AI risk classes: definition, value and limits
AI risk classes Updated
Definition
AI risk classes are the tiers with which the EU AI Act divides AI systems by their risk. The usual tiers are prohibited practices, high risk, limited risk and minimal risk. Each tier attaches different duties for documentation, oversight and transparency. The class follows from the purpose of a flow. This framing is general and not legal advice.
Why the Term Matters
The risk class decides how much effort an AI flow demands. Who knows it builds the fitting documentation and control in from the start, instead of over- or under-investing. In the mid-market a clear classification helps to size AI projects right, keep the simple case lean and take the demanding case seriously. It is the starting point of any AI compliance.
When It Is Relevant
- A flow contains an AI step that should go live.
- The effort for documentation and oversight must be sized.
- Different AI flows should be placed consistently.
- An audit asks for the risk classification.
When Not
A flow with no AI model needs no AI risk class. Purely rule-based RPA usually does not fall into the demanding tiers. If an AI step is only tested internally and processes no real data, a formal classification is not yet needed, a short note suffices until rollout.
Industries That Use It
- Medical technology: recognise high-risk AI components early as such.
- Staffing services: check AI in the application process for high risk.
- Industry: cleanly classify AI-assisted check steps by their effect.
- Finance: assign automated scoring to the correct class.
Typical Use Cases
- Record the purpose and affected people per AI flow.
- Derive the fitting risk class from the purpose.
- Adjust the documentation effort to the class.
- Recognise high-risk cases early and plan them separately.
- Record and justify the classification before rollout.
Decision Guide
| Signal | Classification is central | Alternative |
|---|---|---|
| AI affects people | check high risk | simple class unlikely |
| AI only reads receipts | limited risk | heavy duties excessive |
| No AI model | no AI class needed | RPA documentation is enough |
| Purpose unclear | clarify purpose first | no class on assumption |
Example
An industrial company plans several AI steps and records per flow what the AI does and who is affected. From this the risk class is derived, a check step lands in limited risk, a step affecting people is classified as high and planned separately. This describes the method and does not replace a legal check.
Service Connection
Classification happens in process automation consulting, the AI step is built in process automation with AI, and delivery as an RPA flow.
Sources
This framing describes the EU AI Act risk classes generally and is not legal advice. The current legal texts and their implementing acts are binding. The concrete classification of a flow depends on the case and must be checked against the applicable version and professionally.