Compliance

Risk-based categorisation

Classification of AI systems by risk level (minimal to unacceptable).

How the laws define this

Both sources establish that regulatory expectations must scale directly with the risk and potential impact an artificial intelligence system presents, with both explicitly referencing alignment with the EU AI Act. They share a core principle that assessed harm to rights, safety, or society determines applicable governance and enforcement priorities. The primary divergence lies in how this classification is defined and applied. The strategy document AI – Here for Good: National AI Strategy Refresh (2024) sets out a specific four-tiered structure—minimal, limited, high, and unacceptable—to dictate conformity assessment requirements and permissible uses. In contrast, the Overview of potential regulatory approaches for artificial intelligence (OFCOM report) emphasizes contextual risk, highlighting that the exact same model can present different risks depending on its specific use. Organizations must therefore evaluate whether compliance hinges on predefined risk tiers or on context-dependent assessments of an AI system's actual deployment.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

In the AI – Here for Good: National AI Strategy Refresh (2024), it determines applicable governance expectations, conformity assessment requirements, permissible uses, and enforcement priorities based on the potential harm and societal impact of an AI system.

Definitions (2)

A tiered framework (minimal, limited, high, unacceptable) aligned with the EU AI Act used in the strategy to determine applicable governance expectations, conformity assessment requirements, permissible uses, and enforcement priorities based on the potential harm and societal impact of an AI system.

AI – Here for Good: National AI Strategy Refresh (2024)Definition 1 of 2

A framework for classifying AI systems by the level of risk they pose in context, including the proposal to adopt a model aligned with the EU AI Act; it recognises that the same model may present different risks depending on its use, and that obligations should scale with assessed impact to rights and safety.

Overview of potential regulatory approaches for artificial intelligence (OFCOM report)Definition 2 of 2

Not to be confused with

Risk-based taxonomy

Risk-based taxonomy refers specifically to classification based on use-case-specific risk levels, while risk-based categorisation is the broader framework for classifying AI systems by risk level including minimal to unacceptable.

High-risk AI deployment

High-risk AI deployment describes AI systems requiring stricter controls due to elevated harm potential, whereas risk-based categorisation is the overall process of classifying all AI systems by their risk levels.

Questions and answers

How does the National AI Strategy Refresh use risk-based categorisation?

The AI – Here for Good: National AI Strategy Refresh (2024) uses a tiered framework of minimal, limited, high, and unacceptable risks aligned with the EU AI Act. This determines governance expectations, conformity assessment requirements, permissible uses, and enforcement priorities based on potential harm and societal impact.

Does risk-based categorisation depend on the context of AI use?

The Switzerland Overview of potential regulatory approaches for artificial intelligence (OFCOM report) recognises that the same model may present different risks depending on its use.