How the EU AI Act's Risk Tiers Actually Classify Your AI System

The EU AI Act isn't just incoming regulation - it classifies AI systems by risk and sorts what you're required to build, document, and prove before you ship.

The Risk Tier System and What It Requires

The Act sorts AI systems into four risk tiers: unacceptable risk (banned outright), high risk, limited risk, and minimal risk. Most teams building internal tools, chatbots, or recommendation features land in the limited or minimal risk buckets - which carry light obligations, mostly around transparency (telling users they're interacting with AI).

The tier that demands real engineering attention is high risk. Systems in this category include AI used in hiring, credit scoring, education assessment, critical infrastructure, and healthcare triage. If your product touches any of those domains, you're looking at mandatory conformity assessments, human oversight mechanisms, detailed technical documentation, logging of system outputs, and data governance requirements before you can legally deploy in the EU.

High-risk systems must be built to support auditability from the start - not retrofitted. That means logging inputs and outputs with enough context to reconstruct decisions, building in a kill switch or human override, and maintaining a risk register that maps each failure mode to a mitigation.

Real Example

Here's a minimal logging pattern for a high-risk AI decision endpoint - the kind of audit trail the Act expects to exist:

import uuid, datetime, json

def log_ai_decision(input_data, model_output, model_id):
 record = {
 "decision_id": str(uuid.uuid4()),
 "timestamp": datetime.datetime.utcnow().isoformat(),
 "model_id": model_id,
 "input_hash": hash(json.dumps(input_data, sort_keys=True)),
 "output": model_output,
 "human_reviewed": False,
 }
 # Write to append-only store (e.g., S3, BigQuery, audit DB)
 audit_log.append(record)
 return record

This isn't compliance theatre - it's the minimum scaffold you need to answer "what did your system decide, and why, on date X?" - a question regulators can ask. The human_reviewed flag signals where oversight happened and where it didn't.

For non-technical roles: think of this as a receipt system for every AI decision your product makes. Without it, you can't demonstrate accountability after the fact.

Key Takeaways

• The EU AI Act's impact on your team depends almost entirely on which risk tier your use case falls into - mapping that early saves rework later.
• High-risk AI systems require audit logging, human override mechanisms, and pre-deployment conformity assessments - these aren't add-ons, they're architectural requirements.
• Products in limited or minimal risk tiers mostly just need to disclose that they're AI-powered - a much lower bar, but still a legal one.

If you're currently building an AI feature for a regulated domain, what's your team's current approach to logging model decisions in a way that could survive a compliance review?

---

Sources referenced: OpenAI Blog - Advancing responsible AI across Europe; EU AI Act official text summary (European Parliament)