Risk-Based Model

The regulation adopts a proportionate approach based on the level of risk that different AI applications may pose to citizens’ rights or to society.

• Unacceptable-risk systems are strictly prohibited, such as those involving subliminal manipulative techniques or social scoring by public authorities.
• High-risk systems, used in sensitive areas including health, education, justice or the management of critical infrastructure, are subject to stringent requirements, including conformity assessment, risk management, technical documentation, human oversight and continuous monitoring.
• Limited-risk systems must comply with transparency obligations, such as clearly informing users when they are interacting with an AI system.
• Minimal-risk systems can be developed and used freely, without specific regulatory requirements.

In addition to this risk-based categorisation, the regulation introduces specific rules for general-purpose AI models, including documentation obligations, systemic risk assessment, and dedicated safety measures for the most advanced models.

To support the correct implementation of the regulation, the European Commission has published the Guidelines on the Definition of an AI System, aimed at helping providers and authorities determine, in a harmonised way, the risk level of each system and the applicable requirements.

In parallel, the The General-Purpose AI Code of Practice has also been published, providing technical and organisational guidance to help operators of these models voluntarily comply with the principles of the regulation. Its adoption is encouraged as a preparatory mechanism ahead of the full entry into force of the legal obligations, offering greater predictability and legal certainty for companies involved in the development and deployment of advanced AI models.