Limited-Risk AI Under the EU AI Act: Definition and Duties
Limited-risk AI under the EU AI Act means transparency duties under Article 50 — disclosure, not a heavy regime. Definition, examples, and dates.
Limited-risk AI is AI that is neither prohibited nor high-risk, but that carries transparency duties under Article 50 of the EU AI Act (Regulation (EU) 2024/1689). The defining idea is disclosure, not a heavy compliance regime: people should know when they are dealing with a machine or with synthetic content. There is no conformity assessment, no technical-documentation pack, no risk-management system. There is a duty to tell the truth about what the AI is.
It helps to place limited-risk on the Act's four-tier ladder. Unacceptable-risk practices are banned outright (Article 5). High-risk systems (Article 6, Annex III) carry the full weight of the Act. Limited-risk systems carry only the Article 50 transparency obligations. Minimal-risk systems — the large majority of AI in everyday business use — carry no mandatory obligations at all. Limited-risk is the lightest of the regimes that actually impose a duty.
What Article 50 Actually Requires
"Limited-risk" is not a phrase that appears in the Regulation's text — it is the practitioner label for the systems caught by Article 50. Four duties matter:
| Article 50 duty | Who it falls on | What it requires |
|---|---|---|
| 50(1) — AI interaction | Provider designing the system | People must be told when they are interacting with an AI system (e.g. a chatbot), unless it is obvious |
| 50(2) — synthetic content marking | Provider | Outputs of AI generating synthetic audio, image, video, or text must be marked in a machine-readable format and detectable as artificially generated |
| 50(3) — emotion / biometric categorisation notice | Deployer | People exposed to an emotion-recognition or biometric-categorisation system (where lawful) must be informed |
| 50(4) — deepfakes and public-interest text | Deployer | Deepfake image/audio/video must be disclosed as artificially generated; AI-generated text published to inform the public on matters of public interest must be disclosed |
These are disclosure obligations. A chatbot needs a line saying it is a bot. AI-generated content needs a label. An emotion-recognition demo needs a notice. None of this requires a notified body, a CE mark, or an EU database registration — those belong to the high-risk tier.
One important boundary: emotion recognition in the workplace and in education is not limited-risk — it is prohibited under Article 5(1)(f). Article 50(3)'s notice duty applies only where emotion recognition or biometric categorisation is otherwise lawful. Do not treat a banned practice as a transparency case.
When the Transparency Duties Apply
Article 50 has applied since 2 August 2026, the date of the Act's general application — not the high-risk deadline. That includes the Article 50(2) content-marking duty; only generative systems already on the market before 2 August 2026 have until 2 December 2026 (Article 111(4)).
A note on the wider deadlines, because confusion here is common: the high-risk regime is deferred to 2 December 2027 (stand-alone Annex III) and 2 August 2028 (product-embedded) under the Digital Omnibus, which is now law — Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force since 27 July 2026. The Article 50 transparency dates, however, are part of the general-application schedule and were not deferred. If you operate a chatbot or generate synthetic content, treat 2 August 2026 as a date that has already passed (2 December 2026 for marking by generative systems already on the market).
Limited-Risk vs Minimal-Risk vs High-Risk
The line that trips people up is limited-risk versus minimal-risk, because both are "low" tiers — but only one carries a duty.
- Minimal-risk: no mandatory obligations. A spam filter, an inventory-forecasting model, a recommendation engine that does not interact conversationally — these carry nothing under the Act beyond the general Article 4 AI-literacy expectation that staff understand the tools they use.
- Limited-risk: the Article 50 transparency duties, and only those. The system interacts with people or generates synthetic content, so disclosure is owed.
- High-risk: the full regime (Articles 9-15, conformity assessment, registration). A system lands here because of its use — it sits in an Annex III category — not because it is more "advanced."
A system can carry an Article 50 duty and be high-risk at the same time: a high-risk system that also generates deepfakes owes both the high-risk obligations and the Article 50(4) disclosure. The tiers are not mutually exclusive at the edges.
Penalties for breaching Article 50 sit in the €15 million or 3% band under Article 99(4) — the same tier as most other obligations, not the top Article 5 tier. For SMEs and start-ups, Article 99(6) caps the fine at the lower of the fixed amount or the percentage.
Worked Example: A Limited-Risk Stack at One SME
Take Tramontana Reisen GmbH, a fictional 60-person, ~€9 million-turnover travel-booking company. It runs a customer-support chatbot on its website, uses an AI tool to generate marketing images for destination pages, and publishes AI-assisted travel-trend summaries on its blog.
- The chatbot triggers Article 50(1): a visible "You're chatting with our AI assistant" disclosure satisfies it.
- The AI-generated marketing images trigger Article 50(2) content-marking on the provider of the image tool, and if any image is a realistic deepfake, Article 50(4) disclosure on Tramontana as deployer. The marking obligation has applied since 2 August 2026 (2 December 2026 if the tool was already on the market before then).
- The AI-assisted travel-trend posts are interesting: Article 50(4) attaches a disclosure duty to AI-generated text published to inform the public on matters of public interest. Light travel-trend marketing copy is unlikely to count as public-interest information, so this probably falls outside 50(4) — but if Tramontana started publishing AI-generated pieces on, say, travel-safety or health advisories, the public-interest disclosure duty could attach.
Tramontana's verdict: a limited-risk stack. Its entire AI Act obligation here is disclosure — a few clear labels and one notice line. No conformity assessment, no registration, no FRIA. That is exactly the proportionality the limited-risk tier is designed for.
How Confir Helps
The practical risk with limited-risk AI is mislabelling it — treating a transparency case as high-risk (wasted effort) or missing the disclosure duty entirely (a 3% exposure).
Confir's classification engine is rule-based and deterministic: it walks each system through Articles 5, 6, and 50 with explicit rules, so the same intake always yields the same finding and tells you which rule fired — including whether an Article 50 transparency duty attaches and which sub-paragraph. It keeps the result in an org-wide AI register with an audit log, so the classification of every limited-risk system is documented and reproducible.
Related guides
- limited-risk AI examples
- the limited-risk tier in depth
- transparency obligations explained
- Article 50 transparency duties
- what counts as a deepfake
- high-risk AI systems defined
- the corrected enforcement timeline
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →