Is Your AI Tool High-Risk Under European Law? How to Decide
The EU AI Act introduces strict obligations for high-risk AI systems, but many SMEs are unsure whether their tools fall into that category.
By Laurent Maréchal · · 5 min read
Since the EU AI Act began its phased entry into application, one question comes up consistently during the diagnostic assessments we conduct with Belgian and French SMEs: "What exactly does our AI tool have to comply with?" The honest answer is: it depends. Not on what the tool does on the surface, but on how you use it, the sector in which you operate, and the decisions it influences. Here is a clear method for reaching a conclusion without getting lost in legal texts.
What the EU AI Act Actually Says About Risk Levels
The European regulation classifies AI systems into four broad categories: unacceptable risk (prohibited), high risk (strictly regulated), limited risk (transparency obligations), and minimal risk (largely unrestricted). The vast majority of SMEs do not touch the prohibited category. However, the boundary between high risk and limited risk is far less obvious than it might appear.
A high-risk system, according to the text, is a system used in sensitive domains listed in the annexes: recruitment and HR management, access to credit, academic assessment, infrastructure security, migration management, and the administration of justice. If your AI tool is involved in any of these contexts to make or influence a decision that affects a natural person, you are potentially in the regulatory red zone.
The Three Questions to Ask Yourself First
Rather than reading the entire regulation, start with three simple questions:
1. Who is affected by the decision?
If the output of your AI directly influences an individual's situation — a job applicant, a customer requesting credit, a student being assessed — the level of vigilance rises automatically. A tool that classifies invoices or summarises internal meetings does not produce this type of impact.
2. In which sector does this tool operate?
Annex III of the regulation lists the sensitive sectors. If your core activity touches employment, financial services, education, or healthcare, and your AI tool plays a decision-making role within it, a high-risk classification is likely.
3. Does a human remain in the loop?
A tool that suggests without deciding is not automatically high-risk. But if in practice the AI's recommendation is followed without critical review, the regulator may consider that human oversight is fictitious. This point is frequently underestimated in SMEs where teams trust the tool without any formal validation procedure.
Real-World Cases That Surprise Business Leaders
Several common situations deserve particular attention. A CV-screening application connected to an automatic scoring model? High-risk HR. A customer service chatbot that answers general questions about your products? Limited risk, with transparency obligations sufficient. A solvency analysis tool integrated into your CRM to qualify leads? Potentially high-risk depending on how it is used within the commercial decision-making process.
What often surprises business leaders is that the classification does not depend on the tool's commercial name or on what the supplier's product sheet says. It depends on your actual use within your specific business context. The same language model can be minimal-risk in one company and high-risk in another.
For SMEs that want to make sure they are compliant on this point, Audityo offers specialist EU AI Act compliance support for SMEs, with a pragmatic approach tailored to organisations that do not have an in-house AI legal expert.
What a High-Risk Classification Actually Entails
If your tool falls into this category, the obligations are concrete and non-negotiable. You must, among other things: document the system in a technical register, put in place effective and traceable human supervision, assess risks before deployment, guarantee the quality and representativeness of the data used, and ensure transparency towards the individuals concerned.
These obligations apply to you as a professional user (what the regulation calls the "deployer"), even if you did not develop the tool yourself. Purchasing a turnkey solution does not exempt you from responsibility for the way in which you use it.
To structure this compliance process without starting from scratch, our page on AI solutions for SMEs details the approaches we implement according to the identified risk level.
Where to Start If You Have Not Yet Taken Stock
The first step is to draw up an inventory of all the AI tools active within your company — including those used informally by certain teams. Many SMEs discover during an AI Diagnostic that they are using far more automated systems than they realised: commercial scoring, sentiment analysis on customer reviews, automatic generation of publicly distributed content, HR planning tools.
Once the inventory is complete, each tool is filtered through the three questions mentioned above. The result is a simple map with three columns: tool, actual use, probable risk level. From there, you know where to focus your compliance efforts.
If your activity includes audio communication or AI-generated content distributed as voice, note that transparency about the artificial origin of the content is an obligation from the limited-risk level onwards. Players such as Distr Action, specialists in radio spot production, voice-over and sound design, already incorporate these requirements into their production process for their clients.
What This Process Changes for Your Business
Beyond regulatory compliance, correctly classifying your AI tools has a useful side effect: it forces a reflection on the quality of your decision-making processes. Who validates what? On what basis? With what traceability? These are questions that many SMEs were not asking themselves before the regulation compelled them to do so. The result: better-documented processes, improved management of operational risks, and a stronger position when facing clients or partners who are beginning to request guarantees regarding AI use.
Compliance is not just another administrative burden. It is an opportunity to bring order to practices that have often developed rapidly, without a clear framework. SMEs that tackle this now will have a head start over those that wait for a formal notice.
Conclusion
Classifying the risk level of your AI systems is not an exercise reserved for large companies with dedicated legal teams. It is an accessible process, provided you start from the right questions and have a clear picture of your actual uses. If you want to address this seriously, without spending weeks on it, start with a complimentary, no-obligation thirty-minute discovery call: book your AI audit at ainspiration.eu and leave with an initial map of your tools and their risk level.