EU AI Act Risk Classification
Classification answers one question per entity: which EU AI Act obligation tier applies, given what it actually does. Praesidia keeps one classification per agent, MCP server, or application — a risk level, a risk category, the assessment answers behind it, a compliance status, and a review date. It can suggest a tier automatically from what it already observes about the entity, but only a person's assessment concludes a classification, and that assessment records the intended purpose, the provision relied on, the rationale, and who confirmed it.
Before you start
- Risk classification is on the Advanced tier of the Team plan and on Enterprise. If your organization's plan does not include it, classification routes return 403 rather than data.
- Requesting a suggestion, assessing, or updating compliance status requires
compliance.manage; viewing an existing classification requirescompliance.view. - Classification is per entity, not per organization. Assess each agent, MCP server, or application you need a tier for, and re-assess it when an entity's function changes.
1. Get an automatic suggestion
POST /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}/classify
entityType is agent, mcp-server, or application. This runs the automatic classifier against the signals Praesidia has for that entity: whether an agent carries the EU AI Act high-risk flag, and the enabled guardrails in scope (an agent's own plus the organization-wide ones; only the organization-wide ones for an MCP server or application). An enabled security or compliance guardrail, or a PII-class detection template, counts as documented data governance, which changes the compliance gaps but never the tier. The classifier has no signal for the Annex III uses or the prohibited practices, so the suggested tier is HIGH for an agent whose EU AI Act high-risk flag is set and MINIMAL otherwise.
An automatic run records a suggestion, not a classification. The row gets classificationSource: AUTO, complianceStatus: UNASSESSED, and review status DUE with a review date of now, and it has no intended purpose, provision, rationale, or reviewer; its riskLevel is only the suggested tier. Until someone confirms it, the summary counts it under UNASSESSED and in no risk tier, the entity's article matrix (Articles 9, 10, 12, 13, and 14) marks every article as a gap that asks for the classification to be confirmed first, and a compliance-status update is refused.
If the entity already has a human-confirmed classification, or one marked as a manual override, the run leaves it untouched and the response returns it with autoReclassificationSkipped: true.
2. Confirm with an assessment
POST /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}/assess
{
"usesRealTimeRemoteBiometric": false,
"influencesCriticalInfrastructure": false,
"affectsEducationAccess": false,
"usedInEmploymentDecisions": true,
"affectsEssentialServiceAccess": false,
"usedByLawEnforcement": false,
"usedInMigrationDecisions": false,
"usedInJustice": false,
"socialScoringCapability": false,
"subliminalManipulation": false,
"exploitsVulnerabilities": false,
"generalPurposeAI": false,
"outputTransparencyProvided": true,
"humanOversightEnabled": true,
"dataGovernanceDocumented": true,
"technicalDocumentation": true,
"loggingEnabled": true,
"accuracyMetricsAvailable": false,
"cybersecurityMeasures": true,
"intendedPurpose": "Screens incoming job applications and ranks candidates for the recruiting team's interview shortlist.",
"applicableProvision": "Art. 6(2) + Annex III point 4(a)",
"rationale": "The ranking decides which candidates are invited to interview, a recruitment and selection use listed in Annex III point 4(a), so the system is high-risk."
}
The assessment is the human confirmation that concludes a classification. intendedPurpose (what the system is for, up to 5,000 characters), applicableProvision (the EU AI Act provision the classification rests on, up to 200 characters), and rationale (why the assessor reached it, up to 5,000 characters) are required and must not be blank; a request missing one is rejected with a 400 that names the field. Praesidia takes the reviewer and review time from the authenticated caller and the time of the request, never from the body. You can also send a remediationPlan, and an aiSystemId or assetId to attach the classification to an AI system or asset in your organization.
The questionnaire covers part of the decision workflow described in classifying an AI agent under the EU AI Act's risk tiers, not all of it. The prohibited-practice flags (socialScoringCapability, subliminalManipulation, exploitsVulnerabilities, and usesRealTimeRemoteBiometric together with usedByLawEnforcement) set UNACCEPTABLE, and otherwise the Annex III flags (usedInEmploymentDecisions, affectsEssentialServiceAccess, usedByLawEnforcement, and so on) set HIGH. Article 50 appears in the questionnaire only as the generalPurposeAI flag, which sets LIMITED when none of those flags is set, with an Article 50 gap until outputTransparencyProvided is true; a HIGH result carries no Article 50 gap. There is no question for the Annex I safety-component route or the Article 6(3) exception. Article 50 transparency is assessed separately, per AI system, at POST /organizations/{orgId}/compliance/eu-ai-act/systems/{aiSystemId}/transparency, which records whether the system interacts with people or generates synthetic content and how the disclosure is made. The governance flags (humanOversightEnabled, loggingEnabled, dataGovernanceDocumented, …) drive whether the entity is compliant for the tier it lands in. The example above lands HIGH in the employment category with one gap, accuracy and robustness metrics (Art. 15), so its compliance status is NEEDS_REVIEW. A submitted assessment sets classificationSource: MANUAL, stamps manualOverride: true so the automatic classifier will not overwrite it on a later run, and sets the review status to CURRENT with the next review six months out.
