AI Act: the four levels of risk explained

The AI Act does not treat all systems the same: it divides them into four levels of risk and assigns proportionate obligations to each. Understanding which step a system falls into is the step that determines everything else: whether you need technical documentation or a line of transparency, whether you can proceed or need to stop.

The important thing to grab right away: the band does not depend on how advanced the technology is, but on what that system decides and on who. The same language model is at minimal risk if it summarizes verbal and at high risk if it filters curriculum.

Bands also have different dates. Bans apply from February 2, 2025 and transparency from August 2, 2026 (Article 113 of Regulation (EU) 2024/1689); obligations for high risk, after the Digital Omnibus on AI, depart from 2 December 2027 or 2 August 2028.

How classification works

The mechanism is progressive exclusion. You start from the top and go down:

1. The system is one of the prohibited practices? If yes, it is not done. End.
2. It falls within the areas listed as high risk? If yes, full obligations are triggered.
3. Does it interact with people or does it generate content that could be mistaken for human? If so, Limited risk: transparency obligations.
4. None of the above? Minimum risk: no specific obligation other than literacy.

This order counts. Many companies start by asking themselves "how powerful is the model I use", and that's the wrong question. The right question is "Does this system decide something about a person, and can that person suffer the consequences?".

Outside this scale are the models for general purposes, the ones behind the most popular assistants. They have their own rules, applicable from August 2, 2025, which concern those who develop them and not those who use them (Article 113(b) of the AI Act): your use of that assistant still ranks with the four questions above.

Level 1: Unacceptable risk

It is not a band of obligations: it is a list of things that cannot be done in the European Union, in force since 2 February 2025 (Art. 5 and Art. 113 of the AI Act). It includes, in summary, the manipulation of behavior that causes harm, the exploitation of vulnerabilities of fragile people, social scoring (by whoever it is done, not just by public authorities), the recognition of emotions at work and at school, and some forms of biometric identification and inference of personal characteristics.

From December 2, 2026 the list lengthens. The Digital Omnibus on AI It also prohibits systems that generate intimate or sexually explicit images, videos or audio of recognizable people without their consent, and those that generate child pornography.

For an Italian SME this band is almost always irrelevant. Almost.

Level 2: High risk

It's the band that generates real work. It's about systems that impact decisions that are important to people's lives. Typical areas:

Those who provide a system in these areas have structured obligations: risk management system, training data quality, technical documentation, event recording, human surveillance, accuracy and robustness.

Who is it? use has more contained but not null obligations: to employ it according to instructions, to ensure that human surveillance is real, to inform the persons concerned, to keep logs. The distinction between the two roles is explained in obligations of the AI Act for SMEs.

Since when do the high risk obligations apply

The obligations of Chapter III, Sections 1-3, do not yet apply. The Digital Omnibus on AI, in force from 27 July 2026, postponed them: from 2 December 2027 for the systems of Annex III, i.e. the areas of the table, and from 2 August 2028 for those of Annex I, i.e. the AI that acts as a safety component of products such as toys, lifts or medical devices. In the original text of the Art. 113 dates were August 2, 2026 and August 2, 2027.

The same regulation added two clarifications useful for classification. A system used solely for user support, optimisation, efficiency, automation or quality control is not a safety component unless its failure puts health and safety at risk (new Article 6, paragraphs 1 bis and 1 ter). For systems placed on the market or put into service before the new date, obligations apply only if their design has changed significantly since then (Article 111, paragraph 2, revised by the Omnibus). All dates are in AI Act schedule.

Level 3: Limited risk

Here the obligation is essentially one, effective from August 2, 2026: Transparency (Article 50 of the AI Act). People need to know when they are interacting with an automatic system, at the latest at the first interaction, and when a content is artificially generated: generative system providers mark the content, the publisher of a deep fake declares it.

For generative systems already on the market before 2 August 2026 the marking must be done by 2 December 2026 (Article 111(4), introduced by the Omnibus).

Here fall chatbots, conversational assistants, agents who respond to customers, content generators. It is the band that touches the most companies, and it is also the easiest to comply with.

If you have a AI Agent or a chatbot talking to customers, you're almost certainly in this band, and fulfillment runs out in a well-written sentence.

Level 4: minimum risk

Everything else. Assistants used to write and summarize, internal automations, productivity tools, support systems that don't decide on people. No specific obligations under the AI Act, apart from the literacy of Article 4, which applies to anyone providing or using AI systems: from 27 July 2026 the Omnibus It re-wrote it as an obligation to take measures that support the skills of staff, without a specific level to be guaranteed.

