The risk levels
Prohibited
Banned outright: manipulation, exploitation of vulnerabilities, social scoring, crime prediction by profiling, face scraping, emotion recognition at work or school, sensitive biometric categorisation, most real-time public biometric identification, and (from 2 December 2026) AI generating non-consensual intimate images or child abuse material.
High-risk
Allowed with strict requirements: risk management, data governance, documentation, logs, transparency, human oversight, accuracy and security, quality management, conformity assessment, CE marking, registration, monitoring and incident reporting. Annex I products and the eight Annex III areas.
Transparency risk
Allowed with disclosure: chatbots must say they are AI, generated content must be marked, deep fakes and emotion recognition disclosed.
Minimal risk
Most AI (spam filters, games, recommendations). No specific obligations beyond AI literacy, with voluntary codes of conduct encouraged.
General-purpose AI models
Documentation, downstream information, copyright policy and training summary for all; evaluation, risk mitigation, incident reporting and cybersecurity for systemic-risk models.
Plain-English summary by sebbi.pro of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. The official text is the only authoritative version: EUR-Lex.