AI Act risk tiers
Four-tier classification that drives every obligation in the European AI regulation, from outright prohibition to no obligation at all, with a separate regime for general-purpose models.
Regulation (EU) 2024/1689 of June 13, 2024 on artificial intelligence, published in the EU Official Journal on July 12, 2024, sorts AI systems by the use made of them, and that classification drives everything else. Four tiers follow one another. Unacceptable risk is prohibited, with no commercial derogation available. High risk is permitted under heavy conditions: risk management system, data governance, technical documentation, logging, transparency toward the deployer, human oversight, accuracy and resilience, conformity assessment and registration in a European database. Limited risk calls only for transparency obligations: disclose that the user is talking to a machine, label generated content. Minimal risk calls for nothing. A fifth, cross-cutting regime targets general-purpose models, with reinforced obligations above a compute threshold. For insurance the decisive point fits in one line: AI systems intended for risk assessment and pricing in life and health insurance are classified as high risk, which drops a pricing engine into the most demanding regime.
Regulation (EU) 2024/1689, in force since August 1, 2024. Prohibitions and the AI literacy obligation have applied since February 2, 2025, general-purpose model obligations since August 2, 2025, and those on Annex III high-risk systems from August 2, 2026. A European health insurer running a pricing engine built on a learning model therefore enters the high-risk regime at that last date, and the compliance runway is measured in quarters, not weeks.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.