The AI Act explained: risk levels and where your activities fit
If you use artificial intelligence in your work or offer it to your clients, you have probably wondered whether the European AI Act affects you and what you need to do to comply. The answer depends on how you use AI and the effect it may have on people. It does not depend on how advanced the technology is.
With this chapter, we begin a new section of the series dedicated to the regulatory framework. You will see how the Act's risk-based approach works, what each level requires, and which deadlines apply following the 2026 reform. You will also find a table to help you classify your use cases and a design strategy tailored to professionals and SMEs.
Note: this post is for informational purposes and is not a substitute for legal advice. If you have a specific case, especially one that may be high-risk, consult a specialist.
From “move fast” to compliance by design
For years, software development followed the motto made famous in Silicon Valley: “Move fast and break things”. In the European Union, that approach no longer works for AI.
The EU Artificial Intelligence Act (AI Act) is the first comprehensive legal framework governing the development, sale and use of AI systems across all sectors. Its aim is not to hold back innovation. It seeks to ensure that AI is trustworthy and respects people's health, safety and fundamental rights.
For a professional or an SME, understanding the AI Act is not just a legal matter. It is also a design matter. If you understand its structure, you can build systems that comply from the outset (compliance by design). This helps you avoid penalties, which in the most serious cases can reach 35 million euros or 7 % of annual worldwide turnover. Transparency also becomes a selling point against less rigorous competitors.
The AI Act's risk pyramid
The AI Act follows a risk-based approach. The greater the potential harm from a particular use of AI, the more obligations apply.
The key point: the use case is regulated, not the technology. The same language model can pose minimal risk when summarising internal reports and high risk when screening job candidates.
Level 1: unacceptable risk (prohibited practices)
These are uses of AI that undermine dignity and fundamental rights. They have been prohibited since 2 February 2025. They include:
- Social scoring: evaluating or classifying people based on their social behaviour or personal characteristics when this leads to unjustified or disproportionate detrimental treatment. The prohibition applies to both public bodies and businesses.
- Subliminal or deceptive manipulation that materially distorts a person's behaviour and causes, or may cause, significant harm.
- Exploitation of vulnerabilities related to age, disability, or social or economic circumstances.
- Biometric categorisation to infer sensitive data such as race, political opinions, trade union membership, religious beliefs or sexual orientation. There are very limited exceptions.
- Emotion recognition in the workplace or in educational institutions, except for medical or safety reasons.
The list also includes creating facial recognition databases by scraping images in bulk from the internet or surveillance cameras. It also includes predicting crimes solely on the basis of a person's profile and certain uses of real-time biometric identification in public spaces.
Level 2: high risk (strict requirements)
These are systems that can directly affect people's lives, opportunities or rights. They are not prohibited, but they require rigorous regulatory compliance.
Annex III of the Act lists the main areas:
- Education and vocational training: student admissions, assessment of learning outcomes and monitoring behaviour during exams.
- Employment and human resources: recruitment, CV screening, performance evaluation, promotion or dismissal decisions, and task allocation.
- Essential services and credit: creditworthiness assessments, risk assessment and pricing for life and health insurance, access to public benefits, and classification of emergency calls.
- Other sensitive areas: biometrics, critical infrastructure (traffic, water, gas, electricity), law enforcement, migration and border control, administration of justice, and democratic processes.
What high risk requires:
- A risk management system.
- Data governance and quality.
- Detailed technical documentation.
- Automatic event logging for traceability.
- Clear information for those using the system.
- Effective human oversight.
- Accuracy, robustness and cybersecurity.
Level 3: transparency risk
This category covers systems that interact with people or generate content. The main risk is that someone may be confused or misled. The obligations apply from 2 August 2026:
- Disclose that users are talking to AI: a chatbot or customer service assistant must inform users that it is not a person, unless this is obvious.
- Mark generated content: providers of tools that generate text, images, audio or video must mark it in a machine-readable format. For example, using metadata or digital watermarks. Systems placed on the market before 2 August 2026 have until 2 December 2026.
- Disclose deepfakes: anyone publishing manipulated images, audio or videos that appear real must disclose this. In clearly artistic, satirical or fictional works, the disclosure can be adapted to avoid spoiling the work, but it is still required.
- Disclose AI use in texts of public interest: if you publish AI-generated texts to inform the public about matters of general interest, you must disclose this, unless a person has reviewed them and assumes editorial responsibility.
Level 4: minimal risk
The vast majority of business and professional uses fall into this category. For example:
- Spam filters.
- Product recommendations in an online shop.
- Agents that summarise documents for internal use.
- Translation of drafts.
- Automation of administrative tasks that do not affect third-party rights.
These uses have no specific requirements under the AI Act, but they must comply with other rules, particularly the General Data Protection Regulation (GDPR). The AI Act also promotes AI literacy, meaning that people who use these systems should know how they work and what risks they pose. Check how this duty applies in its current version.
Which deadlines apply following the 2026 reform
The AI Act entered into force in 2024, but its obligations apply in stages. In 2026, the EU approved a reform called the Digital Omnibus on AI, which mainly delays high-risk obligations. It was published as Regulation (EU) 2026/1744 in July 2026.
Obligation
Application date
From 2 February 2025
Transparency obligations (Art. 50)
From 2 August 2026
Content marking in systems already on the market
By 2 December 2026
High risk under Annex III (employment, education, credit…)
From 2 December 2027
High risk in regulated products (Annex I)
From 2 August 2028
An important reminder: the postponement gives you more time, but it does not remove the obligations. If you are designing a recruitment or educational assessment system now, it is worth building it with those requirements in mind from the outset. The GDPR and anti-discrimination rules also apply today.
The strategy: design to avoid high-risk classification where possible
For many professionals and SMEs, meeting high-risk requirements calls for auditing and documentation resources they do not have. That is why it is often better to design workflows so they remain at the transparency or minimal-risk levels, wherever the use case allows.
1. Use AI for support, not as the decision-maker
In areas such as human resources or education, the system should not make automated decisions that affect people. It is better for it to perform narrowly defined tasks: organising documents, preparing a draft or detecting patterns for a person to review.
The Act provides that a system in a sensitive area listed in Annex III may not be considered high-risk in certain cases:
- If it performs a narrow procedural task.
- If it improves the result of work already carried out by a person.
- If it detects patterns without replacing human judgement.
- If it performs a preparatory task.
But there are limits:
- Having a person make the final decision is not enough. If the system ranks or rejects candidates, it influences that decision and remains high-risk.
- If the system profiles people, it is always considered high-risk.
- You must document your analysis. If you conclude that your system is not high-risk, you must justify this in writing and, where applicable, register it.
This is the same logic we saw in chapter 4 on levels of autonomy: in high-impact processes, the system proposes and the person decides.
2. Be transparent by default
Add clear notices to every interface your clients or users use. Indicate when they are talking to AI and when content has been generated with AI. It costs little, builds trust and prepares you to meet obligations that already apply.
3. Create an inventory of your systems
List all the AI uses in your work, both those you develop and those you procure. Classify each one within the pyramid and record your reasoning. Everything else starts with that inventory.
Conclusion
The AI Act does not treat all systems equally. It focuses on the impact each use has on people. Most professional applications involve minimal or transparency risk. High risk is concentrated in areas such as employment, education or credit. If you understand the pyramid, review the deadlines and design with genuine human oversight and transparency from the outset, you can turn compliance into a competitive advantage.
Want to design your AI systems with sound judgement and transparency from the outset? Visit libertadia.com and sign up in the app.