AI risk classes: definition, levels and classification
Why the Term Matters
The risk class determines whether a prototype goes into operation with little effort or needs extensive evidence. Clarifying that only at the end risks a finished system that is not allowed to run as built. The smart move is early classification in the workshop: if the use case hits a strict class, the build is planned differently from the start. That way effort matches risk and the later implementation does not fail on missing prerequisites.
When It Is Relevant
- A new use case is to be planned and built.
- An existing system is extended and its effect changes.
- A third-party model is bought in and must be classified.
- A tender or an audit requires stating the class.
When Not
For a clearly uncritical tool without personal reference, the classification is quick and moves into the background. The case usually lands in a light class with few duties. Still, a short note is worth it, so a later extension does not slip unnoticed into a stricter class. Classification is not an end in itself but should steer the effort.
Industries That Use It
- Medical technology: AI inside devices often falls into strict classes and needs early clarity.
- Human resources: tools for applicant selection frequently count as high-risk.
- Critical infrastructure: systems in energy and transport are under special scrutiny.
- Education: applications that assess learners touch sensitive areas.
Typical Use Cases
- Classifying a planned use case before the build.
- Checking whether an extension changes the class.
- Deriving the needed evidence from the class.
- Comparing several ideas by effort and risk.
- Stating the class in tenders and audits.
- Classifying a bought-in model along with provider duties.
Decision Guide
| Signal | Check the class carefully | Alternative |
|---|---|---|
| Effect on people or rights | review high-risk carefully | a process without AI automation |
| Only internal help, no personal reference | light class likely | a short note suffices |
| Chatbot with direct customer contact | mind transparency duties | clear labelling as AI |
| Unsure whether prohibited | clarify the practice early | bring in specialist legal advice |
Example
A maker of medical devices assesses an AI assistant to evaluate measured values. In the workshop the team first determines the risk class, because the whole build plan depends on it. Only after the classification and the derivation of evidence is a prototype built. This describes the method, not an asserted metric.
Service Connection
The usual entry is the AI workshop for classification, then AI consulting and AI implementation.
Sources
This framing is general orientation and not legal advice. The exact assignment of an application to a class and the resulting duties follow from the EU AI Act and accompanying guidelines and should be checked for every project against the currently applicable legal texts.