Most companies are misclassifying AI under the EU AI Act
I’m seeing the same mistake across enterprises preparing for the EU AI Act. High-risk classification is being treated as a labeling exercise instead of a governance decision.
Many organizations are asking the wrong first question. They start with “Is this model high-risk?” rather than “How is this system used, and what decisions does it meaningfully influence?” That distinction matters more than most internal teams realize.
Under Article 6 of the EU AI Act, high-risk classification is not triggered by the sophistication of the model or whether it uses generative AI. It is triggered by context. The system’s intended purpose, its reasonably foreseeable use, and its role in decision-making that may affect fundamental rights.
This is where misclassification typically happens.
Consider an internal HR screening tool. Because it is not customer-facing and does not make final hiring decisions, it is often treated as low-risk. But if the system meaningfully influences candidate shortlists or ranking decisions, it may fall squarely within Annex III, regardless of whether a human technically “approves” the final outcome.
Now consider a customer-facing generative AI assistant. Many teams instinctively flag it as high-risk because it interacts directly with users. In practice, if the system does not make or materially influence regulated decisions and operates with appropriate constraints, it may fall outside the high-risk regime altogether.
The most common error is assuming regulators will ultimately decide classification. They won’t. The EU AI Act deliberately places that responsibility on providers and deployers. Organizations are expected to assess, justify, and document their own classification decisions under Article 11, and to stand behind those judgments if challenged later.
Here’s the counterintuitive part. Being overly conservative can actually increase legal exposure. When everything is labeled high-risk, governance resources are diluted, documentation becomes defensive rather than substantive, and truly sensitive systems receive less focused oversight.
High-risk classification under the EU AI Act is a governance act, not a technical checklist. It requires legal judgment, organizational alignment, and a clear understanding of how AI systems operate in real deployment environments.
If you found this useful, subscribe to get new analyses each week.