Minimal-risk AI

Correctly identifying minimal-risk systems is how a compliance programme stays affordable: effort spent documenting a spam filter is effort not spent on the credit-scoring model that actually carries obligations. The classification is a defensible business decision, but only if it is written down — an inventory that records why each system was placed in this tier is the artefact that makes a regulator's question a five-minute answer rather than a project.

A logistics company inventories 40 AI-touching systems and finds that 31 are minimal-risk: route optimisation, demand forecasting, spam filtering, warehouse anomaly detection. Two are limited-risk because they talk to customers, one is Annex III because it scores gig-worker performance, and none are prohibited. That single classification pass is what turns an intimidating regulation into a project scoped around three systems.

Treating minimal-risk as "out of scope of the EU AI Act". Article 4 AI literacy applies across the board, and a system's classification is not permanent — repurposing a forecasting model to screen job applicants moves it straight into Annex III without any change to the model itself.

Are minimal-risk AI systems regulated at all?

They carry no product obligations under the AI Act. The Article 4 AI-literacy duty still applies to the organisations providing and deploying them, and other legislation such as the GDPR applies independently.

What are examples of minimal-risk AI?

Spam filters, AI opponents in video games, inventory forecasting, recommendation systems that do not fall into an Annex III use case, and most internal productivity tooling that neither interacts with people as a chatbot nor generates synthetic media.

Should we document minimal-risk classifications?

Yes. The classification itself is not audited, but you will be asked how you concluded a system is not high-risk. A short recorded rationale per system in the AI inventory is the cheapest possible answer to that question.