The EU AI Act sorts AI by use into four tiers. Prohibited practices are banned. High-risk systems are allowed under strict obligations. Transparency risk systems carry disclosure duties. Minimal risk systems face no specific rules. The tier depends on what the system is used for, not the technology.
Tier 1: unacceptable risk
The Commission page says nine practices are prohibited, including harmful manipulation, social scoring, untargeted scraping of facial images, and emotion recognition in workplaces and education. The ninth is a ban on AI that generates non-consensual sexually explicit content or child sexual abuse material, taking effect in December 2026 through the AI Omnibus. Prohibitions 1 to 8 have applied since 2 February 2025. Penalties here are the highest tier, covered in the post on fines.
Tier 2: high risk
Allowed, with obligations. Examples from the Commission page include safety components in critical infrastructure, education scoring, recruitment tools, credit scoring and certain law enforcement and migration uses. Annex III lists eight areas. Obligations apply from 2 December 2027 for Annex III uses and 2 August 2028 for AI in regulated products. See the Annex III checklist.
Tier 3: transparency risk
Disclosure duties, for example telling people they are talking to a chatbot, labelling AI generated content and identifying deepfakes. Article 50 applies from August 2026.
Tier 4: minimal or no risk
No specific rules. The Commission gives AI in video games and spam filters as examples. General duties such as AI literacy still apply to providers and deployers of any AI system.
Separate track: general-purpose models
Models are handled outside the four tiers. Providers have transparency and copyright duties, and those with systemic risk have extra obligations. These have applied since August 2025.
Using the tiers in practice
- Start with the inventory.
- For each system, ask in order: is any practice prohibited, is it an Annex III or Annex I safety use, does it interact with people or generate content, or is it none of these.
- Record the answer and reasoning.
- Re-check whenever the use changes, since the same model can move tier.
Common confusions
- High-risk does not mean dangerous technology. It means a use listed in the Act.
- Minimal risk is not no duty. Literacy applies.
- A system can sit in two tiers, for example high-risk and subject to transparency rules.
Keep one more habit: re-run the tier check at every product review. New features such as scoring, ranking or automated decisions are the usual way a minimal risk tool slides into a higher tier. A five minute question in design review costs far less than a late reclassification.
If you are a deployer, pair the tier with your role. A minimal risk tool still sits inside your literacy programme, and a high-risk tool brings the Article 26 checklist. If you are a provider, the tier decides how much documentation and testing you owe before release, so make the call early in design rather than at launch.
Quick check
Is a customer chatbot high-risk?
Usually it is a transparency risk case, requiring disclosure that users deal with AI, unless its use falls in Annex III.
Where do general-purpose models fit?
They have their own set of duties, separate from the four use based tiers.
Sources
Last reviewed: 19 October 2026.
