Skip to content

Risk-based approach

What the approach means

Assess possible harm and choose proportionate controls, while meeting the legal requirements that apply to the actual role and activity. An internal risk score cannot remove a statutory duty or authorise prohibited use.

Applying it to AI

  1. Record the system, purpose, users, data and the company’s role.
  2. Review the specific prohibitions in Article 5 of the AI Act, including their conditions, exceptions and applicability dates.
  3. Assess high risk under Article 6 and both Annex I (relevant products and safety components) and Annex III (specified uses).
  4. Assess Article 50 transparency separately; it can apply alongside other requirements.
  5. Check other relevant obligations, including personal data protection, sector rules and GPAI roles where applicable.

The familiar four-level risk pyramid is an explanatory aid, not four mutually exclusive categories that exhaust every obligation. A system outside the high-risk regime may still be subject to transparency, literacy or other legal requirements.

Other regulations

Under GDPR, assess the likelihood and severity of impacts on individuals’ rights and freedoms. A DPIA is required where processing is likely to result in high risk, including the specific Article 35 cases. Not every use of AI automatically requires a DPIA.

NIS2 distinguishes essential and important entities particularly for supervision and sanctions. It does not create a simple rule that important entities need weaker security. In the Czech Republic, assess the regulated service and applicable regime under Act No. 264/2025, including the relevant implementing rules and registration-based deadlines.

The Data Act governs specific rights and obligations concerning data access, sharing and processing services. It cannot be reduced to an AI-style risk pyramid; establish the relevant role and contractual situation.

From assessment to action

Record a justified conclusion, evidence, an owner, required action and a review trigger. Prioritise significant risks and keep uncertain questions visible. Test whether the controls work, and review changes to the system, purpose or supplier.

AI classification · Scope · Current deadlines

Reviewed 6 September 2026. Primary legal sources are provided in the linked regulatory guides.