Compliance

Risk-Based Approach

Regulatory strategy that calibrates requirements based on the level of risk posed by an AI system.

How the laws define this

These regulatory frameworks agree that a risk-based approach is an evaluative methodology that measures the potential adverse impacts of AI systems and applies proportionate mitigation, control, and oversight measures matched to those risk levels. The primary divergence lies in how risks are classified and which societal interests define impact severity. The White Paper on Artificial Intelligence: A European approach to excellence and trust and the Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne en matière économique, financière, environnementale, énergétique, d'information, de transport, de santé, d'agriculture et de pêche establish strict predefined risk tiers (unacceptable, high, limited, and minimal), tying obligations or outright prohibitions directly to these categories. In contrast, the Guidance for the use of artificial intelligence in Tasmanian Government aligns mitigation strategies with an identified appetite for risk rather than fixed categories, while the Federal Council decision to ratify the Council of Europe Convention on Artificial Intelligence explicitly factors in harms to democracy and the rule of law.

Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Argentina	Resolution PGN 14/25 – Creation of the Artificial Intelligence Program of the Public Prosecutor's Office	In Force	Adds classification by impact on rights, liberties, and institutional interests, with application specifically during intake, procurement, and lifecycle monitoring to prioritize mitigations.
Tasmania, Australia	Guidance for the use of artificial intelligence in Tasmanian Government	In Force	Frames it as a methodology tied to identified appetite for risk, enabling tailored mitigation strategies for specific AI uses and applications.
European Union	White Paper on Artificial Intelligence: A European approach to excellence and trust	Adopted	Specifies four risk tiers—unacceptable, high, limited, minimal—and prescribes proportionate measures across design, training, deployment, and monitoring stages.
Switzerland	Federal Council decision to ratify the Council of Europe Convention on Artificial Intelligence	Adopted	Prioritises measures proportional to severity and likelihood of adverse impacts specifically to human rights, democracy, and the rule of law.
France	Bill containing various provisions for adaptation to European Union law in economic, financial, environmental, energy, information, transport, health, agriculture and fisheries matters	Under Review	Limits the term to the EU AI Act's core principle, explicitly naming the four risk categories and their regulatory burdens.

What it triggers

In Argentina's Ministerio Público Fiscal, the Program must apply this approach during intake, procurement, and lifecycle monitoring to prioritize mitigations.source
The Guidance for the use of artificial intelligence in Tasmanian Government sets out this methodology for assessing AI impact and tailoring mitigation strategies.source
The White Paper on Artificial Intelligence describes this method categorising AI into risk tiers and prescribing proportionate measures across lifecycle stages.source

Definitions (5)

A regulatory method that categorises AI applications into risk tiers (unacceptable, high, limited, minimal) based on their potential to cause harm to health, safety, or fundamental rights, and prescribes measures proportionate to those risks across design, training, deployment, and monitoring stages.

White Paper on Artificial Intelligence: A European approach to excellence and trustDefinition 1 of 5

An evaluative framework that classifies AI projects by their potential impact on rights, liberties, and institutional interests, and that tailors assessment, testing, and control measures proportionally to assessed risk levels. The Program must apply this approach during intake, procurement, and lifecycle monitoring to prioritize mitigations.

Resolución PGN 14/25 – Creación del Programa de Inteligencia Artificial del Ministerio Público FiscalDefinition 2 of 5

A regulatory principle that prioritises assessment, mitigation and oversight measures proportional to the severity and likelihood of adverse impacts to human rights, democracy and the rule of law, guiding obligations for high-risk uses and compliance efforts.

Federal Council decision to ratify the Council of Europe Convention on Artificial IntelligenceDefinition 3 of 5

A methodology for assessing the potential impact of AI in specific uses and applications, allowing for tailored mitigation strategies based on the identified appetite for risk.

Guidance for the use of artificial intelligence in Tasmanian GovernmentDefinition 4 of 5

The risk-based approach is a core principle of the EU AI Act, classifying AI systems into different risk categories: unacceptable, high, limited, and minimal/no risk. This approach ensures that regulatory burdens are proportionate to the potential risks posed by an AI system, with the most stringent requirements applied to high-risk systems and outright prohibitions for unacceptable risks.

Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne en matière économique, financière, environnementale, énergétique, d'information, de transport, de santé, d'agriculture et de pêcheDefinition 5 of 5

Not to be confused with

High-Risk AI System

High-Risk AI System refers to a specific category of AI posing significant risks, while Risk-Based Approach is the overarching strategy classifying systems into such categories.

Proportionality Principle

Proportionality Principle is a general legal principle requiring balanced measures, whereas Risk-Based Approach applies it specifically to calibrate AI regulatory requirements by risk level.

Questions and answers

What stages does Argentina's AI Program apply the risk-based approach to?

The Program applies this approach during intake, procurement, and lifecycle monitoring. It classifies AI projects by potential impact on rights, liberties, and institutional interests to tailor measures proportionally.

How does the EU White Paper categorise AI risks?

It categorises AI applications into unacceptable, high, limited, and minimal risk tiers based on potential harm to health, safety, or fundamental rights. Measures are prescribed proportionate to those risks across design, training, deployment, and monitoring.

What are the risk categories in the EU AI Act as per France's bill?

The bill describes unacceptable, high, limited, and minimal/no risk categories. Regulatory burdens are proportionate, with stringent requirements for high-risk systems and prohibitions for unacceptable risks.