EU AI Act Risk Classification & Penalty Exposure Calculator

EU AI Act Risk Tiers: Which Category Is Your AI System (and What It Costs)

The EU AI Act is the world's first comprehensive AI law, and its fines go up to €35 million or 7% of global turnover — higher than GDPR. But the law does not treat all AI equally. It sorts systems into four risk tiers: unacceptable (banned), high-risk (heavily regulated), limited-risk (transparency duties), and minimal-risk (largely free). Most companies building AI products have no idea which tier they fall into, and the tier determines everything: whether you need conformity assessments, human oversight, training-data documentation, or whether your product is simply illegal to deploy in the EU.

The banned list is shorter than people fear but broader than they expect: social scoring by governments, real-time remote biometric identification for law enforcement (with narrow exceptions), emotion recognition in workplaces and schools, and manipulative AI exploiting vulnerabilities. High-risk is where most B2B AI lives — CV screening, credit scoring, medical devices, safety components, biometric verification, and AI used in education, employment, or law enforcement. High-risk obligations are substantial: risk management systems, high-quality training data with bias testing, technical documentation, logging, human oversight, and robustness testing. Compliance costs for a high-risk system typically run €150,000–€400,000 in the first year for a mid-size company, which is why tier classification is the first question, not an afterthought.

The timeline matters because enforcement is phased. Banned practices took effect first, general-purpose AI model obligations followed, and high-risk requirements phase in through 2026–2027. If you are building now, you are building under the law — "we started before it applied" is not a defense for systems deployed after the deadlines. The practical move: classify every AI feature you ship, document the classification reasoning (regulators ask "why did you decide this was limited-risk?"), and for high-risk systems, start the conformity assessment process early — notified-body capacity is the bottleneck nobody talks about. Non-EU companies are not exempt: the Act applies to any system whose output is used in the EU, which in practice means nearly every global AI product.

Penalties scale with the violation, and they are designed to hurt. Up to €35M or 7% of global annual turnover for banned practices; up to €15M or 3% for high-risk violations; up to €7.5M or 1.5% for transparency failures. For context, 7% of turnover exceeds GDPR's 4% — the EU deliberately made AI violations the most expensive compliance failure in tech. SMEs get somewhat reduced fines, but "startup" is not a shield. The auditor maps your system's characteristics against the Act's Annex III high-risk categories and Article 5 prohibitions, estimates your exposure tier, and lists the specific obligations triggered — so the compliance conversation starts from a classified inventory instead of a blank page.