The Act sorts AI into risk tiers, from prohibited uses through high-risk, limited-risk and minimal-risk, with obligations rising alongside the risk. High-risk systems face requirements such as risk management, data governance, transparency, human oversight and documentation. Providers and deployers each carry defined duties depending on their role.
