The EU AI Act (Regulation (EU) 2024/1689) sorts AI systems into a four-tier risk pyramid instead of regulating all AI the same way. Where a system lands depends on how autonomously it decides, how severely a wrong decision could affect people's rights, safety or livelihood, and whether it operates in a sensitive sector listed in Annex III (biometric ID, critical infrastructure, education, employment, essential services, law enforcement, migration, justice).
RiskScore = 0.5·Autonomy + 0.4·Impact + SectorBonus(sector)
Tiers (illustrative thresholds):
score < 25 → Minimal risk — voluntary codes of conduct only
25 – 54 → Limited risk — transparency duties (e.g. disclose it's AI)
55 – 84 → High-risk — Title III: risk mgmt, data governance,
logging, human oversight, CE marking
score ≥ 85 → Unacceptable — banned under Article 5 (e.g. social
scoring, manipulative/subliminal systems)
- Autonomy — how much a human reviews or can override each decision; fully autonomous, unreviewed decisions push the score up.
- Potential impact — the severity of harm a wrong or biased decision could cause to health, safety or fundamental rights.
- Sector — Annex III use-cases (healthcare, law enforcement, employment, …) each carry a fixed risk bonus on top of Autonomy/Impact.
- Sandbox — Articles 57–58 let providers trial a high-risk system under a supervised regulatory sandbox before full Title III conformity is required; it never lifts an Article 5 ban.
The small cubes floating around the tower are a fixed sample of other hypothetical AI systems, coloured by their own tier, so the pyramid never looks empty at any setting.