Skip to content
Book a consultation

EU AI Act: Risk Classification of AI

EU AI Act: Risk Classification of AI in practice

Regulation (EU) 2024/1689 is not only for those who build artificial intelligence. It also covers a company that buys a ready-made tool from a US vendor and deploys it in-house. What matters is the purpose. The same chatbot carries transparency duties in customer support, yet used as a decision-making tool in recruitment it may be a high-risk system.

For every system we begin with a classification analysis. It shows whether the use is a prohibited practice, a high-risk system, AI with transparency obligations or other AI. Based on the result, we prepare a step-by-step plan and an internal policy. We also review your contracts with vendors so it is clear which duties sit with the provider and which with you as the deployer.

What we help with

  • Classification of an AI system by risk category
  • Step-by-step plan towards AI Act compliance
  • Internal policy on risk management and human oversight
  • Review of AI vendor contracts and allocation of duties
  • Link to the DPIA and Article 22 GDPR
  • Contract clauses on liability for damage caused by AI

Worth knowing

Prohibited practices already apply

The bans under Article 5 have applied since 2 February 2025. They include, for example, subliminal manipulation, emotion recognition at work and in schools (with exceptions) and untargeted scraping of facial images from the internet.

A chatbot must say it is AI

Under Article 50, people must be told they are interacting with AI unless this is obvious from the context. Deepfakes and other synthetic content must be labelled as AI-generated.

General-purpose AI models

Obligations for providers of general-purpose AI models (GPAI), such as large language models, have applied since 2 August 2025. They include technical documentation, respect for copyright in training and a published summary of the training data.

Provider and deployer

A provider develops an AI system or places it on the market under its own name and carries the wider set of duties. A deployer uses the system under its own control and is mainly responsible for human oversight, informing affected people and keeping records.

Common questions

  • Article 5 bans, for example, social scoring, manipulative subliminal techniques, exploiting people's vulnerabilities and mass scraping of faces to build biometric databases. Emotion recognition at work and in education is also banned, with narrow exceptions.

  • Generative AI usually falls among systems with transparency duties under Article 50, and its outputs should be marked in a machine-readable way. The underlying models are also general-purpose AI models, whose providers have their own obligations.

  • Penalties are laid down in Article 99 and depend on how serious the breach is. The strictest apply to prohibited practices. They are set as a share of worldwide annual turnover or a fixed amount, and may be proportionately lower for small and medium-sized businesses.

Related articles

Articles are in Slovak.

Preparing for the consultation

What to prepare for your consultation

Tick what you already have. You can print the list or save it as a PDF. Your ticks are remembered only in your browser.

For every matter

Also for this area

0 of 8 ready

Discuss your matter with a lawyer

In a consultation we assess your situation, suggest a way forward and tell you what costs to expect.

€90 incl. VAT, 30 minutes, in person or online

This page is for general information, reflects Slovak law at the time of writing and is not a substitute for advice on your particular matter.