AI System Risk Categories Under the EU AI Act

The EU AI Act classifies artificial intelligence (AI) systems into four risk categories: unacceptable risk (banned), high risk, limited risk, and minimal risk. Each category has different obligations - the stricter the potential harm to people, the stricter the requirements. Most AI tools used by Lithuanian micro-enterprises (such as ChatGPT, Copilot, or image generators) fall into the limited or minimal risk categories, but understanding the classification is still essential to know which rules apply to your business.

This categorisation is the foundation of the EU AI Act (Regulation (EU) 2024/1689). Without it, it is impossible to correctly complete the AI tool registry or determine what compliance measures are needed. Below, we explain each category with concrete examples relevant to small Lithuanian businesses.

What Are the Four AI Risk Categories?

The EU AI Act is based on a so-called risk-based approach. This means that the strictness of regulation depends not on the technology used, but on the potential harm the system can cause to people and their rights. Here are all four levels:

Important: A single AI system can fall into different categories depending on how it is used. The same language model used to generate responses to customer questions is limited risk, but if adapted for automated employee selection decisions, it becomes a high-risk system.

What Is Unacceptable Risk AI and Why Is It Banned?

Unacceptable risk AI refers to practices considered too dangerous and are therefore completely prohibited in the EU. These provisions apply earliest - from 2 February 2025.

Prohibited practices include:

• Subliminal manipulation - systems that deceive people into making decisions they would not otherwise make, thereby harming them.
• Exploitation of vulnerable groups - AI that takes advantage of vulnerability due to age, disability, or social status.
• Social scoring - evaluating people based on behaviour and classifying them in a way that leads to unfavourable treatment in unrelated situations.
• Emotion recognition in the workplace and educational institutions - with certain medical and security exceptions.
• Non-selective scraping of facial images from the internet to create facial recognition databases.

This category is rarely directly relevant to micro-enterprises, but it is worth knowing: if you are considering deploying a tool that, for example, analyses employee emotions from facial images, it already falls into the prohibited zone. For more on this, see who the EU AI Act applies to.

What Is High-Risk AI?

High-risk AI refers to systems that can significantly affect people’s safety, health, or fundamental rights, so they are subject to the strictest requirements (after bans). AI classification into this category happens in two ways:

1. AI as a product safety component - for example, systems in medical devices, vehicles, elevators, or toys, which are already subject to EU product safety legislation.
2. AI in specific sensitive areas listed in Annex III of the EU AI Act:
   • biometric identification;
   • critical infrastructure (energy, water, transport);
   • education and vocational training (assessment, admission);
   • employment and worker management - CV screening, candidate scoring, decisions on promotion or dismissal;
   • access to essential private and public services (credit scoring, social assistance);
   • law enforcement, migration, administration of justice.

The employment point is particularly relevant for small businesses. If you use an AI tool to automatically screen or rank job candidates, it is likely a high-risk system. In such cases, the deploying company (the deployer) must:

• ensure human oversight,
• use the system according to instructions,
• monitor its operation,
• keep logs.

Obligations for high-risk AI systems - quality management system, technical documentation, conformity assessment, risk management - mostly apply from 2 December 2027 (for systems listed in Annex III) and from 2 August 2028 (for AI embedded in regulated products, such as medical devices).

Practical advice for micro-enterprises: if possible, leave the final decision to a human. If AI only suggests, and a human reviews and confirms, the risk profile is significantly reduced.

What Is Limited Risk AI?

Limited risk AI refers to systems that interact with people or generate content, so they are subject to transparency obligations. The main rule is simple: people must know they are interacting with AI or viewing AI-generated content. Examples include:

• Chatbots - the user must understand they are talking to a machine, not a human.
• AI-generated content - Article 50 contains specific duties for generated content, including deepfakes and certain public-interest text; the duty and exceptions depend on the content and role.

This category includes most generative AI tools used daily by small businesses. For example, if you use an AI customer service bot on your website or generate images for marketing, proper labelling is the main requirement. A visible notice may be part of implementation, but whether it is sufficient depends on the applicable Article 50 duty and context.

