The 4 Risk Classes of the EU AI Act Explained Simply (With Examples)

The EU AI Act (Regulation (EU) 2024/1689) regulates AI using a risk-based approach: the higher the risk, the stricter the obligations. Here are the four classes, with examples and the respective sanctions.

1. Prohibited practices (Art. 5)

Some AI applications have been prohibited since February 2, 2025, including social scoring by public authorities, certain forms of emotion recognition in the workplace and in schools, and manipulative techniques that exploit vulnerabilities (source: EUR-Lex, Regulation (EU) 2024/1689, Art. 5).

Sanction: up to 35 million EUR or 7% of worldwide annual turnover (Art. 99).

2. High-risk AI (Annex III)

This includes, among other things, AI in recruitment and applicant selection, creditworthiness checks, critical infrastructure and education. Strict requirements on risk management, data, transparency and human oversight apply to these systems (source: EUR-Lex, Regulation (EU) 2024/1689, Annex III and Chapter III).

Sanction for breaching these obligations: up to 15 million EUR or 3% of worldwide annual turnover (Art. 99).

3. Limited risk / transparency obligations (Art. 50)

Chatbots and AI-generated content (for example, "deepfakes") are subject to transparency obligations: users must be able to recognize that they are interacting with AI or that content is AI-generated (source: EUR-Lex, Regulation (EU) 2024/1689, Art. 50).

4. Minimal risk

Most everyday applications, spam filters, recommendation systems, text correction, fall into this class and are not subject to any special obligations under the AI Act.

Important: Art. 4 applies to ALL classes

Regardless of which risk class a system falls into: the AI competence obligation under Article 4 applies to all AI systems (source: BMDS/BeKI, "Framework conditions"). Anyone who uses AI must understand the fundamentals, precisely in order to be able to classify risk classes in the first place.

Timeline of the EU AI Act

• Aug 1, 2024: entry into force.
• Feb 2, 2025: prohibited practices (Art. 5) and the AI competence obligation (Art. 4) apply.
• Aug 2, 2025: rules for general-purpose AI (GPAI) models as well as governance and penalty provisions apply (Chapter XII, except Art. 101).
• Aug 2, 2026: general applicability of the Regulation begins.
• High-risk deadlines: following the political Omnibus agreement from May 2026, expected to be December 2, 2027 (Annex III) and August 2, 2028 (Annex I); until formal entry into force, the previous dates of August 2, 2026 and 2027 apply.

(Source: EUR-Lex, Regulation (EU) 2024/1689, Art. 113.)

Our AI competence certificate under Art. 4 provides an accessible introduction to exactly these topics, including a chapter on the risk classes of the EU AI Act.

Sources

• Regulation (EU) 2024/1689 (AI Regulation / EU AI Act), EUR-Lex: eur-lex.europa.eu/eli/reg/2024/1689/oj
• European Commission, "AI literacy: Questions & Answers": digital-strategy.ec.europa.eu
• BMDS (Federal Ministry for Digital Affairs and State Modernisation) / Advisory Centre for Artificial Intelligence (BeKI): "Building AI competence under Art. 4 AI Act (AI Regulation), guidance for basic training" (Oct. 2025): bmds.bund.de

This article is general information and does not replace legal advice.