Phase 7: AI Governance, Compliance & Risk · 55 min · EU AI Act · Python

EU AI Act

The Act doesn't regulate 'AI' — it regulates specific use cases, and the tier is decided by what the system does, not what it's built with.

Hiring signal: AI Governance & Compliance Engineer roles explicitly list EU AI Act risk classification as a required skill, and any company shipping AI to EU users needs someone who can look at a feature spec and say, with the actual Article/Annex cited, which tier it falls into and what obligations follow — before legal has to get involved.

What you will learn

Classify an AI system into the Act's four risk tiers using its actual criteria: Article 5 prohibited practices, Annex III high-risk domains, transparency-obligation use cases
Distinguish the risk-tier system from the separate GPAI (general-purpose AI model) obligations track
Enumerate the concrete obligations attached to each risk tier: conformity assessment, technical documentation, human oversight, transparency disclosures
Identify which obligations apply to a downstream application versus the upstream foundation model it's built on

The Problem

A product manager pings you: "Legal wants to know if the new resume-screening feature is 'high risk' under the EU AI Act." The honest answer at most companies is: nobody knows, because nobody has actually read Annex III, and the question gets forwarded to outside counsel who bills by the hour to answer something that a five-minute structured lookup should have caught in the design review.

This is the recurring failure mode with the EU AI Act: engineering teams either ignore it entirely (risky — it's not optional, and fines run up to the greater of €35 million or 7% of global annual turnover for the most serious violations) or treat every AI feature as a legal black box requiring outside counsel (slow and expensive). Neither is necessary. The Act's classification logic is genuinely mechanical for most cases — you can build a checklist that gets you 90% of the way to the right answer, and know precisely when the remaining 10% actually needs a lawyer.

The core thing to internalize: the Act classifies by use case, not by technology. Using an LLM doesn't make something high risk. Using a simple logistic regression model to screen job applicants does — because the risk is about the consequence to a person (losing access to employment), not the sophistication of the model producing it.

The Four Risk Tiers

Tier	What triggers it	Compliance path
Unacceptable	Article 5 prohibited practices: social scoring by public authorities, real-time remote biometric ID in public spaces for law enforcement (narrow exceptions), subliminal/manipulative techniques causing harm, exploiting vulnerabilities of specific groups, untargeted facial-recognition scraping, predictive policing based solely on profiling	None — cannot be placed on the market or used in the EU
High	Annex III use-case domains: biometric ID, critical infrastructure, education/vocational training, employment/worker management, essential private/public services (credit, insurance, benefits), law enforcement, migration/asylum/border control, justice/democratic processes	Risk management system, data governance, technical documentation, logging, human oversight, conformity assessment, CE marking, EU database registration, post-market monitoring
Limited	Transparency-obligation use cases: chatbots/conversational AI, synthetic or deepfake content generation, emotion recognition or biometric categorization	Disclose AI interaction to users; label synthetic content; disclose emotion-recognition/biometric-categorization use
Minimal	Everything else	No mandatory obligations beyond existing law; voluntary codes of conduct encouraged

Notice the ordering matters: check for prohibited practices first — if a system is prohibited, its tier is settled regardless of what domain it operates in. Then check Annex III domain membership. Only if neither applies do you check for transparency triggers. A system can look superficially like a "chatbot" (limited risk) but actually be doing employment screening (high risk) — the domain check has to win.

GPAI obligations are a separate track, not a fifth tier
General-purpose AI model providers — the companies building foundation models other companies build on top of — have their own obligation set that applies regardless of what any downstream application does with the model: technical documentation, a training-data content summary, and a copyright-compliance policy for every GPAI model, plus adversarial testing, systemic-risk mitigation, and incident reporting for models above a compute threshold or designated by the Commission as carrying systemic risk. These obligations become fully applicable in August 2026. A minimal-risk internal tool can be built on a GPAI model that itself carries systemic-risk obligations — always check both axes, not just the application-level tier.

A team is building a feature that uses an LLM to draft personalized responses to loan applicants, including automated approve/deny recommendations that loan officers can override but rarely do in practice. What risk tier applies, and why?

Credit and access to essential services is an Annex III high-risk domain — the classification is driven by the use case (deciding who gets credit) not by whether a human is nominally in the loop. A human-override option that's rarely exercised in practice is a documentation problem for the human-oversight requirement, not a reason to reclassify the system as lower risk; regulators and auditors specifically look for 'rubber stamp' oversight as a red flag. It's not unacceptable risk — social scoring by public authorities is a distinct, narrower prohibited practice under Article 5 and doesn't cover private credit decisions.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Turning Annex III Into a Classifier, Build It, What to Practice — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.