The four risk levels in the EU AI Act – where does your use of AI fit?
Short answer
The EU AI Act has four levels. Prohibited AI must not be used (for example emotion recognition in the workplace). High-risk AI (for example recruitment, credit and education) requires human oversight, logs and informing the people affected from 2 December 2027. Limited risk (chatbots and deepfakes) requires you to say that it is AI. Minimal risk (for example drafting text and summaries) only requires AI literacy. The level depends on what the AI is used for – not on the tool.
Try it yourself
Choose a task and see how it is classified:
Approved automatically under your rules. Staff need sufficient AI literacy (Art. 4).
Users must be able to see they are talking to an AI (Art. 50). GoalCube has ready-made wording you can use.
Recruitment is listed in Annex III. A person confirms the use before the AI gets any data, and decides each case (Art. 14 and 26; Art. 22 GDPR).
Emotion recognition in the workplace is prohibited (Art. 5). GoalCube won’t help with it.
The example is simplified. In GoalCube you answer a few questions, and the classification follows fixed rules.
Simplified example. In GoalCube, you answer a few questions, and the classification follows fixed rules.
How GoalCube handles each level
| Level | What it means in GoalCube |
|---|---|
| Prohibited | The use is stopped. GoalCube won’t help with it (Art. 5 AI Act). |
| High risk | A person confirms the use before the AI gets any data, and decides each case about a person (Annex III, Art. 14 and 26 AI Act). |
| Limited risk | Approved automatically under your rules. People must be able to see that they are talking to an AI, or that content was made by AI (Art. 50). |
| Minimal risk | Approved automatically under your rules. Staff need AI literacy (Art. 4). |
The use decides the risk
The same tool can carry different risks. Copilot drafting a newsletter is minimal risk. Copilot ranking employees for a bonus is high-risk. That's why you record each use of AI separately – not each tool.
What about GDPR?
The AI Act risk level says nothing about personal data. A minimal-risk use can still require a data processing agreement (DPA) and a legal basis if the AI sees names and emails.
What to do
- Describe the task, not the tool.ChatGPT can be minimal risk for emails and high-risk for screening applicants.
- Check the bans first.If the use falls under Article 5, it must stop.
- Check Annex III.Recruitment, employment relationships, education, credit, insurance, public benefits and biometrics.
- Check transparency.Do people talk to the AI, or does it create images, audio or video that look real?
- Record the result in your AI inventory.With reasons, so you can show why you classified it the way you did.
What the law says
- Article 5 AI Act – prohibited AI practices
- List of prohibited practices, applicable from 2 February 2025.
- Article 6 and Annex III AI Act – high-risk
- When AI is high-risk, and the exceptions in Article 6(3).
- Article 50 AI Act – transparency
- Chatbots, generative AI, deepfakes and emotion recognition.
Questions and answers
Is ChatGPT high-risk?
No, not in itself. The risk depends on the use. If you use ChatGPT to screen applicants, that use is high-risk.
What if the AI only prepares a case?
Under Article 6(3), an AI system listed in Annex III is not high-risk if it only performs a narrow preparatory task and does not materially influence the outcome. But AI that profiles people is always high-risk.
Who decides the level?
You do – as a deployer, you must be able to explain your assessment. GoalCube uses fixed rules and shows the reasoning.
Sources
Written by The GoalCube editorial team. Last updated 11 October 2026. GoalCube helps you follow the EU AI Act and GDPR. It is not legal advice.
Be among the first.
We expect to launch in November 2026. Join the waitlist and we’ll let you know when you can get started.