• The AI Act is already in force, but high-risk obligations phase in on the Commission's staggered timeline — classify now, don't wait for the deadline.
• There are two doors into high-risk: being a safety component of a regulated product, or landing in a listed use like hiring, credit scoring, biometrics, or critical infrastructure.
• Most general chatbots are limited-risk, not high-risk — they owe transparency (tell users it's AI), not the full high-risk obligation stack.
• If you are high-risk, seven duties follow: risk management, data governance, logging, technical documentation, deployer information, human oversight, and robustness/accuracy/security.
• Classification is use-based, not model-based — the same LLM can be minimal-risk in one feature and high-risk in another.

Verdict: binding soon — so classify before you build

The AI Act is already law; the European Commission's framework sorts every system into four risk tiers — unacceptable, high, limited, minimal — and loads almost all the compliance weight onto the high-risk tier (s1). Prohibited uses bite first; high-risk duties phase in later on the Commission's staggered timeline. Treat that gap as a trap, not a reprieve. The prioritised move is to classify honestly today, then stand up a risk-management system and technical documentation — the two things that take longest to retrofit.

There are exactly two doors into high-risk

Door one: your AI is a safety component of a product already covered by EU product-safety law — think medical devices, machinery, vehicles, toys (s1). Door two: your use sits in the Commission's listed high-risk areas — biometric identification, critical infrastructure, education, employment and worker management, access to essential private and public services such as credit scoring, law enforcement, migration and border control, and administration of justice (s1). The consequence to internalise: classification is use-based, not model-based. The same LLM is minimal-risk behind a marketing helper and high-risk behind a hiring filter.

The seven duties, and the one that actually bites

Through either door, the framework requires a risk-management system; high-quality datasets to curb discriminatory outcomes; activity logging for traceability; technical documentation deep enough for authorities to assess compliance; clear information to the deployer; human oversight; and a high level of robustness, security and accuracy (s1). What most teams underestimate is data governance — proving training and evaluation data is representative and bias-checked is far harder than writing a policy doc, and you cannot backfill it after shipping. One honest caveat: this is the classification-and-obligations skeleton only. Conformity assessment, registration, and the general-purpose-AI rules are separate tracks with their own timing, and national implementing detail is still settling — so scope the paperwork wider than these seven lines.