DEV Community: Fredrik

Are You Using High-Risk AI Without Realizing It?

Fredrik — Tue, 17 Mar 2026 09:41:44 +0000

Are You Using High-Risk AI Without Realizing It? 25 Real Examples from the EU AI Act

When people hear about the EU AI Act, they often assume it’s mainly about large tech companies building advanced AI systems.

In reality, many of the rules focus on how AI is used in everyday decisions — especially when those decisions affect people’s lives.

The regulation introduces a category called high-risk AI systems, which come with stricter requirements.

The tricky part is that many of these use cases are more common than you might think.

What does “high-risk AI” actually mean?

An AI system is considered high-risk when it is used in contexts where decisions can significantly impact individuals.

This includes areas like:

hiring
education
finance
healthcare
public services

These use cases are listed in Annex III of the EU AI Act, and they define where companies need to be more careful.

25 real-world examples

Here are some examples that help make this more concrete.

Hiring and workplace decisions

AI that filters job applicants or ranks candidates is considered high-risk.

The same goes for systems that evaluate employee performance or monitor behavior.

Education systems

If an AI system is used to grade exams or determine admissions, it falls into the high-risk category.

Financial decisions

Credit scoring is one of the most obvious examples.

If AI determines whether someone gets a loan, that system is high-risk.

Insurance pricing and approvals can fall into the same category.

Public sector use

AI systems used to determine access to benefits or allocate public housing are also high-risk.

These systems directly affect people’s access to essential services.

Law enforcement

Predictive policing tools and facial recognition systems are included here.

These are some of the most heavily discussed use cases in the regulation.

Healthcare

AI used in diagnosis or treatment recommendations is high-risk.

These systems can influence medical decisions, which raises the bar significantly.

Infrastructure and safety

AI systems controlling energy grids or traffic systems also fall into this category.

Failures in these systems can have wide-reaching consequences.

What about everyday AI tools?

Most companies are not building high-risk systems.

Common use cases like:

chatbots
document summarization
marketing tools
recommendation systems

are typically low or minimal risk.

But that doesn’t mean they can be ignored.

The real challenge for companies

The biggest issue isn’t identifying obvious high-risk systems.

It’s realizing that:

you may already be using more AI systems than you think.

Many companies have:

internal models
third-party APIs
embedded AI features

without a clear overview.

Why documentation matters

Even if your systems are not high-risk, you still need to:

understand what AI systems you use
assess their risk level
document your reasoning

This becomes especially important as regulation evolves.

A simple starting point

A practical approach is to:

list all AI systems used in your company
identify which ones might fall under high-risk categories
document how they are used

If you want a more detailed breakdown of high-risk AI systems and examples, we put together a full guide here:

https://paracta.com/25-high-risk-ai-examples

We also built a small tool to help companies classify and document their AI systems:

https://paracta.com

Final thought

The EU AI Act is less about advanced AI technology and more about how AI is applied in real-world decisions.

And for many companies, the first step isn’t compliance — it’s simply understanding:

Where are we actually using AI today?

What Actually Counts as an AI System Under the EU AI Act?

Fredrik — Sat, 14 Mar 2026 16:46:10 +0000

What Actually Counts as an AI System Under the EU AI Act?

If you’ve been following the EU AI Act discussions, one question keeps coming up when talking to founders and engineers:

“Does our software actually count as an AI system?”

The regulation sounds like it’s about big AI labs or advanced machine learning systems. But when you read the definition more carefully, you realize the scope is much broader.

A lot of everyday software features may already fall into the category of an AI system.

Understanding where that boundary is matters, because once a system qualifies as AI under the Act, the next step is determining its risk classification and documentation requirements.

The legal definition

The EU AI Act defines an AI system roughly like this:

A machine-based system that infers from input data how to generate outputs such as predictions, recommendations, content, or decisions.

The key word in that definition is infers.

In other words, the system is not just executing fixed logic — it is deriving outputs based on patterns in data.

That distinction ends up being the line between traditional software and AI systems.

Scenario 1: Using an LLM API

Let’s say your product calls an API like OpenAI, Anthropic, or another language model provider.

For example:

generating summaries
answering questions
analyzing user input
extracting information from documents

Even though you didn’t train the model, you are still deploying an AI system.

The AI Act distinguishes between:

providers (companies that build models)
deployers (companies that use them)

Most SaaS companies fall into the deployer category.

