Is your AI system high-risk under the EU AI Act?

The EU AI Act sorts AI into four bands, and almost everything about your obligations flows from which band you land in. Knowing your tier is the first, and cheapest, step to getting compliant.

The four risk tiers

Unacceptable risk systems are banned outright, think social scoring or manipulative techniques that exploit vulnerabilities. High-risk systems are permitted but carry the heaviest obligations: risk management, data governance, technical documentation, transparency, human oversight, accuracy and post-market monitoring. Limited-risk systems mostly attract transparency duties, telling people they're interacting with AI. Minimal-risk systems carry few specific obligations today.

What makes a system "high-risk"?

Two routes. First, AI used as a safety component of regulated products. Second, the one most organisations hit, AI used in specified sensitive areas: employment and worker management (CV screening, ranking), education (admissions, assessment), access to essential private and public services (credit scoring, benefits), law enforcement, migration, and the administration of justice. If your system materially influences a decision about a person in one of these areas, assume high-risk until an assessment says otherwise.

Why it matters commercially

High-risk classification isn't just paperwork. Without documented conformity you risk fines, stalled procurement (enterprise buyers increasingly ask), and reputational exposure if a system is challenged. Conversely, a clean assessment is fast becoming a sales asset, proof your AI can be trusted.

How to find out, in days, not months

You don't need a full assessment to learn your tier. A Triage classifies the system, screens for prohibited practices, and returns a Risk & Confidence Score in 1–2 days, with a clear go/no-go. If it's high-risk, you move into a full conformity assessment; if it isn't, you've spent very little to gain certainty.

One caveat: classification is region-aware. The EU AI Act is the most developed framework, but if you deploy in the UK, US, UAE, Canada or Australia, the picture shifts, which is exactly what a multi-region triage is for.