Transparency obligations for limited risk AI systems applied from 2 August 2026.

What Is Minimal Risk AI?

Minimal risk AI covers the vast majority of everyday tools for which the EU AI Act imposes no mandatory obligations. This includes spelling and grammar checkers, spam filters, recommendation systems, gaming AI, and similar systems that pose little or no risk to people.

Although there are no mandatory requirements, the EU encourages voluntary adherence to codes of conduct. However, there is one exception that applies to everyone - regardless of which risk category your tools fall into.

Does AI Literacy Depend on the Risk Category?

No - the AI literacy requirement (Article 4 of the EU AI Act) applies to all companies using any AI systems, regardless of their risk category. This obligation took effect from 2 February 2025, with supervision and enforcement mechanisms starting from August 2026.

Article 4 states that providers and deployers must take measures to support the development of AI literacy among their staff and other persons involved in the use of the AI system. This means they must consider the knowledge, experience, training, context of use, and the persons who may be affected by the system. There is no requirement to guarantee a specific or sufficient individual level of literacy.

This is often misunderstood. Even if all your AI tools are minimal risk (for example, only ChatGPT for text and DeepL for translations), Article 4 still requires that employees working with AI have an appropriate level of AI literacy. This means they understand how AI works, its limitations, and the risks involved. For more on how the EU AI Act works in simple terms, see our introductory article.

This is why classification is practically important: it helps identify the relevant obligations, including whether additional high-risk requirements need to be assessed.

Importantly: The EU AI Act does not require a specific certificate, a particular document bundle, fixed training hours, an external trainer/auditor, or a dedicated AI officer. Documenting AI use, training your team, and keeping training records are best practices, but they are not a legal minimum or a guarantee that all requirements are met.

How to Determine Which Category Your AI Belongs To?

A practical step-by-step method for micro-enterprises:

1. List all AI tools used by your employees - from ChatGPT to AI features in accounting software. Even “shadow AI” used by employees on their own initiative must be included.
2. Record the purpose of use - not the tool itself, but what it is used for. The same ChatGPT used for text generation and candidate screening represents two completely different risk levels.
3. Check if the purpose falls under bans (unacceptable risk).
4. Check if the purpose is in Annex III (high-risk areas - especially employment).
5. If not - assign to limited or minimal risk based on whether the system interacts with people/generates content.

It is useful to record this information in a suitable form. This is exactly what the AI tool registry is for - a structured document recording all tools, their purposes, and risk categories. This is the foundation for further compliance.

What to Do With the Classification Next?

Correct AI classification is only the beginning. Once you know which category your systems fall into, you can select practical measures such as an AI usage policy, a tools register, an activity record, employee guidance and suitable training. This is a recommended approach, not a universal statutory document bundle.

This documentation often seems daunting for micro-enterprises, but it can be standardised. nebedirbam.lt automatically prepares this entire set of documents for a fixed €149 + VAT (€299) price - policy, registry, compliance record, employee guide, and AI literacy training with knowledge checks and certificates - based on your answers in the questionnaire. Our templates are professionally reviewed, but each generated document is an automated product. If you first want to try the AI literacy training yourself, there are also free AI literacy training courses. The free path is for one signed-in participant; team training is included in the paid documentation package.

To explore the topic further, browse the list of all articles or read about how to properly use popular tools, such as ChatGPT in business. The official regulation text can be found in the EUR-Lex database (eur-lex.europa.eu), Regulation (EU) 2024/1689.

Understanding risk categories is not a bureaucratic formality but a practical tool. It helps avoid wasting time where there are no requirements (minimal risk tools) and focus attention where it truly matters (high-risk use, especially in employment). Start with a simple list of tools, assign each a purpose and category - and most of the work is already done.

Answers to questions about EU AI Act Article 4 and application timelines are based on official European Commission sources: AI Act Service Desk - Article 4 and Regulatory Framework on AI.