Risk levels: prohibited, high, limited and minimal risk
Short answer
GoalCube gives each use of AI one of four levels, based on fixed rules and your answers: prohibited (stopped), high risk (a person confirms the use and decides every case), limited risk and minimal risk (approved automatically under your rules). High risk includes recruitment and decisions on employment (AI Act Annex III). Decisions about people always need a person (Article 22 GDPR).
The four levels
| Level | What it means in GoalCube |
|---|---|
| Prohibited | The use is stopped. GoalCube won’t help with it (Art. 5 AI Act). |
| High risk | A person confirms the use before the AI gets any data, and decides each case about a person (Annex III, Art. 14 and 26 AI Act). |
| Limited risk | Approved automatically under your rules. People must be able to see that they are talking to an AI, or that content was made by AI (Art. 50). |
| Minimal risk | Approved automatically under your rules. Staff need AI literacy (Art. 4). |
Prohibited use of AI
| Prohibited practice |
|---|
| Emotion recognition in the workplace or in education |
| Social scoring of people |
| Biometric categorisation by, for example, race, political opinion, religion or sexuality |
| Manipulation or exploitation of vulnerabilities that can harm people |
High-risk areas
| High-risk area (Annex III AI Act) |
|---|
| Recruitment and selection of people |
| Decisions about employment (for example promotion, terms, dismissal, task allocation, evaluation) |
| Education (access, assessment, exam monitoring) |
| Credit scoring, or pricing of life and health insurance |
| Access to public services |
| Biometric identification or categorisation |
| Safety in critical infrastructure |
If the AI is only used for a narrow, preparatory task without profiling, the use may be exempt from high risk. GoalCube asks about this when the use is recorded.
Decisions about people
Whatever the level, a decision that significantly affects a person needs a person (Article 22 GDPR). That is why use with decisions about people is never approved automatically.
The classification is simplified and is not legal advice. The rules have a version; see When GoalCube's rules change.