YTYK You think you know

Card 1 of 15 The risk tiers ●○○ Foundational

Four tiers, decided by use

The regulation sorts AI by risk of use, not by capability: unacceptable (banned), high (regulated), limited (transparency duties only), and minimal (nothing). The same model can land in different tiers depending on what it is used for.

Why it is like this

Regulating the technology would age badly and would catch harmless uses. Regulating the use keeps the obligations proportionate and lets the list of uses be amended.

Not to be confused with

A ranking of how powerful a model is. A large model used to suggest recipes is minimal risk; a small classifier used to filter job applicants is high risk.

In practice

A face-matching model: banned for untargeted scraping to build a database, high risk for biometric identification, minimal for unlocking your own phone.

Source: Regulation (EU) 2024/1689 (AI Act) — Article 6 and Annex III. Read on .

Predict Check yourself

A team deploys the same open-weights model in two products: a recipe assistant and a CV screening tool. How many risk tiers are in play?

  1. Two — the tier follows the use, so one is minimal risk and the other is high risk under Annex III.
  2. One — the tier is a property of the model.
  3. One — both are high risk, because the model is the same.
  4. Two, but only if the two products are sold by different legal entities.
Show the answer

Two — the tier follows the use, so one is minimal risk and the other is high risk under Annex III.

This is the organising idea of the whole regulation. Classifying by model rather than by use is the single most common mistake in internal AI inventories.