--- title: "AI Act Risk Classification | Pitch" description: "How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act." url: https://www.pitch.law/academy/ai-act-risk-classification-explained --- [pitch](https://www.pitch.law/) [Academy](https://www.pitch.law/academy) [Legal Aspects of Artificial Intelligence](https://www.pitch.law/academy/topics/legal-aspects-of-artificial-intelligence) # AI Act Risk Classification How to tell whether an AI system is prohibited, high-risk, subject to transparency duties or free of specific obligations under the AI Act. - By By Bart Lieben, Attorney-at-Law - Published 25 February 2026 ## The legal framework The AI Act (Regulation (EU) 2024/1689) attaches obligations to the risk class of a system. Classification is therefore the first legal question, and the answer depends on the intended purpose of the system and the context in which it is used, not on the technology as such. ### Prohibited practices Article 5 prohibits, among others, manipulative or exploitative techniques that cause significant harm, social scoring, untargeted scraping of facial images, emotion recognition in the workplace and education (except for medical or safety reasons) and certain uses of biometric identification. Regulation (EU) 2026/1744 adds two prohibitions on AI systems that generate non-consensual intimate imagery or child sexual abuse material; they apply from 2 December 2026. ### High-risk systems Article 6 gives two routes. First, an AI system that is a safety component of a product, or is itself a product, covered by the EU harmonisation legislation listed in Annex I (machinery, medical devices, toys and others) and that requires third-party conformity assessment. Second, a system listed in Annex III, which covers eight areas: - biometrics; - critical infrastructure; - education and vocational training; - employment and worker management; - access to essential private and public services, including credit scoring and life and health insurance pricing; - law enforcement; - migration, asylum and border control; - administration of justice and democratic processes. An Annex III system is not high-risk if, under Article 6(3), it does not pose a significant risk of harm to health, safety or fundamental rights, for example because it only performs a narrow procedural task, improves the result of a previously completed human activity, detects deviations from earlier decision patterns, or performs a preparatory task. A system that performs profiling of natural persons is always high-risk. A provider that relies on the exemption must document its assessment before placing the system on the market and register the system. ### Transparency duties Article 50 requires that people are told when they interact with an AI system, that synthetic audio, image, video or text is marked as artificially generated, that deployers of emotion recognition or biometric categorisation inform the persons exposed, and that deepfakes are disclosed. These duties can apply to a system on top of any other class. ### The remainder Systems that fall in none of these categories, such as spam filters or AI in video games, carry no specific obligations, but Article 4 on AI literacy still applies. ## In practice A bank uses an AI model to assess consumer credit applications. Creditworthiness assessment of natural persons is listed in Annex III, point 5, and the model builds a profile of the applicant, so the Article 6(3) exemption is not available. The system is high-risk. The same bank deploys a chatbot for general questions. It is not in Annex III, so it is not high-risk, but Article 50 requires that customers are told they are talking to an AI system. A logistics company uses an AI tool that sorts incoming invoices into folders. The tool performs a purely preparatory task with no decision about individuals, and in any case it is not in an Annex III area. It carries no specific obligations other than AI literacy. A recruitment agency uses software that scores CVs. This falls under employment in Annex III and involves profiling, so it is high-risk. See [AI in HR and recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act). Each conclusion should be written down with the reasoning. Where a high-risk system processes personal data, a [data protection impact assessment](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) is often required as well. A useful way to work is to keep a short classification note per system: the intended purpose, the Annex III area (if any), the reasoning on Article 6(3), the transparency duties that apply and the name of the person who approved the conclusion. When the system or its use changes, the note is revisited. ## Frequently asked questions ### When do the high-risk rules apply? Following Regulation (EU) 2026/1744, from 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I systems. Prohibitions and transparency duties are not postponed. See the [timeline](https://www.pitch.law/academy/ai-act-compliance-timeline). ### Can