In short: There are four EU AI Act risk categories. Unacceptable risk is banned. High risk comes with strict duties. Limited risk means you must tell people it is AI. Minimal risk adds no new duties. Your category depends on what the AI is used for, not on the technology. Find your use case in the law, write down why it fits, and test against the duties that follow.
Many teams use AI without knowing which EU AI Act risk category it falls under. That is a problem, because the category decides almost everything: what you must document, what you must test and what you must tell users. If a regulator or a large customer asks, “we never checked” is not an answer. The check itself takes an afternoon, not a project.
What are the four EU AI Act risk categories?
The EU AI Act, Regulation (EU) 2024/1689, groups AI systems by the harm they could do. It looks at people’s health, safety and basic rights. The more harm, the stricter the rules. At the top is unacceptable risk: practices the law bans outright. Next is high risk: systems that are allowed, but only with risk management, testing, documentation and human oversight. Then limited risk: systems where people must be told they are dealing with AI. At the bottom is minimal risk: most everyday AI, such as spam filters, with no new duties. The law also has separate rules for general-purpose AI models, the large models that other apps are built on. Those rules mainly apply to the companies that make such models. If you build on top of one, your own app still gets its own category.
| Category | Examples | What it means for you |
|---|---|---|
| Unacceptable risk | Social scoring, emotion recognition at work or school | Banned. |
| High risk | CV screening, credit scoring, exam grading | Strict duties before and after launch. |
| Limited risk | Customer service chatbots, AI-generated images | Tell people it is AI. |
| Minimal risk | Spam filters, AI in video games | No new duties. |
How do you know if your AI system is high risk?
Your AI system is high risk in two cases. The first is when it is a safety part of a product that needs an EU safety check. Think of a medical device, a machine or a toy. The second is when it is used in an area listed in Annex III of the AI Act. These areas include biometrics, critical infrastructure, education, and hiring and managing staff. Access to key services, such as credit or insurance, is on the list as well. Law enforcement, migration and the justice system are on the list too. So the same language model can be minimal risk as a writing helper and high risk when it ranks job applicants. The use decides, not the model.
There is an exception. A system in an Annex III area is not high risk if it poses no significant risk. An example is a tool that only does a narrow task to prepare a human decision. But a system that profiles people always stays high risk. If you rely on the exception, you must write down your reasoning, and you must be able to show it.
What do limited and minimal risk mean in practice?
Limited risk means your main duty is to be open about the AI. Under Article 50, people must know when they talk to a chatbot instead of a person. AI-generated or altered images, audio and video must be marked as such. Most customer-facing chatbots land here. Minimal risk means the AI Act adds no specific duties, although other laws, such as the GDPR, still apply. Watch out for one thing. A low category does not mean low risk to your business. A chatbot that leaks customer data or gives wrong advice can be limited risk under the law and still cost you customers. The category tells you your legal duties. It does not tell you whether your AI behaves well.
When do the rules apply?
The AI Act applies in steps. The bans have applied since 2 February 2025. So has a duty to make sure staff who work with AI understand it. Rules for general-purpose AI models followed on 2 August 2025. The original timetable set most other duties, including those for Annex III high-risk systems and the transparency duties, for 2 August 2026. High-risk AI in regulated products followed a year later. In November 2025 the European Commission proposed to move part of the high-risk rules to a later date. That plan is part of a wider package called the Digital Omnibus. So check the latest dates on the Commission’s AI Act page before you plan. Fines are high. Banned practices can cost up to 35 million euros or 7% of worldwide turnover. Most other breaches can cost up to 15 million euros or 3%.
What this means for your team
Start with a simple list. Write down every AI system you use or build, what it does and who it affects. For each one, pick the category and write one or two sentences on why. Do it for bought tools too. You’re responsible for your AI, even when you didn’t build it. Your duties differ depending on whether you build the system or only use it, but neither role gets you off the hook.
Then test against the duties that follow. For limited risk, check that your chatbot says it is an AI and does not leak data. For high risk, you need evidence over time: how the system was tested, what went wrong and what you fixed. A one-off check won’t show that.
That evidence is what VeritasAI is built for. The PRO plan runs an automated weekly test schedule with a growing test library mapped to the EU AI Act, ISO 42001, OWASP and NIST. You see how your AI scores, where it struggles and what to improve. That gives you audit readiness: you can show at any moment that you monitor and reduce AI risk. It does not replace legal advice on your category, and it does not promise you will pass an audit. It does give you the proof an auditor will ask for.
Know your risk category, and prove your AI is under control.
Frequently asked questions
Is ChatGPT high risk under the EU AI Act?
A general-purpose model like the one behind ChatGPT has its own set of rules, which mainly apply to the company that makes it. Your use of it gets its own category. As a writing helper it is usually minimal risk; used to screen job applicants it is high risk.
Does the EU AI Act apply to companies outside the EU?
Yes, if the AI system is placed on the EU market or its output is used in the EU. Where your company is based does not matter.
Who decides which risk category my AI falls under?
You do, at first. The provider or user of the system makes the assessment and must be able to explain it. National authorities can check it and disagree.
What happens if I put my AI in the wrong category?
You may miss duties that apply to you, such as testing, documentation or telling users it is AI. That can lead to fines and to orders to stop using the system. Writing down your reasoning helps you spot mistakes early.