EU AI Act Risk Categories: What US Teams Need to Know
Understand the four commonly used risk categories, the separate rules for general-purpose AI models, and the facts a US team should gather before seeking a legal classification.
Updated 5 min read
The EU AI Act risk categories are commonly summarized as unacceptable risk, high risk, transparency risk, and minimal or no risk. The category depends on the system’s purpose and use; a familiar product name is not enough to classify it. US teams should investigate relevance when they provide AI to the EU, operate there, or have another connection covered by the law.
Keep the classification question attached to the actual workflow. fenbs can record the review people approve and the internal rules that follow, while qualified advisers handle legal interpretation. A saved decision helps colleagues understand the permitted use without treating a chat answer as an authoritative ruling.
What does each category describe?
The European Commission’s AI Act overview (opens in a new tab) explains the risk-based structure. This is an orientation to the categories, rather than a checklist that determines your obligations.
| Category | General meaning | Starting question |
|---|---|---|
| Unacceptable risk | Certain prohibited AI practices. | Could this use fall within a prohibition? |
| High risk | Specified uses with substantial implications for safety or fundamental rights. | Does the intended use meet the legal classification criteria? |
| Transparency risk | Certain uses require people to be informed about AI involvement or artificial content. | What disclosure is required, and who must provide it? |
| Minimal or no risk | Uses outside the other categories generally lack additional risk-specific requirements under this framework. | Which other laws and internal controls still apply? |
The Commission gives spam filters as a minimal-risk example and recruitment tools as a high-risk example. Avoid stretching either example into a blanket judgment about your own system. Details about purpose, affected people, and how the output is used can change the review.
Why is the intended use more important than the model name?
A system that summarizes an internal meeting and a system that screens job applicants can use similar underlying technology while doing very different work. Document what the output changes in the real world. A draft that stays with its author creates a different decision path from a score used to exclude someone.
The Act’s legal text (opens in a new tab) sets out the high-risk criteria in Article 6 and the specified areas in Annex III, with conditions and exceptions that need careful reading. Article 50 contains particular transparency obligations. These are legal tests, not labels to choose by intuition.
Start a short use description: who operates the system, who is affected, what information enters, what comes out, and what a person does next. Include whether someone can challenge the outcome. Keep marketing descriptions separate from that operational account.
When should a US organization investigate EU relevance?
Article 2 covers specified providers outside the EU that place systems or general-purpose AI models on the EU market, as well as other defined situations. It also addresses certain providers and deployers outside the EU where the system’s output is used in the EU. Headquarters in the United States therefore does not settle the scope question.
Ask counsel to assess the actual relationship: where you offer the system, where people use its outputs, your contractual role, and any exclusions. A deployer is an organization using an AI system under its authority; a provider develops or supplies one under the conditions the Act defines. The allocation deserves review before responsibilities are assigned.
- Identify the business entity operating each part of the workflow.
- Describe where the service is offered and where its outputs are used.
- List the people and decisions the workflow affects.
- Gather vendor documentation and the contract describing each party’s role.
- Record unresolved scope questions for a qualified reviewer.
Use an AI risk assessment record to organize the facts before the legal review. A completed internal form helps the conversation; it does not determine whether the Act applies.
Are general-purpose models a fifth risk tier?
General-purpose AI model rules are a separate part of the Act, rather than a simple fifth rung of the four-category diagram. The Commission’s general-purpose AI explanation (opens in a new tab) describes provider obligations, with additional treatment for systemic risk. A model’s status does not answer every question about a system built with it.
For a purchasing team, the practical next step is to ask which part of the offering the vendor is describing. A statement about the underlying model may leave questions about your configured workflow unanswered. Keep the vendor’s answer and any limitations with the use description.
What should the review record contain?
Separate your factual account, the reviewer’s interpretation, and the organization’s operating decision. For example, the workflow facts might say an assistant drafts interview questions. The operating decision might limit it to drafting and forbid candidate ranking until a separate review is complete. That limit should be visible to the people using it.
The Commission’s high-risk classification guidance page (opens in a new tab) points to interpretation resources and current implementation information. Check its status and the applicable legal text with your adviser when making a decision. Guidance, proposed changes, and enacted obligations should not be treated as interchangeable.
- The exact use, its owner, and the version or configuration reviewed.
- The sources examined, including their status and the date checked.
- The reviewer’s conclusion, remaining questions, and assumptions.
- The uses people approved, the boundaries, and the next review trigger.
fenbs Decisions and rules can keep the approved boundaries with the project, so the next assistant reads the internal instruction people actually adopted.
Which shortcuts create the most confusion?
Avoid concluding that a human reviewer automatically makes a use low risk, that every chatbot has the same obligations, or that minimal risk means unrestricted use. Also avoid treating a supplier’s broad compliance statement as approval for any future use. Ask what the statement covers and what it assumes.
Where oversight is relevant, the human oversight guide explores the operational questions. For an independent US risk-management structure, see the NIST framework guide. Neither replaces the classification of the particular system and use.
Keep the approved boundary visible
Record the human-approved use, the reason for the boundary, and the review tasks still open. Keep links to the authoritative material with the work so a later change can be reviewed against the original assumptions.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
How to do this with fenbs
- Create a free account and add a project for the AI workflow under review.
- Create tasks for missing facts, vendor questions, and legal review. Put the intended use and the source references in the relevant work record.
- Record the decision a person approves in Decisions and rules, including its limits and the person who chose it.
- Save outstanding questions in Where we left off. Reopen review work when the purpose, affected users, or operating authority changes.
fenbs does not classify AI systems, certify compliance, or replace legal advice and specialist compliance systems. It keeps the internal decisions and follow-up work; the AI governance library covers related questions you may need to investigate.