Lion Cipher Lab
Classify an AI system's risk tier under the EU AI Act
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
The EU AI Act is the first comprehensive, horizontal AI law in the world, and like the GDPR before it, it reaches far beyond Europe: it can bind a company anywhere on earth whose AI system is placed on the EU market or whose output is used in the EU. The single skill that pays for everything else is being able to answer, correctly and defensibly, the question a nervous product owner or executive will ask you: 'what tier is our AI system in, and what does that cost us?' That is a classification decision on a four-level risk pyramid — is it a PROHIBITED practice, is it HIGH-RISK, does it only…
What you'll learn
- EU AI Act (Regulation (EU) 2024/1689) risk-tier classification
- walking the risk pyramid: prohibited / high-risk / limited-risk / minimal-risk
- Article 5 prohibited-practice screening
- Annex III use-case + Annex I product-safety high-risk classification
- the Article 6(3) 'not significant risk' filter and the profiling override
- high-risk provider obligations (risk management, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, conformity assessment, CE marking, registration)
- Article 50 transparency obligations (disclose AI interaction, label synthetic content)
- general-purpose AI (GPAI) model obligations and the systemic-risk threshold, at a high level
- reading the phased application timeline off the Regulation's own schedule
- provider vs deployer role and why it changes who owes what
Steps in this lab
- What the AI Act is — why 'regulation' matters, and the risk pyramid in one breath
- Set up your worksheet and pick an AI system to classify
- Tier gate 1 — is it a PROHIBITED practice? (Article 5)
- Tier gate 2 — is it HIGH-RISK? (Annex III use cases + Annex I product safety)
- If it is HIGH-RISK, know what you owe — the provider obligations
- Tier gates 3 and 4 — LIMITED-RISK transparency (Article 50) and MINIMAL-RISK
- The orthogonal layer — general-purpose AI (GPAI) models
- Do it right — the judgment that separates a pro from a box-ticker
- Write the one-page verdict and the prioritised fix list