The EU AI Act distinguishes four risk classes. For engineering teams, the legal definition matters less than the question: which obligations does our system trigger?
The four classes at a glance
| Class | Example | Core obligations |
|---|---|---|
| Prohibited | Social scoring | Not permitted |
| High-risk | CV screening, medical | Conformity assessment, QMS, logging |
| Limited risk | Chatbots | Transparency obligations |
| Minimal risk | Spam filter | No special obligations |
Why early classification matters
A late high-risk classification usually means expensive rework: missing data governance, no risk management system, insufficient technical documentation.
Compliance is not a release gate at the end, but a property of the architecture.
Practical checklist
- Document the intended purpose precisely
- Identify affected groups
- Prove data provenance and quality
- Anchor human oversight technically
- Consider logging and traceability from the start
Conclusion
The risk class is the starting point of every compliance strategy. Teams that determine it early can weave obligations into the architecture instead of retrofitting them.