The entire structure of the law rests on one simple idea: Not all artificial intelligence is equally dangerous.

The law sorts every AI system into four different risk categories. Your compliance obligations depend entirely on which bucket your AI falls into. Here is how these four levels work:

Unacceptable Risk: AI systems in this category are strictly prohibited and cannot be used in the European Union under any circumstances. This category includes systems that perform real-time facial recognition (biometric identification) in public spaces, social scoring applications that classify citizens based on their social behavior (e.g., China’s social credit model), and AI systems that exploit psychological vulnerabilities to manipulate people’s decisions. Additionally, applications aimed at recognizing the emotions of employees in the workplace or students in educational institutions fall under this absolute ban. The strict prohibitions on these systems, which directly threaten fundamental rights and safety, officially took effect as of February 2025.

High Risk: AI systems in this category are permitted but subject to strict controls. Systems with the potential to pose serious risks to health, safety, or fundamental rights fall into this category. For example, CV screening software in HR processes, credit approval/rejection scoring by banks, product safety components like robotic surgery, and critical infrastructure management (e.g., transportation) fall directly into this scope. The use of these systems is allowed, but you must use high-quality datasets to prevent discrimination, conduct risk assessments, keep logs, and establish a robust human oversight mechanism. For most high-risk systems, these rules will fully enter into force in August 2026, and in August 2027 for certain specific systems already subject to product safety legislation.

• Transparency and Limited Risk: AI systems in this category require “transparency and disclosure”. Designed to preserve human trust in AI usage, this category mandates that users must clearly know they are interacting with a machine, not a human. If your company uses chatbots in customer service or creates content with generative AI (GenAI), your primary obligation here is not to prepare complex technical documentation, but rather a direct process of disclosure and informing. Institutions providing generative AI must ensure that all generated content is identifiable as being in an AI format. Especially if you publish texts intended to inform the public or produce manipulated audio and video content such as deepfakes, you must label these outputs clearly and visibly. These transparency and labeling rules, which guarantee users make informed decisions, will fully enter into force as of August 2026.

• Minimal Risk: There are no mandatory rules for AI systems in this category. The vast majority of AI systems currently used in the European Union fall into this category, and the Regulation does not impose any binding rules or additional obligations on these systems. Most everyday consumer-facing tools, such as spam filters, AI-enabled video games, and music recommendation algorithms, are in this group. Although it is not mandatory to prepare a formal legal compliance program for companies using such systems, compromising on high quality and transparency standards is never a winning approach.