{"id":176,"date":"2026-06-01T12:39:58","date_gmt":"2026-06-01T12:39:58","guid":{"rendered":"https:\/\/solucom.si\/?p=176"},"modified":"2026-06-05T00:33:28","modified_gmt":"2026-06-04T22:33:28","slug":"ais-four-levels-of-risk","status":"publish","type":"post","link":"https:\/\/solucom.si\/en\/ai-act-quattro-livelli-di-rischio\/","title":{"rendered":"The 4 Risk Levels of AI Act, Explained with Examples"},"content":{"rendered":"

The word \u00abrisk,\u00bb when paired with \u00abartificial intelligence,\u00bb can be unsettling. But the AI Act uses that word in a very specific way, and understanding that takes away half your worries. The regulation does not treat all uses of AI the same way: it categorizes them into four levels of risk<\/strong>, like a pyramid. The higher you go, the more rules; but the base of the pyramid\u2014where the vast majority of businesses are\u2014is almost free. Let's look at the four levels with concrete examples, so you understand where you really stand. (As always: this is information, not legal advice for your specific situation.)<\/p>\n\n

1. Unacceptable risk: prohibited uses<\/h2>\n

At the top of the pyramid are uses considered so dangerous that they forbidden<\/strong> in the European Union (the ban has been in effect since February 2025). This is not about obligations to be met: these things are simply not allowed.<\/p>\n

Some examples: the social score<\/em> of citizens in mass surveillance style, the systems that manipulate<\/em> people exploiting vulnerabilities (age, disability), emotion recognition in the workplace or school, indiscriminate collection of faces to build facial recognition databases. For a normal SME, this is good news: these are practices far removed from everyday use. They are unlikely to concern you, unless you are evaluating something very extreme.<\/p>\n\n

2. High Risk: delicate uses, serious obligations<\/h2>\n

The second level is the one that requires the most attention. They are uses Permissible but delicate<\/strong>, as they impact people's rights or safety. This triggers significant obligations: documentation, human oversight, data quality management, and traceability. (Remember: the deadlines for these obligations have been postponed to 2027-2028, as I explain in Dates that count<\/a>.)<\/p>\n

Examples that can also affect an SME: AI used for select personnel<\/strong> (automatic resume screening), for assess creditworthiness<\/strong> from a client, to decide access to essential services, or AI integrated in Regulated products<\/strong> as medical devices. The point to remember: if you use AI to make\u2014or even just automatically influence\u2014important decisions about people, you're probably here.<\/p>\n\n

3. Limited risk: transparency is enough<\/h2>\n

Going down, we find the uses at limited risk<\/strong>. You don't need complex procedures here: what's needed is to be transparent<\/strong>. The bottom line is that people must know when they are interacting with an AI or viewing AI-generated content.<\/p>\n

Concrete examples for a company: a chatbot<\/strong> On the site, you need to make it clear that users are speaking with an AI, not a person. images, texts, or videos generated<\/strong> from AI and published must be indicated as such in the cases provided (the full transparency obligation applies from August 2026). This is the level where a good part of the \u00abvisible\u00bb uses of AI in SMEs fall: nothing dramatic, just declared honesty.<\/p>\n\n

4. Minimal risk: the vast majority<\/h2>\n

At the base of the pyramid is everything else: the customs minimum risk<\/strong>, which do not entail any specific obligations under AI Act. This is where most of what companies do with AI on a daily basis falls.<\/p>\n

Examples: Use AI to write text drafts, summarize documents, organize notes, translate, conduct internal research, filter spam, suggest products. All activities with low impact on people's rights. Good sense and attention to data are needed, but not a dedicated compliance apparatus.<\/p>\n\n

The point that almost everyone gets wrong: what matters is how you use it, not the tool itself.<\/h2>\n

Here is the key to not getting confused. The level of risk doesn't depend on the tool, but on how you use it.<\/strong> The same generic AI model can be at minimal or high risk depending on the task.<\/p>\n

Clear example: using an AI assistant to write a draft of a commercial offer is a minimal risk. Using the same<\/em> An assistant for automatically deciding which candidates to reject in a hiring process is high risk. The same tool, two different regulatory worlds. This is why it doesn't make sense to ask \u00abIs ChatGPT high risk?\u00bb: the right question is \u00abWhat am I using it for?\u00bb. The same applies to a AI agent<\/a>It's the use that determines its level.<\/p>\n\n

Supplier or user? The role also matters<\/h2>\n

There is a second element, besides the risk level, that decides how many obligations you have: the role<\/strong> in terms of how it interacts with the AI system. AI Act primarily distinguishes between two types, and the difference is substantial.<\/p>\n