the Commission change the lists? Yes. The Commission can amend Annex III by delegated act and issue guidelines on classification, so the lists should be monitored. ### What if I am unsure about the class? Make a documented assessment of intended purpose, area of use and effect on individuals. Where doubt remains, treat the system as high-risk until a lawyer has confirmed otherwise. ### Does the class depend on the model or on the use? On the use. The same underlying model can be minimal-risk in one application and high-risk in another. ## How this connects [Our AI Act register](https://www.pitch.law/technologies/ai-act-governance-toolkit) records each classification together with the articles it relies on, and our [AI Act compliance](https://www.pitch.law/solutions/ai-act-compliance) service has an attorney confirm it. Once a system is high-risk, the next question is your role, covered in [provider or deployer](https://www.pitch.law/academy/provider-vs-deployer-ai-act). ## In short - Classification depends on use, not on the technology - Eight high-risk areas in Annex III - Exemption in Article 6(3) needs a documented assessment - Transparency duties can apply on top ## Related solutions - [Solutions](https://www.pitch.law/solutions/ai-act-compliance) ### [AI Act Compliance](https://www.pitch.law/solutions/ai-act-compliance) [We help you find out which of your AI systems fall under the EU AI Act, in what role, and what you must have in place and by when.](https://www.pitch.law/solutions/ai-act-compliance) ## Technology we use - [Technology](https://www.pitch.law/technologies/ai-act-governance-toolkit) ### [AI Act Register and Assessments](https://www.pitch.law/technologies/ai-act-governance-toolkit) [One register where your AI systems are listed, classified and followed per role, with assessments, incident records and an AI Act timeline, all checked by an attorney.](https://www.pitch.law/technologies/ai-act-governance-toolkit) - [Technology](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) ### [DPIA](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) [Guided data protection impact assessments, kept as working records that you and your attorney complete together in the client portal.](https://www.pitch.law/technologies/digital-data-protection-impact-assessment) - [Technology](https://www.pitch.law/technologies/privacy-register) ### [Records of Processing and Compliance Registers](https://www.pitch.law/technologies/privacy-register) [One register engine for the GDPR record of processing activities and for the AI Act, NIS2 and DORA registers, with article references, evidence and attorney or DPO approval.](https://www.pitch.law/technologies/privacy-register) ## More in Legal Aspects of Artificial Intelligence - ### [AI Act Timeline: What Applies When](https://www.pitch.law/academy/ai-act-compliance-timeline) [The application dates of the AI Act as of October 2026, including the postponement of the high-risk rules adopted in 2026.](https://www.pitch.law/academy/ai-act-compliance-timeline) - ### [AI Act Meets GDPR: Where the Two Frameworks Overlap](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) [How the AI Act and the GDPR apply side by side to the same AI system: roles, impact assessments, automated decisions, transparency, data quality and special categories.](https://www.pitch.law/academy/ai-act-meets-gdpr-where-frameworks-overlap) - ### [AI Clauses in Vendor Contracts](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) [Which clauses to expect and negotiate when you buy or supply AI: AI Act allocation, data use, output ownership, IP indemnity, liability and change control.](https://www.pitch.law/academy/ai-clauses-in-vendor-contracts) - ### [AI in HR and Recruitment](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) [Which AI tools in recruitment and people management are prohibited or high-risk under the AI Act, what employers must do, and how national labour law and the GDPR add to it.](https://www.pitch.law/academy/ai-in-hr-and-recruitment-under-the-ai-act) - ### [AI and Intellectual Property: Training Data, Copyright and Disclosure](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) [How EU copyright law and the AI Act treat training data, rights holders' opt-outs, training summaries, and the protection of AI-generated output and inventions.](https://www.pitch.law/academy/ai-intellectual-property-training-data-copyright-disclosure) - ### [The AI Literacy Obligation](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) [Article 4 of the AI Act has applied since February 2025 to every company using AI. What it requires, how the 2026 amendment changed it and what to document.](https://www.pitch.law/academy/ai-literacy-obligation-businesses-overlooking) ## Let’s talk Tell us what you’re working on. We’ll get the right person on it and reply within one business day. The first chat is free. [Schedule a meeting](https://www.pitch.law/schedule)