EU AI Act risk categories
Definition:
The EU AI Act (Regulation 2024/1689) divides AI systems into four risk categories: unacceptable risk (prohibited), high risk (strict requirements), limited risk (transparency obligations) and minimal risk (no obligations). The classification determines which compliance requirements a company must meet when using or developing AI systems.
The EU AI Act distinguishes four levels, from prohibited to freely usable. The category depends on how strongly an AI system affects fundamental rights, safety or social processes.
Which four risk categories does the EU AI Act define?
Category 1: unacceptable risk: AI systems that violate fundamental rights have been prohibited since February 2025. These include social scoring systems used by public authorities, real-time biometric surveillance in public spaces (with narrow exceptions for law enforcement) and systems that manipulate people's behavior through subliminal influence.
Category 2: high risk: High-risk AI covers systems in critical areas: medical diagnostics, lending, HR decisions (e.g. applicant screening), education, biometric identification and critical infrastructure. From August 2026, these systems must have a risk management system, technical documentation, a conformity assessment, CE marking and an entry in the EU database for high-risk AI.
Category 3: limited risk: Most AI chatbots and AI agents in customer service fall into this category. The core requirement under Art. 50 of the EU AI Act: users must be able to recognize that they are interacting with AI. Deepfakes and synthetically generated content must be labeled as such. Providers of general-purpose AI models (GPAI) with training compute of 10²⁵ FLOPs or more are subject to additional transparency and safety obligations.
Category 4: minimal risk: AI systems without significant risks to fundamental rights or safety, such as spam filters, AI-powered search or recommendation algorithms in e-commerce, fall into this category. No legal obligations apply; lawmakers recommend a voluntary code of conduct.
Which category applies to AI chatbots and AI agents in customer service?
AI chatbots and AI agents in customer service usually fall into category 3 (limited risk). The practical obligation is manageable: the chat interface must show a visible notice that the user is talking to AI. Providers who use or adapt their own model must also check whether GPAI obligations apply.
An exception applies when a chatbot uses personal data for automated decisions, for example in credit checks or employee assessments. In that case the system can slip into category 2. This isn't the case in standard customer service use (FAQ automation, order status, first-level support). melibo explains what this means in concrete terms for using AI agents in customer service in a separate article.
Providers like melibo that host in Germany and are ISO 27001 certified meet the transparency requirement with a standard notice in the chat widget and document this in the data processing agreement (DPA).
Key deadlines at a glance
The EU AI Act is being implemented in stages. Four dates are decisive for companies in the DACH region. Since February 2025, the bans on unacceptable risks (category 1) have applied. In August 2025, transparency obligations for GPAI models and the governance rules came into force. In August 2026, the high-risk obligations (category 2) become fully applicable: CE marking, conformity assessment and EU database registration are then mandatory. From August 2027, high-risk AI used as a safety component in regulated products must be brought into compliance.
For most customer service AI systems (category 3), the August 2025 deadline is the relevant threshold. The August 2026 deadline mainly affects providers using AI in regulated areas such as medicine, finance or HR.
EU AI Act vs. GDPR vs. ISO 27001
These frameworks overlap but govern different areas.
The EU AI Act (Regulation 2024/1689) is AI-specific. It regulates which AI systems may be used and how, and which transparency and documentation obligations apply. It applies to providers and deployers of AI systems in the EU. The melibo article on the EU AI Act gives a good overview of what it means for companies in practice.
The GDPR (Regulation 2016/679) is data protection law and regulates the processing of personal data, regardless of whether AI is involved. Art. 22 GDPR is especially relevant for AI systems: automated individual decisions with significant effects are only permitted to a limited extent.
ISO 27001 is an information security standard. Certification of information security management systems (ISMS) is voluntary but is seen as a signal of trust toward customers and authorities.
The NIS 2 Directive (2022/2555) regulates network and information security for critical infrastructure. It affects companies in defined sectors such as energy, transport, health and digital infrastructure but isn't an AI-specific framework.
CE marking is a product safety mark for the EU single market. High-risk AI must carry the CE mark from August 2026 – this is an obligation under the EU AI Act, not a separate regulation.
Conclusion
For most companies using AI in customer service, the situation is clearer than the media attention around the EU AI Act suggests. Standard chatbots and AI agents for FAQ automation, order status or first-level support fall into category 3 and have been subject to a single concrete obligation since August 2025: a visible notice of the AI interaction. If you implement that and have a proper DPA with your provider, you are compliant.
It gets more complex as soon as AI is involved in automated decisions with significant effects, for example in recruiting, lending or medical diagnostics. Then the high-risk requirements of category 2 apply, with a deadline in August 2026.
So the most important question isn't "Does the EU AI Act apply to us?" but "Which category does our specific system fall into?" Clarifying that now avoids both unnecessary compliance effort and nasty surprises just before the deadline. An overview of how melibo AI agents are used in customer service in a GDPR-compliant and transparent way is available directly on the platform page.
