Risk levels under the EU AI Act

Every AI system the company runs needs a risk level: it decides how much the law asks, and how closely the company reviews it. This chapter tests two ways to get that level from a model, and shows why the answer to keep is the facts behind it, not the label.

The source is Lab 17 (Governance), script 02_risk_levels.py, recorded in October 2026; the video uses that run, no new calls. Every level is a recorded call to gpt-5.4-nano or gpt-5.4-mini; this chapter follows the bigger one, gpt-5.4-mini, like the video. The 40 use cases are made up and labeled by hand, and the company, Lantern Outfitters, is made up too. It's a teaching implementation of the EU AI Act as amended in 2026, not legal advice. Chapter 49 built the list of the company's 16 AI systems; this chapter sorts it by risk.

Four levels

The EU AI Act puts every AI use into one of four levels. The use decides, not the model: the same model can screen job applicants or filter spam. Think of food rules:

Two rules sit on top:

• The strictest level that fits is the label, and the lighter duties still apply. A chatbot that screens job applicants is high-risk, and must still say it's an AI.
• A small helper task in a high-risk area can be exempt (Art. 6(3)): a narrow procedural task, improving work a person already finished, spotting patterns without replacing a person's review, or preparatory work. Turning CVs into a table without ranking anyone isn't high-risk. The exception never applies if the system profiles people.

Two ways to ask

To find out which method gets the level right, the lab wrote 40 short use cases and labeled each by hand with its level and the article behind it: 9 prohibited, 14 high-risk, 7 limited and 10 minimal, 3 of those minimal because of the helper-task exception. Some sit on purpose near a line: emotion recognition at work (banned) against in a call center with customers (high-risk).

1. Ask for the level. Give the model a summary of the Act's levels and ask for one, with a reason.
2. Ask for the facts, let code decide. Give it the same summary and ask seven short questions instead, most of them yes or no: Is this a banned practice? Is it in a high-risk area? Is it only a helper task? Does it profile people? Does it talk with people? Does it generate content? Does it read emotions or sort people by body traits? Then a few lines of code apply the rules in order, like a tax form:

# risk.py
def decide(a: dict) -> tuple[str, str]:
    """The Act's order: Art. 5, then Annex III with Art. 6(3), then Art. 50."""
    p = str(a.get("prohibited_practice", "none")).lower()
    if p in PROHIBITED:
        return "prohibited", f"Art. 5(1)({p}) {PROHIBITED[p]}"
    area = a.get("annex_iii_area", "none")
    if area in AREAS and area != "none":
        exc = a.get("exception", "none")
        if exc == "none" or exc not in EXCEPTIONS or a.get("profiles_people"):
            return "high", f"Annex III, {area}" + (" (profiles people: no exception)" if exc != "none" else "")
        return_basis = f"Art. 6(3) {exc}, Annex III {area}"
        if a.get("interacts_with_people") or a.get("generates_synthetic_content"):
            return "limited", return_basis + "; Art. 50"
        return "minimal", return_basis
    if a.get("interacts_with_people") or a.get("generates_synthetic_content") or a.get("emotion_or_biometric_categorisation"):
        return "limited", "Art. 50"
    return "minimal", "none"

The model describes; the rule decides. Pick a use case, see both answers, and change any of the facts to watch the level move:

Ask for the level: 36 of 40

Asked for the level, gpt-5.4-mini got 36 of the 40 right. Its four misses:

• Three systems that talk with people, called minimal: a shop's customer chat, a phone voice assistant that books restaurant tables, and an internal assistant for the expense policy. A system that talks with people must say it's an AI, unless that's obvious, so all three are limited.
• The CV-to-table tool, called high-risk: it saw the employment area and missed the exception.

Three of the four misses are too low, the costly direction: a level that's too low skips duties the law requires, while one that's too high only costs an extra review.

Facts, then rules: 39 of 40

With the seven questions and the rules in code, the same model got 39 of 40. It costs more, about half as much again: $0.70 per 1,000 use cases against $0.49.

Its one miss was the call center that reads customers' emotions from their voices. That's high-risk (Annex III 1(c): emotion recognition, not at work or school, so not banned). It marked it limited, and you can see exactly why: it answered "is this in a high-risk area?" with none. Correct that one fact to "biometrics" in the widget above and the level is right.

The full table, first try of three:

The ranges are 95% intervals: with only 40 cases, each rate could easily be several points off.

Careful with the comparison. For gpt-5.4-mini, the two methods disagreed on only 5 cases. On 4, only the facts were right; on 1, only asking was. Even if both methods were equally good, a split this uneven would happen about three times in eight (McNemar p = 0.375). This test can't prove facts-then-rules is more accurate.

The bigger reason to use it: a lawyer can disagree with one fact, and you fix that fact. With a bare label, there's nothing to check. And when the law changes, as it did in 2026, you change the rule in one place instead of re-asking a model about every system.

Our sixteen systems

Back to the company. The lab ran facts-then-rules on each of its 16 systems twice, from two kinds of description:

• Drafted by an AI from each project's technical notes. Those notes describe tests and experiments, not how the system is used. 15 of 16 came out minimal, and only 5 of 16 matched our own labels.
• One plain line per system, the way its owner would describe it at work. For example, the refund agent: "A customer support chat agent that looks up orders and issues refunds and cancellations up to $200 on its own; larger refunds go to a person." 13 of 16 matched.