Of course, the other rules remain in place: if there is personal data in the documents you feed to an assistant, the GDPR applies exactly as before. GDPR and AI in the company.

Three companies, three different bands

Mechanical workshop with assistant for quotations. The system reads the customer's request, proposes a draft estimate, the holder corrects it and sends it. It doesn't decide on people, it doesn't access essential services: minimal risk. If the draft starts automatically to the customer via chat, limited risk transparency is added, mandatory from August 2, 2026 (Art. 50).

Service company that uses software for selection. The system sorts candidates by score before the interview. High risk: affects access to work, with obligations applicable from 2 December 2027 (Reg. (EU) 2026/1744). Effective human surveillance, information to candidates, and verification that the scoring criterion does not produce indirect discrimination will be needed. The fact that the software is third party does not eliminate the obligations of the company that uses it.

Professional study summarizing practices. Minimal risk on the AI Act front. The serious theme is where the documents end: if they contain customer data, the assessment to be made is on the treatment, not on the risk classification.

When the band changes without changing the software

The most expensive error in classification is not to miss the initial assessment: it is don't do it again when the use changes.

A system remains identical, its risk range not. The typical scenarios:

1. An assistant who suggested replies are automatically put in. Change the degree of autonomy, change who controls the error.
2. An Instrument Born for Use internal is exposed to customers. Limited risk transparency enters.
3. A system that ordered practices start ordering Candidates. Passes directly into high risk.
4. An automation reading technical documents begins to read documents with data of people. The GDPR enters.

The third case is the one that most often escapes, because it happens by natural extension: the system works well on one thing, and someone proposes to use it also for another that looks similar. From a technical point of view it is; from a regulatory point of view it is another category.

The practical boundary between limited and high risk

On paper the distinction seems clear. In business reality there is a grey area that is worth knowing about: the systems that do not formally decide but effectively orient.

A tool that sorts candidates by score does not "decide" who to hire: it proposes an order. But if in practice no one looks past the top five, that system is determining the outcome. The substance matters more than the label.

The Regulation gives a precise criterion. An Annex III system is not high risk if it does not materially influence the outcome of the decision, for example because it performs a limited or only preparatory procedural task; however, if it performs profiling of persons, it always remains high risk, and the provider must document the assessment before placing it on the market (Article 6(3) and (4)).

The question to be asked is not "formally who decides", but "What if the system proposes the opposite order?". If the answer is "it would change the outcome", the system is deciding, however you call it. The method to evaluate it is in How to Assess the Risks of an AI System, and the general logic of acting agents is explained in AI Agents: What They Are.

The most frequent classification errors

• Classifying by model. "I use a powerful LLM so I'm at high risk" is wrong. Purpose counts.
• Classifying only once. The band should be reviewed when the use changes, not just when the software changes.
• Confusing risk of error with legal risk. A system that often errs but does not harm rights remains at minimal risk.
• Taking for granted that the high risk is only the supplier's. The user has obligations of his own, in particular on human surveillance.
• Treating transparency as a legal clause. It must be said where the person reads it, not buried in terms.

The classification in half an hour: three questions in order

Take the list of AI systems you use and answer for each one in order of three questions: it is among the prohibited practices, it falls into a high-risk area, talk to someone. The first positive response determines the fascia. If they're all negative, you're at minimal risk.

The result of this exercise, for most Italian companies, is a table with all systems in the minimum range and perhaps one in the limited range. It takes half an hour and closes a concern that otherwise remains vague for months. For the full method of assessment see How to Assess the Risks of an AI System; to know when every obligation is worth, the AI Act schedule.

Since these are standards with evolving guidelines, Always check official sources when classification has concrete legal consequences.

Four steps, one question: Who decides the system?

The logic is one: the more the system can affect people's lives, the more it needs to be documented and controlled. Those who use AI to work better are almost always at the bottom of the scale; those who use it to decide on someone are at the top and must organize themselves, with time until December 2, 2027 for Annex III (Regulation (EU) 2026/1744).

Knowing where you are isn't a theoretical exercise: it's what tells you if you can proceed quietly or if you need a compliance structure.

If you are evaluating a system that orders candidates, assigns scores or talks to customers, we can classify it together and design it with human surveillance and log from the beginning: we start from a AI consulting for SMEs. The complete overview remains AI Act: The Business Guide.