Risk Tiers, Enforcement, and Timeline

A Global Regulatory Benchmark

The EU Artificial Intelligence Act is the world’s first comprehensive horizontal regulation on AI. Much like the GDPR transformed data privacy, this Act sets a global benchmark for governance. Crucially, it has extraterritorial reach. It applies to any organization—regardless of headquarters—if their AI system is used in the EU or if its outputs affect EU citizens.

The Risk-Based Approach

At the heart of the Act is a risk-based approach. The stricter the risk to human rights and safety, the heavier the compliance burden. We classify every AI system into one of four distinct tiers to determine exactly which rules apply to your organization.

Tier 1: Unacceptable Risk

Systems in the Unacceptable Risk tier are considered a clear threat to safety and rights. They are strictly banned within the European Union. This includes social scoring that discriminates against citizens or AI designed to manipulate human behavior against their free will.

Tier 2: High-Risk AI

High-risk systems are permitted but face the most stringent requirements. Examples include AI used in HR for resume screening or credit scoring in banking. To deploy these, you must ensure human oversight and maintain detailed technical logs for conformity assessments.

Limited & Minimal Risk

Limited risk systems, like customer support chatbots, only require transparency. Users must simply be informed they are interacting with a machine. Minimal risk systems, such as spam filters or video games, face no mandatory legal obligations at all.

Classify the Use Case

Correct. That classification aligns with the Act's risk-based framework. Let's test your understanding. Drag each AI use case on the left to its corresponding risk category on the right.

Recap: Risk Classifications

Before we move to the timeline, remember: compliance scales with risk. High-risk systems like those in HR require significant preparation, while minimal risk systems remain largely unregulated.

Implementation Timeline

The Act entered into force in August 2024, but compliance is phased. By February 2025, all prohibited systems must be decommissioned. Rules for General Purpose AI follow in late 2025. Most high-risk obligations for enterprises don't become enforceable until December 2027.

Enforcement & Penalties

Non-compliance carries some of the highest penalties in the regulatory world. Using prohibited AI can cost up to 7% of global turnover—nearly double the GDPR limit. High-risk violations reach 3%, and even providing incorrect information to authorities can trigger a 1.5% fine.

Scenario: Enterprise AI Strategy

Your company is launching two tools. First, a screening tool for video interviews. Second, an internal IT support chatbot. Click on the tool that requires a full conformity assessment and human-in-the-loop oversight. Correct! Because it impacts access to employment, it is High-Risk. You must maintain rigorous logs and oversight. Not quite. The chatbot is Limited Risk. It only requires a transparency notice. Look at the screening tool instead.