it in the limited-risk transparency tier. Minimal risk means every gate answered no, including that one.
Do you have to record why a system is minimal risk?
For the true residual: no — no article of the Regulation obliges it. Record it anyway, as evidence discipline: the classification exists only as a conclusion you reached, and the first thing a procurement review, auditor or authority asks is how. A useful record is short — the system, the provisions checked (Article 5, Article 6(1), Article 6(2) with the Annex III point examined, Article 50), why each came out negative, the date, the signatory. The Article 6(3) case is the exception where documentation stops being discipline and becomes the Article 6(4) legal duty.
What this means for you
If you're a provider: Minimal risk is only claimable per system, after the gates. Then cover the one live duty: Article 4 measures for the staff who build and operate your systems, owed since 2 February 2025 — and re-read what you promised internally, because the duty is now to support development, not to guarantee a level. If any classification rests on Article 6(3), write the Article 6(4) assessment now and date it, even though that duty does not bite until 2 December 2027. Complipath's guided risk classification records each system's risk level with the provisions and reasoning attached, so the negative conclusion is an artefact, not a memory.
If you're a deployer: Article 4 binds you directly — the one duty every deployer of any AI system carries, including for tools you subscribe to and use. When a vendor says "minimal risk", ask which kind: the residual, or an Article 6(3) derogation — if the latter, ask for the Article 6(4) assessment. Check your own uses against Article 50 too; deployer-side transparency duties attach to how you use a system, not the vendor's classification.
Is yours actually the residual?
Classify your system now — 7 questions on the main line, plus follow-ups where they apply, no account, and the classification runs in your browser: answers stay there unless you choose to keep the result.
FAQ
Is "minimal risk" an official EU AI Act category? No. The phrase appears nowhere in Regulation (EU) 2024/1689 — the operative text builds gates (Articles 5, 6 and 50), not a bottom tier. "Minimal risk" is shorthand from Commission communications for systems that pass every gate: a conclusion you document, not a status the law assigns.
Does the AI literacy duty apply to minimal-risk AI? Yes. Article 4 binds providers and deployers of AI systems without any risk qualifier, so it applies even when every system in your inventory is residual. It has applied since 2 February 2025 under Article 113, third paragraph, point (a) — earlier than the high-risk and transparency obligations.
Are the Article 95 codes of conduct mandatory? No. Article 95 codes exist for "voluntary application" — non-high-risk systems can adopt Chapter III, Section 2 requirements by choice, in codes drawn up by providers, deployers or their representative organisations. Not signing one breaches nothing; signing one is a credibility signal, not a legal shield.
Our system escaped Annex III under Article 6(3) — is it obligation-free? No. Article 6(4) requires the assessment to be documented before market placement, Article 49(2) requires registration in the EU database, and authorities can demand the documentation. Under Article 80, market surveillance can re-evaluate the classification and pull the system into full high-risk compliance if it disagrees.
Sources: Regulation (EU) 2024/1689 (EUR-Lex), Articles 3, 4, 6, 49, 80, 95, 99 and 113, as amended by Regulation (EU) 2026/1744 (EUR-Lex), Article 1, points (5), (35), (38) and (40). Article 95(1) to (3) were not amended; Article 95(4) was, to add SMCs. Three things are outside our source corpus as of 12 August 2026, and this guide does not report them: whether sector codes of conduct under Article 95 exist; how individual Member States penalise Article 4 non-compliance under their national rules pursuant to Article 99(1); and any guidance on how the delay of Chapter III, Sections 1 to 3 to 2 December 2027 interacts with Article 49, which sits in Section 5 and was not delayed — the texts themselves do not resolve it. Verify before relying.