risk classification
Categorization of systems as low, high, or excessive risk.
How the laws define this
Regulators across governance frameworks agree that risk classification is a structured process of categorizing artificial intelligence systems, uses, or applications based on their potential harms, impact, or characteristics to dictate proportional controls, oversight intensity, required mitigations, and compliance obligations. Frameworks diverge primarily in how they define and divide these risk categories. Portaria CNJ nº 270/2025 and Projeto de Lei nº 2.338/2023 adopt a three-tiered taxonomy comprising low, high, or excessive risk. In contrast, Expediente 2505-D-2023 – Investigación, desarrollo y uso de la Inteligencia Artificial establishes a four-category model consisting of unacceptable, high, limited, and insignificant risk. FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence avoids predetermined tier names entirely, requiring institutions to evaluate applications against specific operational factors such as financial impact, autonomy, model complexity, and data sensitivity. Finally, the India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation leaves its specific categorizations to be developed and applied under the MeitY Action Plan.
Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Brazil | Portaria CNJ No. 270/2025 | In Force | Specifies three tiers—low, high, excessive risk—under the CNJ governance model with distinct obligations like reporting, auditing, or prohibition. |
| India | India AI Governance Guidelines: Enabling Safe and Trusted AI Innovation | In Force | Describes an India-specific framework to be developed under the MeitY Action Plan for categorizing by potential harms and impact. |
| Switzerland | FINMA Guidance 08/2024: Governance and risk management when using artificial intelligence | In Force | Evaluates AI applications in finance using six specific factors—financial impact, regulatory relevance, client impact, autonomy, model complexity, data sensitivity. |
| Argentina | File 2505-D-2023 – Research, Development and Use of Artificial Intelligence | Proposed | Defines four categories—unacceptable, high, limited, insignificant risk—for AI uses determining prohibitions, assessments, certification, and oversight. |
| Brazil | Bill No. 2,338/2023 (Legal Framework for Artificial Intelligence — Draft national AI regulatory framework) | Under Review | Establishes statutory taxonomy with risk tiers triggering algorithmic impact assessments, conformity/certification, and liability presumptions via regulation. |
What it triggers
- Under Portaria CNJ No. 270/2025, classification guides required oversight, audit frequency, and mitigation measures.source
- India AI Governance Guidelines set out proportional oversight, mitigations, documentation and incident reporting based on classification.source
- FINMA Guidance 08/2024 describes proportional controls, testing and supervision based on classification.source
- Bill No. 2,338/2023 would determine applicable obligations such as algorithmic impact assessments, conformity/certification and liability presumptions.source
- File 2505-D-2023 would determine applicable prohibitions, pre-deployment obligations like impact assessments and certification, and intensity of oversight.source
Definitions (5)
The process of categorizing AI systems as low, high, or excessive risk, each tier carrying distinct governance obligations such as reporting, auditing, or prohibition. Classification guides required oversight, audit frequency, and mitigation measures under the CNJ governance model.
An India‑specific framework to categorise AI systems according to potential harms and impact, used to determine proportional oversight, required mitigations, documentation and incident reporting obligations; to be developed and applied under the MeitY Action Plan.
The statutory taxonomy that classifies AI systems into risk tiers (e.g., low, high, excessive) based on their potential to affect rights, safety or legal interests; the classification determines applicable obligations such as algorithmic impact assessments, conformity/certification and liability presumptions, with methodological criteria to be specified by regulation.
The bill's framework that classifies AI uses into four categories—unacceptable, high, limited, and insignificant risk—which determines applicable prohibitions, pre-deployment obligations (e.g., impact assessments, certification), and intensity of oversight and mitigation measures.
A structured classification process that evaluates each AI application by factors such as financial impact, regulatory relevance, client impact, autonomy, model complexity and data sensitivity to determine proportional controls, testing and supervision required.
Not to be confused with
Risk-based categorisation refers more broadly to classification from minimal to unacceptable risk, while risk classification here specifies tiered categories with governance obligations in particular instruments.
Questions and answers
What risk tiers does Portaria CNJ No. 270/2025 use for AI systems?
Portaria CNJ No. 270/2025 categorizes AI systems as low, high, or excessive risk. Each tier carries distinct governance obligations such as reporting, auditing, or prohibition.
What factors does FINMA Guidance use in risk classification?
FINMA Guidance 08/2024 evaluates AI applications by financial impact, regulatory relevance, client impact, autonomy, model complexity and data sensitivity to determine proportional controls.
How does Bill No. 2,338/2023 classify AI systems?
Bill No. 2,338/2023 uses a statutory taxonomy classifying AI into risk tiers like low, high, excessive based on potential effects on rights, safety or legal interests.
Related Terms
Risk classification (of AI applications)
Assessment of AI applications by materiality and risk factors....
High-Risk (AI)
AI uses that pose substantial potential harm....
AI System (tiered by risk)
AI systems categorized into risk tiers with corresponding obligations....
Risk-based categorisation
Classification of AI systems by risk level (minimal to unacceptable)....
Risk classification (unacceptable, high, limited, insignificant)
Four-tier risk taxonomy for AI uses....