Módulo 4: EU AI Act Deep Dive

8. Mini-proyecto: Risk Classification

Siguiente →

Cerrás el módulo aplicando el framework completo del EU AI Act a un sistema real: produciendo un Risk Classification document.

Este document:

  • Clasifica el sistema en una de las 4 categorías.
  • Lista los requisitos específicos que aplican.
  • Estima compliance effort.
  • Identifies gaps con current state.
  • Provides mitigation roadmap.

Es el primer artifact de Phase 2 de la guía. Combinarás con Privacy Assessment (M3/08) y posteriormente con GDPR Compliance Checklist (M5/08) para forma compliance package completo.

Especificación del entregable

Mínimo viable

  • ✅ Sistema descrito: caracterización completa.
  • ✅ Classification: categoría asignada con justification.
  • ✅ Applicable requirements: list completa.
  • ✅ Current compliance status: gap analysis.
  • ✅ Mitigation plan: actions, owners, timelines.
  • ✅ Decision log: documentation.

Stretch goals

  • ⭐ Implementation: implement at least 1 obligation in code.
  • ⭐ Legal review: get external opinion.
  • ⭐ Deploy plan: integrate compliance into deployment process.
  • ⭐ Cross-reference con GDPR (M5 preview).

Estructura del documento

# Risk Classification: [System Name]

## 1. Executive Summary
- Classification: [Unacceptable / High-Risk / Limited / Minimal]
- Critical findings
- Required actions
- Estimated compliance effort

## 2. System Description
[Detailed]

## 3. Classification Analysis
[Per category, why or why not]

## 4. Applicable Obligations
[Specific list]

## 5. Current Compliance Status
[Gap analysis per obligation]

## 6. Mitigation Plan
[Concrete actions]

## 7. Decision Log
[Authors, reviewers]

Procedimiento

Paso 1: System Description

## 2. System Description

**System name**: [Name]

**Functionality**: [1-2 paragraphs]

**Use case**: [Specific industry/sector]

**Inputs**: [What data]

**Outputs**: [What decisions/recommendations]

**Decision authority**:
- [ ] AI decides directly
- [ ] Human approves AI suggestions
- [ ] Human reviews AI for guidance only

**Stakeholders affected**: [Who is impacted by outputs]

**Geographic scope**: [Where deployed]

**Volume**: [Users/decisions per period]

Paso 2: Classification Analysis

Iterate por las 4 categorías:

a) Check Unacceptable Risk (Art. 5):

### Unacceptable Risk Check

- [ ] Subliminal manipulation? [Yes/No]
- [ ] Exploits vulnerabilities? [Yes/No]
- [ ] Social scoring? [Yes/No]
- [ ] Predictive policing alone profiling? [Yes/No]
- [ ] Untargeted facial recognition scraping? [Yes/No]
- [ ] Workplace/education emotion recognition? [Yes/No]
- [ ] Sensitive biometric categorization? [Yes/No]
- [ ] Real-time public biometric ID? [Yes/No]

**Conclusion**: System [is / is not] in Unacceptable Risk.

If yes: STOP. Do not proceed con deployment.

b) Check High Risk (Annex III + Annex I):

### High-Risk Check (Annex III)

Sectors:
- [ ] Biometric (cuando no prohibited)
- [ ] Critical infrastructure
- [ ] Education / vocational training
- [ ] Employment / worker management
- [ ] Essential services (credit, insurance, etc.)
- [ ] Law enforcement
- [ ] Migration, asylum, border control
- [ ] Justice administration

### High-Risk Check (Annex I)

Products:
- [ ] Medical device with AI safety component
- [ ] Toy with AI safety component
- [ ] Vehicle / aviation with AI safety component
- [ ] Industrial machinery
- [ ] Etc.