Scenario 2: A chatbot in your product

A chatbot powered by a language model is clearly an AI system.

The regulation doesn’t automatically make that high-risk, but it does introduce transparency obligations.

For example, users should be aware that they are interacting with an AI system.

In most SaaS or customer support contexts this will likely fall under limited or minimal risk, but it still counts as AI.

Scenario 3: Machine learning models

If your product uses machine learning — even something simple — it almost certainly qualifies.

Examples:

churn prediction models
fraud detection
recommendation engines
classification models
personalization algorithms

The important question is not whether the system uses neural networks or fancy architectures.

It’s whether the system infers outputs from data rather than executing deterministic logic.

Scenario 4: Recommendation systems

Recommendation systems appear everywhere:

e-commerce product suggestions
content feeds
personalization features

These systems usually rely on machine learning or statistical inference, which means they qualify as AI systems.

However, the risk classification depends heavily on context.

A product recommendation engine is likely minimal risk.

A system recommending medical treatments would be something very different.

Scenario 5: Rule-based automation

This is where things get blurry.

Many companies assume their automation tools count as AI, but often they don’t.

Examples that usually do not qualify:

simple if/then logic
scripted automation
workflow rules
deterministic business logic

These systems execute predefined instructions.

They don’t infer outputs.

However, once statistical models or adaptive logic are introduced, that boundary can shift quickly.

Scenario 6: Robotic Process Automation (RPA)

Traditional RPA tools typically follow scripted steps and therefore don’t qualify as AI systems.

But many modern RPA pipelines include AI components such as:

document recognition
classification models
anomaly detection

Those components may fall under the AI system definition even if the surrounding workflow does not.

Scenario 7: Analytics dashboards

Classic analytics and BI tools generally fall outside the scope.

Examples:

SQL queries
dashboards
reporting tools
visualizations

These tools summarize data but don’t infer predictions or decisions.

However, predictive analytics models — forecasting outcomes based on patterns — may qualify.

Why this matters for companies

This classification question isn’t just theoretical.

Many companies are discovering that they already have multiple AI systems running inside their products or internal workflows, often without realizing it.

Examples I’ve seen:

internal document processing pipelines
support chatbots
recommendation algorithms
fraud detection models

Each of these may need to be inventoried and assessed.

A practical approach

One practical rule that has emerged in many teams:

If there’s uncertainty, document it.

Even if a system ultimately falls outside the AI Act, recording the reasoning behind that decision is useful.

In practice this often leads to maintaining an AI system inventory inside the company.

How we started thinking about it

When we began mapping our own AI systems, we realized how quickly the list grows.

Between APIs, internal models, and product features, it’s easy to lose track.

That’s part of why we started building Paracta — a small tool to help companies classify and document their AI systems in a structured way.

If you want to read a deeper breakdown of the definition and examples, we wrote a full guide here:

https://paracta.com/what-is-an-ai-system-eu-ai-act

And if you’re exploring ways to document AI systems under the regulation, you can check out:

https://paracta.com

Final thought

The EU AI Act isn’t just about advanced AI labs.

It’s about how everyday software products use AI.

And the first step for most teams is simply answering a basic question:

What AI systems are we actually running?

DEV Community: Fredrik

Read more about how high risk systems are regulated, here: https://paracta.com/annex-iii-ai-act

Are You Using High-Risk AI Without Realizing It?

Fredrik ・ Mar 17

Paracta — EU AI Act Classification Platform

Are You Using High-Risk AI Without Realizing It?

Are You Using High-Risk AI Without Realizing It? 25 Real Examples from the EU AI Act

What does “high-risk AI” actually mean?

25 real-world examples

Hiring and workplace decisions

Education systems

Financial decisions

Public sector use

Law enforcement

Healthcare

Infrastructure and safety

What about everyday AI tools?

The real challenge for companies

Why documentation matters

A simple starting point

Final thought

What Actually Counts as an AI System Under the EU AI Act?

What Actually Counts as an AI System Under the EU AI Act?

The legal definition

Scenario 1: Using an LLM API

Scenario 2: A chatbot in your product

Scenario 3: Machine learning models

Scenario 4: Recommendation systems

Scenario 5: Rule-based automation

Scenario 6: Robotic Process Automation (RPA)

Scenario 7: Analytics dashboards

Why this matters for companies

A practical approach

How we started thinking about it

Final thought