The two descriptions gave different levels for 8 of 16 systems, the refund agent among them: minimal from the notes, limited from the owner's line. Switch between the two and click any system to read what it was classified from:

The three it still missed from the owner's lines all talk to people, and it said they don't: the internal Q&A service, the employee assistant, and the refund agent with fallbacks. And one match was right for the wrong reason: the email assistant got limited, but its stored answers put it in the employment area as a helper task. It reads and sends an employee's email; it makes no decisions about workers at all. You only see that because the answers are stored.

The law's level and our own tier

By our reading of the law, none of the 16 is high-risk. That doesn't mean they all get a light review. The law asks what a system is used for. The company also asks: how bad is its worst credible failure, how likely is it, and can it be undone? The lab's tier is a small risk matrix:

# risk.py
def internal_tier(severity: int, likelihood: int, reversible: bool, affects_people: bool) -> str:
    """severity and likelihood 1–4. Irreversible harm and harm to specific people raise the tier:
    a wrong answer someone can ignore isn't a refund someone can't undo."""
    score = severity * likelihood + (0 if reversible else 4) + (2 if affects_people else 0)
    return "critical" if score >= 16 else "high" if score >= 10 else "medium" if score >= 5 else "low"

• The three refund agents: high. Severity 3 × likelihood 2, +4 because a refund paid out can't be taken back, +2 because it harms a specific customer: 12.
• The email assistant: high. 3 × 2 + 4: 10. A sent email can't be unsent.
• The ticket triage model and the HR documents assistant: medium. Everything else is low.

The law's level is the minimum. Our own tier sets how closely the company reviews. The inputs are judgment calls, so they go in the registry with the tier: someone can disagree with "likelihood 2" the same way a lawyer can disagree with a fact.

Also in the lab

From Lab 17's README and result file, not all in the video:

• The smaller model. gpt-5.4-nano got 31 of 40 asked for the level and 36 of 40 with the facts, at $0.14 and $0.19 per 1,000.
• Repeat runs. Each method ran each case three times. With gpt-5.4-mini, asking changed its level on 3 of 40 cases across the tries; the facts method on 1 of 40.
• Right level, different exception. On the CV-to-table case, facts-then-rules said "preparatory task" where our label says "narrow procedural task". Both exceptions give minimal; the stored answer shows the difference, a bare label wouldn't.
• A bug the lab found in its own data. Its first run classified the AI-drafted descriptions only, and once called the HR documents assistant high-risk under "employment", because the description listed policy rules about employment decisions. That's why Exercise 2 now classifies both descriptions.
• Dates. As amended by the Digital Omnibus (Regulation (EU) 2026/1744), bans have applied since 2 February 2025, the duty to tell people since 2 August 2026, and the high-risk rules for Annex III areas apply from 2 December 2027. Laws change; the lab keeps the rules in one function, risk.decide(), so a change goes in one place.

What to do

• Store the facts, not just the level. The registry keeps the answers to the questions and the rule that turned them into a level.
• Classify from how the system is used. Have each owner write one plain line about who uses it and what it does, and classify that, not the technical notes.
• Check "does it talk with people?" by hand. It was the fact behind most misses, by both methods.
• Give every system two levels: the law's, and the company's own tier, with the tier's inputs written down.
• Let a lawyer review the facts, not the label, especially near a line: emotion recognition, helper-task exceptions, and anything that profiles people.

Caveats

• Not legal advice. The use cases and labels are a teaching set; our reading of the Act, as amended in 2026. A lawyer may read a few differently, and the labels say which article was applied.
• 40 cases, 16 systems. The intervals are wide, and 36 against 39 could be chance.
• One provider's models, one run. Other models, or a different summary of the Act, would make different mistakes.
• The tier's inputs are judgment. Severity and likelihood were set by the lab, as an owner would; another team might pick other numbers.
• The company's systems are labs. Lantern Outfitters' 16 systems are this course's labs, described as if they were in use.

The checklist

1. Every system has a recorded level and its basis (the article or Annex point).
2. The facts behind the level are stored, and can be corrected one at a time.
3. The description classified is the owner's, written about the system in use.
4. Anything that talks with people is at least limited, and says it's an AI.
5. Every system has an internal tier with its severity, likelihood and reversibility written down.
6. The rules live in one place, so a change in the law is a change to one function.
7. A person reviews cases near a line before the level goes in the registry.

Practice: facts, then rules

Write the Act's rules in code, score both methods, run the paired test, and set the company's tier. The tests use the 40 hand-labeled use cases, gpt-5.4-mini's recorded level and its seven answers for each, and the 16 systems' tier inputs, and expect the lab's numbers: 39 and 36 right, 1 and 3 too low, a 4-to-1 split with p = 0.375, and four systems at tier high.

Quiz

Check your understanding

Try each question before opening its answer.

Next up: Chapter 51 is the launch checklist: what a system must have before it ships, and whether that checklist would have caught real AI failures.