### Article 6(3) Exception?

Even if in Annex III area, exception may apply if:
- [ ] Performs narrow procedural task only
- [ ] Improves human-completed activity (no decisions)
- [ ] Detects patterns without intent to influence
- [ ] Performs preparatory task only

**Conclusion**: System [is / is not] High-Risk because [justification].

c) Check Limited Risk (Art. 50):

### Limited Risk Check

- [ ] Chatbot or conversational AI?
- [ ] Generates synthetic media (deepfakes)?
- [ ] Emotion recognition (in permitted contexts)?
- [ ] Biometric categorization (in permitted contexts)?

**Conclusion**: Transparency obligations [apply / do not apply].

d) Default: Minimal Risk:

If none of the above, classification es Minimal Risk.

Paso 3: Applicable Obligations

Based on classification, list obligations:

Si High-Risk:

## 4. Applicable Obligations

### Article 9: Risk Management System
- Required: continuous risk identification y mitigation.
- Status: [Implemented / Partial / Not started]

### Article 10: Data y Data Governance
- Required: documented data sources, quality, bias examination.
- Status: [...]

### Article 11: Technical Documentation
- Required: comprehensive system documentation.
- Status: [...]

### Article 12: Record-Keeping
- Required: automatic logging para traceability.
- Status: [...]

### Article 13: Transparency to Deployers
- Required: instructions, limitations, etc.
- Status: [...]

### Article 14: Human Oversight
- Required: effective human review capability.
- Status: [...]

### Article 15: Accuracy, Robustness, Cybersecurity
- Required: tested, monitored, secured.
- Status: [...]

### Article 43: Conformity Assessment
- Required: prior to deployment.
- Status: [Plan / In progress / Complete]

### Article 49: Registration
- Required: in EU database.
- Status: [...]

Paso 4: Gap Analysis

Para cada obligation:

| Obligation | Required | Current State | Gap | Effort to Close |
|------------|----------|---------------|-----|-----------------|
| Risk management | Continuous process documented | Ad-hoc | Need formal RMS | 4 weeks |
| Data governance | Sources documented, bias examined | Partial (M2 Audit done) | Need full data sources doc | 2 weeks |
| Technical doc | Annex IV requirements met | Code documentation only | Need complete tech doc | 6 weeks |
| Record-keeping | Audit logs sufficient | Some logs, not auditable | Implement structured logs | 3 weeks |
| ... | | | | |

Paso 5: Mitigation Plan

## 6. Mitigation Plan

| # | Action | Priority | Owner | Timeline |
|---|--------|----------|-------|----------|
| 1 | Establish RMS document + process | High | ML Lead | 4 weeks |
| 2 | Complete data sources documentation | High | Data Eng | 2 weeks |
| 3 | Build technical documentation | High | ML Eng + DevOps | 6 weeks |
| 4 | Implement structured audit logs | High | Backend Eng | 3 weeks |
| 5 | Define human oversight workflow | High | Product + ML | 2 weeks |
| 6 | Cybersecurity hardening | Medium | Security Eng | 4 weeks |
| 7 | Submit conformity assessment | High | Compliance Lead | 8 weeks |
| 8 | Register in EU database | High | Compliance | 1 week |

**Total estimated effort**: 4-6 months.
**Dependencies**: items #7-8 require #1-6 complete.

Ejemplo desarrollado: Loan Approval System

Mostraremos parts de un example completo.

Paso 1: System Description

## System Description

**System**: Loan Approval AI

**Functionality**: Predicts probability de loan default y recommends 
approve/deny decision para personal loans ($1K-$50K).

**Use case**: Consumer lending in Spain, with EU-wide expansion planned.

**Inputs**: Application form data (income, employment, credit history, 
demographics).

**Outputs**: 
- Probability score (0-1).
- Decision: approve / deny / manual review.

**Decision authority**: AI decides automatically for clear cases (score < 0.3 
or > 0.7). Manual review for middle range.

**Stakeholders**: Loan applicants (decision recipients), loan officers, 
company.

**Geographic scope**: Spain (EU jurisdiction).

**Volume**: 10K applications/month.

Paso 2: Classification Analysis

## Classification Analysis

### Unacceptable Risk Check
- Subliminal manipulation? No
- Exploits vulnerabilities? No (standard credit scoring)
- Social scoring? No (sector-specific)
- ...

