Hardware Ready Ready to Bench?
AI Act risk pyramid. Those approaching the AI Act for the first time encounter a diagram that has become almost symbolic: a pyramid divided into four risk levels, also reproduced on the European Union’s official portals. This graphical representation constitutes the classic image of the regulatory framework and is used to explain the underlying logic.
The idea behind it is both simple and ambitious: not all artificial intelligence systems deserve the same treatment. Therefore, rules become stricter in proportion to the increasing potential impact on people. This classification is not a mere technical detail for lawyers; it represents the core around which the entire regulation revolves, as it precisely determines which obligations fall on those who develop a system, those who distribute it, and those who use it.
AI Act risk pyramid: why it matters
Misplacing a product within one of the bands practically results in applying incorrect compliance requirements, submitting insufficient documentation, or preparing controls that were not anticipated. At the base of the risk pyramid are applications considered to be of minimal risk, those that do not require particular precautions and can circulate freely.
Moving up the pyramid, one encounters the band related to transparency. In this case, the main issue is not so much direct harm as the possibility that a person does not understand they are facing artificially generated content or a machine rather than a human being. Here, the primary obligation is informational: making the state of affairs explicit.
The next step is occupied by high-risk systems, the beating heart of the regulation. This category includes areas where an automated decision can significantly impact people’s rights, opportunities, and daily lives. In these cases, the AI Act imposes a series of more substantial compliance requirements, touching on the quality of data used, traceability of the decision-making process, human supervision, and the ability to demonstrate that the system functions as declared.
At the apex of the pyramid is unacceptable risk, the category of prohibited practices. These are not rules to be respected but uses that the European Union has decided to exclude because they are incompatible with the values and fundamental rights protected by the European legal order. This is the most definitive part of the entire regulation, as it provides for no compromises or alternative compliance paths.
What changes and what are the effects
The four-level representation proves effective as a divulgative synthesis, but in practical application, the situation becomes further complicated. Placing a system within a specific band depends on its concrete purpose, context of use, and how it is integrated into broader processes. The same technological tool, if employed in two different sectors, may fall into distinct categories and thus be subject to completely different compliance regimes.
For this reason, the European legislator has provided for the possibility of updating this risk map over time. Further interventions by competent authorities are expected, tasked with clarifying boundaries between different categories, providing precise operational guidelines, and updating lists when technological evolution outpaces the formulation of norms. Those working on artificial intelligence projects therefore find themselves in a position where they must reason in two times: first evaluating the current classification of their system, then considering the possibility that such placement may be refined or modified by subsequent interventions from competent authorities.
Source and further reading on AI Act risk pyramid: original article.
* Content created with the assistance of artificial intelligence systems.