Module 4: EU AI Act Deep Dive

8. Mini-project: Risk Classification

Next →

You close the module by applying the complete EU AI Act framework to a real system: producing a Risk Classification document.

This document:

  • Classifies the system into one of the 4 categories.
  • Lists the specific requirements that apply.
  • Estimates the compliance effort.
  • Identifies the gaps against the current state.
  • Provides a mitigation roadmap.

It's the first artifact of Phase 2 of the guide. You'll combine it with the Privacy Assessment (M3/08) and later with the GDPR Compliance Checklist (M5/08) to form a complete compliance package.

Deliverable spec

Minimum viable

  • ✅ System described: a complete characterization.
  • ✅ Classification: a category assigned with justification.
  • ✅ Applicable requirements: a complete list.
  • ✅ Current compliance status: a gap analysis.
  • ✅ Mitigation plan: actions, owners, timelines.
  • ✅ Decision log: documentation.

Stretch goals

  • ⭐ Implementation: implement at least 1 obligation in code.
  • ⭐ Legal review: get an external opinion.
  • ⭐ Deploy plan: integrate compliance into the deployment process.
  • ⭐ Cross-reference with GDPR (an M5 preview).

Document structure

# Risk Classification: [System Name]

## 1. Executive Summary
- Classification: [Unacceptable / High-Risk / Limited / Minimal]
- Critical findings
- Required actions
- Estimated compliance effort

## 2. System Description
[Detailed]

## 3. Classification Analysis
[Per category, why or why not]

## 4. Applicable Obligations
[Specific list]

## 5. Current Compliance Status
[Gap analysis per obligation]

## 6. Mitigation Plan
[Concrete actions]

## 7. Decision Log
[Authors, reviewers]

Procedure

Step 1: System Description

## 2. System Description

**System name**: [Name]

**Functionality**: [1-2 paragraphs]

**Use case**: [Specific industry/sector]

**Inputs**: [What data]

**Outputs**: [What decisions/recommendations]

**Decision authority**:
- [ ] AI decides directly
- [ ] Human approves AI suggestions
- [ ] Human reviews AI for guidance only

**Stakeholders affected**: [Who is impacted by outputs]

**Geographic scope**: [Where deployed]

**Volume**: [Users/decisions per period]

Step 2: Classification Analysis

Iterate through the 4 categories:

a) Check Unacceptable Risk (Art. 5):

### Unacceptable Risk Check

- [ ] Subliminal manipulation? [Yes/No]
- [ ] Exploits vulnerabilities? [Yes/No]
- [ ] Social scoring? [Yes/No]
- [ ] Predictive policing based on profiling alone? [Yes/No]
- [ ] Untargeted facial recognition scraping? [Yes/No]
- [ ] Workplace/education emotion recognition? [Yes/No]
- [ ] Sensitive biometric categorization? [Yes/No]
- [ ] Real-time public biometric ID? [Yes/No]

**Conclusion**: System [is / is not] in Unacceptable Risk.

If yes: STOP. Do not proceed with deployment.

b) Check High Risk (Annex III + Annex I):

### High-Risk Check (Annex III)

Sectors:
- [ ] Biometric (where not prohibited)
- [ ] Critical infrastructure
- [ ] Education / vocational training
- [ ] Employment / worker management
- [ ] Essential services (credit, insurance, etc.)
- [ ] Law enforcement
- [ ] Migration, asylum, border control
- [ ] Justice administration

### High-Risk Check (Annex I)

Products:
- [ ] Medical device with AI safety component
- [ ] Toy with AI safety component
- [ ] Vehicle / aviation with AI safety component
- [ ] Industrial machinery
- [ ] Etc.