**Conclusion**: NOT Unacceptable Risk.

### High-Risk Check (Annex III)

Annex III §5(b): "AI systems intended to be used to evaluate the creditworthiness 
of natural persons or establish their credit score."

**Match**: Direct application to our system.

### Article 6(3) Exception?

- Narrow procedural task? No (decisions about people).
- Improves human activity? No (replaces human decision in clear cases).
- Pattern detection without influence? No (directly determines outcomes).
- Preparatory task only? No.

**Exception does NOT apply.**

**Conclusion**: HIGH-RISK SYSTEM.

Paso 3: Applicable Obligations

## Applicable Obligations

[Full list of Articles 9-15, 43, 49]

Plus GDPR (covered separately in M5).
Plus FCRA-equivalent national regulations (Spanish law).

Paso 4: Gap Analysis

## Gap Analysis

| Obligation | Status | Gap |
|------------|--------|-----|
| Art 9 RMS | Partial | Need formal documented process |
| Art 10 Data | Done (M2 Bias Audit complete) | Need fuente documentation |
| Art 11 Tech doc | Partial | Need complete Annex IV docs |
| Art 12 Logging | Need structured logs | Implement |
| Art 13 Transparency | Need deployer guide | Build |
| Art 14 Human oversight | Have manual review for middle range | Document workflow |
| Art 15 Accuracy/robust/cyber | Partial | Need cyber hardening |
| Art 43 Conformity | Not started | 8 weeks lead time |
| Art 49 Registration | Not started | 1 week post-conformity |

Paso 5: Mitigation Plan

## Mitigation Plan

[Concrete table with actions, owners, timelines]

**Total estimated**: 6 months hasta full compliance.
**Recommended start**: Immediately. Aug 2026 deadline aproaching.

Cierre del módulo

8 cápsulas

  1. Introducción al módulo.
  2. Unacceptable Risk: prohibitions.
  3. High-Risk categories.
  4. High-Risk obligations.
  5. Limited Risk + transparency.
  6. Minimal Risk + GPAI.
  7. Timelines y penalties.
  8. Mini-proyecto: Risk Classification (esta cápsula).

Lo que tenés ahora

  • Habilidad: clasificar cualquier sistema AI bajo EU AI Act.
  • Knowledge: las 6 obligaciones de high-risk + transparency obligations + GPAI rules.
  • Planning capability: timelines + penalties + budget estimation.
  • Document deliverable: Risk Classification reusable.

Lo que cambió en vos

Antes:

  • "EU AI Act es regulation."

Después:

  • "EU AI Act es framework con 4 categorías de risk-based requirements. Mi sistema es [classification], applicable obligations son [list], current state has [gaps], plan to close them is [actions]."

Concrete. Specific. Actionable.

Empezamos en el siguiente módulo

Módulo 5: GDPR for AI Systems.

GDPR es el complement de EU AI Act:

  • EU AI Act: clasifica AI systems, defines obligations structurally.
  • GDPR: defines obligations sobre personal data específicamente.

Both apply simultaneously. M5 cubre GDPR aplicado a AI:

  • Lawful basis for AI processing.
  • DPIA (Data Protection Impact Assessment).
  • Right to explanation (Art. 22).
  • International data transfers.
  • Cross-references con EU AI Act obligations.

Tu Privacy Assessment (M3/08) + Risk Classification (este módulo M4/08) son inputs directos.

Recursos para el ejercicio

  1. EU AI Act — Full Text — referencia.
  2. Risk Classification Tool (community) — interactive aid.
  3. Conformity Assessment Bodies — list of notified bodies.

Cápsula 08 de 08 — Módulo 4 — AI Ethics & Compliance Guide

Fin del módulo 4. Continúa con el módulo 5 (GDPR for AI Systems).

← Anterior7. Timelines y PenaltiesSiguiente →Introducción a GDPR for AI Systems