3. Read a classification, update compliance status
GET /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}
PATCH /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}
{
"complianceStatus": "COMPLIANT",
"rationale": "Accuracy and robustness metrics are now published with each model release, which closes the Art. 15 gap.",
"complianceGaps": []
}
A classification carries a risk level (UNACCEPTABLE, HIGH, LIMITED, MINIMAL; on an automatic suggestion, the suggested tier), a risk category (employment, biometric, critical infrastructure, education, essential services, law enforcement, migration, justice, general-purpose, or other), a compliance status (COMPLIANT, NON_COMPLIANT, NEEDS_REVIEW, EXEMPT, or UNASSESSED for an automatic suggestion no one has confirmed), any compliance gaps, a remediation plan with its own tracked status (none, open, in progress, resolved), and, once confirmed, the intended purpose, provision, rationale, reviewer, and review time.
PATCH records a compliance decision as you close gaps out: complianceStatus and a non-blank rationale are required, and the same request can replace the gaps, the remediation plan and its remediationStatus, and the AI system or asset attachment. UNASSESSED cannot be set this way. PATCH works only on a human-confirmed classification: on an automatic suggestion it returns 409 with code: "CLASSIFICATION_UNCONFIRMED" and changes nothing until the suggestion is confirmed with an assessment. The caller becomes the recorded reviewer.
Agent classifications also have a legacy path — .../agents/{agentId}/assess, .../agents/{agentId}, and the PATCH equivalent — that predates the general entity routes above and still works for agent-only integrations. It takes the same request bodies, so the three confirmation fields, the PATCH rationale, and the 409 apply there too.
4. Inventory, summary, and report
GET /organizations/{orgId}/compliance/eu-ai-act?riskLevel=HIGH&complianceStatus=NEEDS_REVIEW&entityType=agent
GET /organizations/{orgId}/compliance/eu-ai-act/summary
GET /organizations/{orgId}/compliance/eu-ai-act/report
The list route filters the classification inventory by risk level, compliance status, or entity type, and by aiSystemId or assetId. A row's classificationSource tells a suggestion (AUTO) from a confirmed classification (MANUAL), and a riskLevel filter also matches a suggestion's suggested tier. summary returns aggregate counts for a dashboard: byRiskLevel counts human-confirmed classifications only, byComplianceStatus includes the UNASSESSED suggestions, and total counts both. report returns the fuller compliance report, paged with cursor and limit.
Review and reclassification
A classification carries a nextReviewDate and a review status — CURRENT, DUE, or OVERDUE. A daily job moves a CURRENT classification to DUE once its review date passes and to OVERDUE more than 30 days after it, and notifies the members of the organization who hold compliance.view, so a classification does not silently go stale. A confirming assessment resets the status to CURRENT with the next review six months out. An automatic suggestion starts DUE, so one nobody confirms turns OVERDUE more than 30 days after the run. Re-assess whenever an entity's function changes — a new capability, a new downstream use of its output, or a new people-facing surface — per the reclassification triggers in the classification workflow post.
In the product
Trust & Safety → EU AI Act shows the classification inventory grouped by confirmed risk tier, with automatic suggestions grouped apart as Unconfirmed — suggestion only alongside their suggested tier. Summary cards show Total Assessed (every classification, suggestions included), High Risk (confirmed high-risk and unacceptable), Compliant, Needs Review, and Unconfirmed suggestions, and a row a human has classified carries an Override badge. Assess agent, and Confirm classification in a suggestion's detail or update dialog, open a form that takes the intended purpose, applicable provision, and rationale with all nineteen of the questionnaire's questions, grouped as high-risk indicators, prohibited-practice indicators, general-purpose AI, and mitigations and controls. Every question starts at no and the form records only the ones you turn on, so an assessment with none turned on confirms the minimal tier.
For the underlying risk-management record this classification feeds into, see the AI agent risk register.