### Article 6(3) Exception?

Even if in an Annex III area, the exception may apply if the system:
- [ ] Performs a narrow procedural task only
- [ ] Improves a human-completed activity (no decisions)
- [ ] Detects patterns without intent to influence
- [ ] Performs a preparatory task only

**Conclusion**: System [is / is not] High-Risk because [justification].

c) Check Limited Risk (Art. 50):

### Limited Risk Check

- [ ] Chatbot or conversational AI?
- [ ] Generates synthetic media (deepfakes)?
- [ ] Emotion recognition (in permitted contexts)?
- [ ] Biometric categorization (in permitted contexts)?

**Conclusion**: Transparency obligations [apply / do not apply].

d) Default: Minimal Risk:

If none of the above, the classification is Minimal Risk.

Step 3: Applicable Obligations

Based on the classification, list the obligations:

If High-Risk:

## 4. Applicable Obligations

### Article 9: Risk Management System
- Required: continuous risk identification and mitigation.
- Status: [Implemented / Partial / Not started]

### Article 10: Data and Data Governance
- Required: documented data sources, quality, bias examination.
- Status: [...]

### Article 11: Technical Documentation
- Required: comprehensive system documentation.
- Status: [...]

### Article 12: Record-Keeping
- Required: automatic logging for traceability.
- Status: [...]

### Article 13: Transparency to Deployers
- Required: instructions, limitations, etc.
- Status: [...]

### Article 14: Human Oversight
- Required: effective human review capability.
- Status: [...]

### Article 15: Accuracy, Robustness, Cybersecurity
- Required: tested, monitored, secured.
- Status: [...]

### Article 43: Conformity Assessment
- Required: prior to deployment.
- Status: [Plan / In progress / Complete]

### Article 49: Registration
- Required: in the EU database.
- Status: [...]

Step 4: Gap Analysis

For each obligation:

| Obligation | Required | Current State | Gap | Effort to Close |
|------------|----------|---------------|-----|-----------------|
| Risk management | Continuous process documented | Ad-hoc | Need formal RMS | 4 weeks |
| Data governance | Sources documented, bias examined | Partial (M2 Audit done) | Need full data sources doc | 2 weeks |
| Technical doc | Annex IV requirements met | Code documentation only | Need complete tech doc | 6 weeks |
| Record-keeping | Audit logs sufficient | Some logs, not auditable | Implement structured logs | 3 weeks |
| ... | | | | |

Step 5: Mitigation Plan

## 6. Mitigation Plan

| # | Action | Priority | Owner | Timeline |
|---|--------|----------|-------|----------|
| 1 | Establish RMS document + process | High | ML Lead | 4 weeks |
| 2 | Complete data sources documentation | High | Data Eng | 2 weeks |
| 3 | Build technical documentation | High | ML Eng + DevOps | 6 weeks |
| 4 | Implement structured audit logs | High | Backend Eng | 3 weeks |
| 5 | Define human oversight workflow | High | Product + ML | 2 weeks |
| 6 | Cybersecurity hardening | Medium | Security Eng | 4 weeks |
| 7 | Submit conformity assessment | High | Compliance Lead | 8 weeks |
| 8 | Register in EU database | High | Compliance | 1 week |

**Total estimated effort**: 4-6 months.
**Dependencies**: items #7-8 require #1-6 complete.

A worked example: Loan Approval System

We'll show parts of a complete example.

Step 1: System Description

## System Description

**System**: Loan Approval AI

**Functionality**: Predicts the probability of loan default and recommends an 
approve/deny decision for personal loans ($1K-$50K).

**Use case**: Consumer lending in Spain, with EU-wide expansion planned.

**Inputs**: Application form data (income, employment, credit history, 
demographics).

**Outputs**: 
- Probability score (0-1).
- Decision: approve / deny / manual review.

**Decision authority**: The AI decides automatically for clear cases (score < 0.3 
or > 0.7). Manual review for the middle range.

**Stakeholders**: Loan applicants (decision recipients), loan officers, 
the company.

**Geographic scope**: Spain (EU jurisdiction).

**Volume**: 10K applications/month.

Step 2: Classification Analysis

## Classification Analysis

### Unacceptable Risk Check
- Subliminal manipulation? No
- Exploits vulnerabilities? No (standard credit scoring)
- Social scoring? No (sector-specific)
- ...

