How the EU AI Act's Risk Classification Maps to Legal AI Use Cases

Why Classification Is the Foundational Compliance Step for Legal AI

For any legal department deploying or procuring AI tools, the single most consequential decision under the EU AI Act is not how to comply with high-risk obligations — it is whether those obligations apply at all. Misclassification cascades in both directions: classifying a high-risk system as minimal-risk exposes the organization to fines of up to €15 million or 3% of global annual turnover for non-compliance with Chapter 2 obligations; classifying a minimal-risk system as high-risk wastes resources on risk management systems, technical documentation, and conformity assessments that the regulation does not require.

This guide is designed for general counsel, heads of legal operations, compliance officers, and law firm managing partners who need to map their specific AI use cases — contract analysis, document review, legal research, litigation prediction, client risk scoring, administration of justice tools — to the correct EU AI Act risk tier. It is not a general overview of the regulation. It is a systematic classification exercise, with particular depth on the contested Annex III Category 8 (administration of justice) gray zone, the Article 6(3) exception pathway, and the profiling trap that automatically elevates any system to high-risk.

The EU AI Act's Risk Framework: A Refresher for Legal Professionals

The EU AI Act classifies AI systems into four tiers based on the risk they pose to health, safety, and fundamental rights. Understanding this framework is a prerequisite for any classification exercise.