EU AI Act risk categories: which tier is your system in, and by when?

EU AI Act risk categories explained

The EU AI Act sorts systems into four risk categories, plus a separate regime for general-purpose models. The category sets the obligations; the 2026 Digital Omnibus, Regulation (EU) 2026/1744 (in force 27 July 2026), reset the dates for the high-risk tier without changing the tiers themselves (Gibson Dunn; Freshfields). The four tiers, with what each one requires and when, are below; run the checker above to see which one your system lands in. Orientation only, not legal advice.

• Unacceptable risk (Article 5), banned since 2 February 2025. Social scoring by public authorities, manipulative or exploitative techniques, untargeted facial-image scraping, emotion recognition at work or in education, and most real-time remote biometric identification in public spaces. Obligation: do not place on the market or use. Fines up to EUR 35M or 7% of global turnover (Art. 99). Source: artificialintelligenceact.eu.
• High risk (Article 6 and Annex III), stand-alone systems from 2 December 2027. Annex III lists creditworthiness and credit scoring of natural persons (5(b)), life and health insurance risk assessment and pricing (5(c)), recruitment and worker management (4), education (3), access to essential services (5(a)), critical infrastructure (2), biometrics (1) and law enforcement, migration and justice (6 to 8). Obligations: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, EU database registration, conformity assessment; deployers add Article 26 duties. Annex I safety components in regulated products follow from 2 August 2028. Post-Omnibus dates: Gibson Dunn.
• Limited risk (Article 50 transparency), in force since 2 August 2026. Chatbots and voice agents must tell people they are AI unless obvious; synthetic audio, image, video and certain text must be marked; deepfakes disclosed. Article 50(2) marking for legacy systems applies from 2 December 2026. These duties were not deferred by the Omnibus and apply on top of any other tier. Sources: Mayer Brown; Cloud Security Alliance.
• Minimal risk, no fixed deadline. Spam filters, inventory forecasting, most internal productivity agents that neither decide about people nor talk to the public. Obligation: none specific under the Act; voluntary codes of conduct (Art. 95) and existing law (GDPR, consumer, sectoral rules) still apply. Source: European Commission, AI Act overview.
• General-purpose AI models (Articles 53 and 55), in force since 2 August 2025. Not a risk tier but a parallel regime for model providers: technical documentation, downstream information, copyright policy and a training-data summary; systemic-risk models (10^25 FLOPs and above) add evaluation, adversarial testing and incident reporting. Source: Mayer Brown.

EU AI Act risk categories: how risk classification works

Article 6 has two routes into high-risk. Route one: the system is a safety component of a product covered by Annex I harmonised legislation, such as a medical device or machinery. Route two: the system is used for one of the stand-alone purposes in Annex III, such as creditworthiness, insurance pricing, recruitment or education.

Article 6(3) is the exit. A listed system that only performs a narrow procedural task, improves a prior human decision, or detects patterns without replacing human assessment can be documented out of high-risk. The Commission published new classification guidance in July 2026 (Mayer Brown). TheoSym's AI consulting practice builds that assessment into the design record from the first sprint.

• Unacceptable: Article 5, banned since February 2025
• High: Annex I (2028) or Annex III (2027)
• Limited: Article 50 transparency, live since August 2026
• GPAI: Article 53, systemic risk adds Article 55
• Minimal: no specific duties

Is my AI system high-risk under the EU AI Act after the Omnibus?

The test did not change. The dates did. Regulation (EU) 2026/1744, in force 27 July 2026, moved stand-alone Annex III obligations to 2 December 2027 and Annex I to 2 August 2028 (Gibson Dunn). Article 50 was not deferred and has applied since 2 August 2026.

For lenders and insurers the answer is usually yes. Annex III 5(b) covers creditworthiness and credit scoring of natural persons; 5(c) covers life and health insurance risk assessment and pricing. QGI builds those decision layers deterministic, with the logging, reproducibility and human-oversight evidence Chapter III asks for, so the conformity file writes itself as the system runs. Shipped examples are in the AI Factory workproofs.

Article 50 transparency obligations vs high-risk obligations

Article 50 is about disclosure, not conformity assessment. If your agent talks to people, they must be told it is AI unless that is obvious. If it generates synthetic audio, image, video or certain text, the output must be marked. These duties apply to minimal-risk systems too, and they are live now.

High-risk obligations are heavier: risk management, data governance, technical documentation, logging, human oversight, accuracy and robustness, registration and conformity assessment. A chatbot that also scores credit carries both sets. The harness TheoSym ships with every production agent covers the Article 50 disclosure and the logging line by default.

When do you need an EU AI Act compliance checker, and what are the fines?

Before the architecture is fixed. Classification decides whether you need a fundamental-rights impact assessment, a registration and a notified body, and those change what you build. The incumbent checker reports 150,000 monthly users (Future of Life Institute); many still show the pre-Omnibus dates.

Run it again when the use case changes, when you add a general-purpose model, or when the system starts talking to customers. Dr. Sam Sammane, QGI Founder & CEO, has published on formal verification and explainable AI for two decades; announcements are in the press center. None of this is legal advice. Verify against the Regulation as amended and your counsel.