The 4 AI Act risk levels explained by sector (concrete examples)

Level 1 — Unacceptable risk (prohibited)

These systems have been fully prohibited since 2 February 2025. They infringe EU fundamental values and rights.

• HR: software that analyses employees' emotions via webcam during meetings (emotion recognition at work — prohibited).
• Public sector: a social scoring system for citizens based on their behaviour.
• Marketing: AI exploiting the psychological vulnerabilities of elderly people to push them to purchase.
• Security: untargeted scraping of facial images from the internet to build a recognition database.

See: emotion analysis in interviews: what is prohibited.

Level 2 — High risk (Annex III)

This is the level with the heaviest obligations. Annex III lists eight domains. The most common cases:

• HR: automated CV screening, candidate scoring, video interview analysis, performance rating.
• Finance: creditworthiness scoring, credit granting decision, risk assessment in life and health insurance.
• Health / social care: diagnostic assistance, prioritisation of access to care.
• Education: automated exam marking, learner guidance.
• Essential services: decision on access to a social benefit.

For these systems: risk management, data quality, technical documentation, logging, transparency, human oversight, robustness and cybersecurity. Applicable from 2 December 2027 (Digital Omnibus postponement), but preparation must start well before.

Level 3 — Limited risk (transparency)

These systems interact with humans or generate content. The obligation is transparency (Art. 50).

• Customer relations: a chatbot must clearly indicate that it is an AI.
• Communications: an image or text generated by AI must be labelled as such.
• Media: a deepfake must be identified as artificial content.
• Accounting: a conversational tax assistant must indicate its nature and limitations.

Details: transparency obligations (Article 50).

Level 4 — Minimal risk (no specific obligation)

The vast majority of existing AI systems fall under this level: spam filters, spell checkers, basic recommendation engines, video game AI. No specific obligations apply; a voluntary code of conduct is recommended.

Point of caution: the same tool may combine several levels depending on its functions. An HRIS may have a payroll module (minimal risk) and a candidate scoring module (high risk). It is the function that is classified, not the software as a whole.

How to classify your own systems

The method is always the same: inventory each system, identify its precise purpose, compare it to Annex III and Article 5, then document the classification decision. This system-by-system reasoning is what our AI Act module automates and our DPO experts validate. Starting point: map your AI systems in a register.