**Conclusion**: NOT Unacceptable Risk.

### High-Risk Check (Annex III)

Annex III §5(b): "AI systems intended to be used to evaluate the creditworthiness 
of natural persons or establish their credit score."

**Match**: A direct application to our system.

### Article 6(3) Exception?

- Narrow procedural task? No (decisions about people).
- Improves human activity? No (replaces the human decision in clear cases).
- Pattern detection without influence? No (it directly determines outcomes).
- Preparatory task only? No.

**The exception does NOT apply.**

**Conclusion**: HIGH-RISK SYSTEM.

Step 3: Applicable Obligations

## Applicable Obligations

[The full list of Articles 9-15, 43, 49]

Plus GDPR (covered separately in M5).
Plus FCRA-equivalent national regulations (Spanish law).

Step 4: Gap Analysis

## Gap Analysis

| Obligation | Status | Gap |
|------------|--------|-----|
| Art 9 RMS | Partial | Need a formal documented process |
| Art 10 Data | Done (M2 Bias Audit complete) | Need source documentation |
| Art 11 Tech doc | Partial | Need complete Annex IV docs |
| Art 12 Logging | Need structured logs | Implement |
| Art 13 Transparency | Need a deployer guide | Build |
| Art 14 Human oversight | Manual review exists for the middle range | Document the workflow |
| Art 15 Accuracy/robust/cyber | Partial | Need cyber hardening |
| Art 43 Conformity | Not started | 8 weeks lead time |
| Art 49 Registration | Not started | 1 week post-conformity |

Step 5: Mitigation Plan

## Mitigation Plan

[A concrete table with actions, owners, timelines]

**Total estimate**: 6 months to full compliance.
**Recommended start**: Immediately. The Aug 2026 deadline is approaching.

Closing the module

8 capsules

  1. Module introduction.
  2. Unacceptable Risk: prohibitions.
  3. High-Risk categories.
  4. High-Risk obligations.
  5. Limited Risk + transparency.
  6. Minimal Risk + GPAI.
  7. Timelines and penalties.
  8. Mini-project: Risk Classification (this capsule).

What you have now

  • A skill: classifying any AI system under the EU AI Act.
  • Knowledge: the 6 high-risk obligations + transparency obligations + GPAI rules.
  • Planning capability: timelines + penalties + budget estimation.
  • A document deliverable: a reusable Risk Classification.

What changed in you

Before:

  • "The EU AI Act is regulation."

After:

  • "The EU AI Act is a framework with 4 categories of risk-based requirements. My system is [classification], the applicable obligations are [list], the current state has [gaps], and the plan to close them is [actions]."

Concrete. Specific. Actionable.

We start in the next module

Module 5: GDPR for AI Systems.

GDPR is the complement to the EU AI Act:

  • The EU AI Act: classifies AI systems, defines obligations structurally.
  • GDPR: defines obligations about personal data specifically.

Both apply simultaneously. M5 covers GDPR applied to AI:

  • The lawful basis for AI processing.
  • The DPIA (Data Protection Impact Assessment).
  • The right to explanation (Art. 22).
  • International data transfers.
  • Cross-references with the EU AI Act obligations.

Your Privacy Assessment (M3/08) + Risk Classification (this module, M4/08) are direct inputs.

Resources for the exercise

  1. EU AI Act — Full Text — the reference.
  2. Risk Classification Tool (community) — an interactive aid.
  3. Conformity Assessment Bodies — the list of notified bodies.

Capsule 08 of 08 — Module 4 — AI Ethics & Compliance Guide

End of module 4. Continue with module 5 (GDPR for AI Systems).

← Previous7. Timelines and PenaltiesNext →Introduction to GDPR for AI Systems