Book demo Start free

EU AI Act Risk Classification

Estimated reading time: 4 minutes

Classification answers one question per entity: which EU AI Act obligation tier applies, given what it actually does. Praesidia records a classification per agent, MCP server, or application — a risk level, a risk category, the assessment questionnaire that produced it, a compliance status, and a review date — and can also produce a first-pass classification automatically from what it already observes about the entity.

Before you start

  • The EU AI Act feature must be enabled for your organization. If it is not, classification routes return a feature-gate error rather than data.
  • Assessing or classifying requires compliance.manage; viewing an existing classification requires compliance.view.
  • Classification is per entity, not per organization. Run it for each agent, MCP server, or application you need a tier for, and re-run it when an entity's function changes.

1. Auto-classify an entity

POST /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}/classify

entityType is agent, mcp-server, or application. This runs the automatic classifier against signals Praesidia already has for that entity — connected tools, data categories touched, autonomy, and prohibited-purpose flags — and writes a classification with classificationSource: AUTO. The response also reports autoReclassificationSkipped when a prior manual override means the automatic result was not applied.

Automatic classification is a starting point, not a legal determination — review it, especially for anything the assessment questionnaire below would mark high-risk.

2. Assess manually

POST /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}/assess
{
  "usesRealTimeRemoteBiometric": false,
  "influencesCriticalInfrastructure": false,
  "affectsEducationAccess": false,
  "usedInEmploymentDecisions": true,
  "affectsEssentialServiceAccess": false,
  "usedByLawEnforcement": false,
  "usedInMigrationDecisions": false,
  "usedInJustice": false,
  "socialScoringCapability": false,
  "subliminalManipulation": false,
  "exploitsVulnerabilities": false,
  "generalPurposeAI": false,
  "outputTransparencyProvided": true,
  "humanOversightEnabled": true,
  "dataGovernanceDocumented": true,
  "technicalDocumentation": true,
  "loggingEnabled": true,
  "accuracyMetricsAvailable": false,
  "cybersecurityMeasures": true
}

The questionnaire is the same decision workflow described in classifying an AI agent under the EU AI Act's risk tiers: the Annex III flags (usedInEmploymentDecisions, affectsEssentialServiceAccess, usedByLawEnforcement, and so on) drive the risk tier, and the governance flags (humanOversightEnabled, loggingEnabled, dataGovernanceDocumented, …) drive whether the entity is compliant for the tier it lands in. A submitted assessment sets classificationSource: MANUAL and the server automatically stamps manualOverride: true on the row, so the automatic classifier will not overwrite it on a later run.

3. Read a classification, update compliance status

GET   /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}
PATCH /organizations/{orgId}/compliance/eu-ai-act/entities/{entityType}/{entityId}

A classification carries a risk level (UNACCEPTABLE, HIGH, LIMITED, MINIMAL), a risk category (employment, biometric, critical infrastructure, education, essential services, law enforcement, migration, justice, general-purpose, or other), a compliance status (COMPLIANT, NON_COMPLIANT, NEEDS_REVIEW, EXEMPT), any compliance gaps, and a remediation plan with its own tracked status (none, open, in progress, resolved). PATCH updates the compliance status, gaps, and remediation plan as you close them out.

Agent classifications also have a legacy path — .../agents/{agentId}/assess, .../agents/{agentId}, and the PATCH equivalent — that predates the general entity routes above and still works for agent-only integrations.

4. Inventory, summary, and report

GET /organizations/{orgId}/compliance/eu-ai-act?riskLevel=HIGH&complianceStatus=NEEDS_REVIEW&entityType=agent
GET /organizations/{orgId}/compliance/eu-ai-act/summary
GET /organizations/{orgId}/compliance/eu-ai-act/report

The list route filters the full classification inventory by risk level, compliance status, or entity type. summary returns aggregate counts (total assessed, by risk level, by compliance status) for a dashboard. report generates the fuller compliance report.

Review and reclassification

Every classification carries a nextReviewDate and a review status — CURRENT, DUE, or OVERDUE — that a scheduled job advances as the date passes, so a classification does not silently go stale. Submitting a fresh assessment resets the clock back to CURRENT. Re-run classification whenever an entity's function changes — a new capability, a new downstream use of its output, or a new people-facing surface — per the reclassification triggers in the classification workflow post.

In the product

Monitor → Compliance → EU AI Act shows the classification inventory grouped by risk tier, with Total Assessed, High Risk, and Compliant summary counts, an Assess agent action that opens the same questionnaire as the API above, and an Override badge on any row a human has manually classified.

For the underlying risk-management record this classification feeds into, see the AI agent risk register.