AI risk classes: definition, value and limits
Definition
AI risk classes rank AI systems by their potential harm, from minimal through limited and high risk to prohibited applications. Each level carries different duties. For automated flows, the class determines how much documentation, transparency and human oversight are needed before a system may go live.
Why the Term Matters
The risk class is the first step of any legal classification. Without it, no one knows which duties apply and how much effort a project carries. Determining the class early plans the right scope from the start and avoids two mistakes at once, taking a high-risk system too lightly or crushing a harmless flow with unnecessary effort.
When It Is Relevant
- A new AI project starts and the scope is unclear.
- A flow decides about people or sensitive areas.
- An internal flow is meant to become a product.
- Regulators, a customer or an investor ask about the classification.
When Not
For a pure experiment with no users and no real data, a formal classification is not yet needed, a rough look suffices. For obviously minimal risk, such as an internal text tool with no personal reference, the class does not have to be determined with great effort.
Industries That Use It
- Human resources: selection systems often land in the high-risk class.
- Medical technology: AI in diagnosis regularly counts as high-risk.
- Lending: credit scoring is classified strictly.
- Education: automated exam grading is ranked as sensitive.
Typical Use Cases
- Roughly assign a planned AI system to a class before the build.
- Derive the needed scope of docs and oversight from the class.
- Spot prohibited or especially sensitive applications early.
- Record the classification in writing for customers or investors.
- Re-check the class when the system changes.
Decision Guide
| Signal | Classification is central | Alternative |
|---|---|---|
| New project, scope unclear | determine the class first | pure experiment |
| Decision about people | likely high risk | internal flow without reference |
| Product for external users | document the classification | early stage without users |
| Obviously harmless | light classification | great effort unnecessary |
Example
A team plans an AI product to pre-score applications and roughly assigns it to a risk class before the build. Because the use is judged high, it plans documentation and a human review point from the start. The effort matches the task. This describes the method and does not replace legal advice.
Service Connection
The classification shapes the build in workflow automation and the n8n build, for example through oversight and logs, and in the product it is supported by MVP development.
Sources
This is a general framing, not legal advice. The exact definition of the risk classes and the duties tied to them come from the EU AI Act and change in details and deadlines. The classification of a specific system should be checked against current legal texts and qualified counsel.