Minimal-Risk AI: The Tier Most of Your Systems Land In
Most AI is minimal-risk under the EU AI Act — no mandatory obligations beyond Article 4 literacy. What qualifies, what applies, and why to document it.
The loudest parts of the EU AI Act, Regulation (EU) 2024/1689, are about high-risk systems and prohibitions — but the tier that actually covers most AI in most organisations is minimal risk. Spam filters, recommendation engines, inventory forecasting, search, productivity assistants, most analytics: these carry no mandatory AI Act obligations. Knowing what lands here, and documenting it, is how you avoid over-engineering compliance.
What minimal-risk means
The Act sorts AI into prohibited (Article 5), high-risk (Article 6 + Annex III, and Annex I products), limited/transparency (Article 50), and a residual category with no special obligations — minimal risk. A system is minimal-risk when its use is not prohibited, not in Annex III, and not subject to Article 50 transparency. That residual category is large: most business AI does not decide anyone's job, credit, or access to an essential service.
For minimal-risk systems the Act imposes no conformity assessment, no technical documentation, no registration, no transparency duty.
What still applies
Two things. Article 4 AI literacy has applied since 2 February 2025 to all AI, minimal-risk included — staff should understand the tools they use. And codes of conduct (Article 95) are a voluntary route: the Act encourages providers of non-high-risk systems to apply, where appropriate, some high-risk-style practices or other commitments (accessibility, environmental, diversity). Voluntary, not required. And of course, GDPR and other law continue to apply on their own terms.
Why you should still document it
"Minimal-risk" is a conclusion, not an assumption. The value of writing it down — one line per use, with the reason it is not Annex III — is twofold: it stops you wasting effort treating minimal-risk tools as high-risk, and it is the evidence of diligence if a market-surveillance authority asks what AI you run and how you classified it. A use case register is where that conclusion lives.
The boundary cases to re-check
Re-classify when a minimal-risk tool is repurposed: a general assistant pointed at recruitment (Annex III point 4), a chatbot turned customer-facing (Article 50), a model fine-tuned and shipped under your name (provider under Article 25). The tier follows the use, so a change of use can move a system out of the minimal tier.
How Confir helps
Confir records each minimal-risk use with its documented reason — screened against Article 5, Article 6/Annex III, and Article 50 — so the conclusion is defensible rather than assumed, and it raises a flag the moment a use drifts toward a higher tier. The engine is deterministic and rule-based: the same inputs always yield the same cited finding.
Frequently asked questions
What is minimal-risk AI under the EU AI Act?
It is the residual tier for AI whose use is not prohibited, not in Annex III, and not subject to Article 50 transparency. Most business AI — spam filters, recommendations, forecasting, search, productivity tools — sits here. The Act imposes no conformity, documentation, registration or transparency obligations on minimal-risk systems.
Do minimal-risk systems have any obligations?
Only Article 4 AI literacy, which applies to all AI since 2 February 2025, plus voluntary codes of conduct under Article 95. GDPR and other law still apply on their own terms. There is no high-risk stack and no transparency duty for minimal-risk use.
Why document a system as minimal-risk?
Because minimal-risk is a conclusion, not an assumption. Recording each use with the reason it is not Annex III prevents over-scoping and provides evidence of diligence if an authority asks how you classified your AI. A use case register is where that lives.
Can a minimal-risk system become higher-risk?
Yes, if its use changes. Repurposing a general tool for recruitment (Annex III), turning a chatbot customer-facing (Article 50), or fine-tuning and rebranding a model (provider under Article 25) can move a system out of the minimal tier. Re-classify on material change.
Are recommendation engines and spam filters minimal-risk?
Generally yes, when they are not used for an Annex III purpose. Recommendation, filtering, forecasting and search do not by themselves decide a person's job, credit or access to an essential service, so they typically sit in the minimal-risk tier — but classify each on its actual use.
Related guides
- How AI risk classification works
- Limited-risk AI: examples and duties
- Article 4 AI literacy
- The AI use case register
- How Article 6 classifies high-risk AI
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →