Self-Service or Not? How to Guide Practitioners in Classifying AI Systems Under the EU AI Act

TL;DR

This study examines how practitioners classify AI systems under the EU AI Act's risk scheme using a decision-support tool, revealing challenges and improvements in practical compliance.

Contribution

It provides empirical insights into real-world application of the EU AI Act's risk classification and evaluates a tool designed to assist practitioners.

Findings

Legal interpretation challenges hinder accurate classification.

Targeted support improves classification accuracy.

Practitioners benefit from clear explanations and examples.

Abstract

In August 2024, the EU Artificial Intelligence Act (AIA) came into force, marking the world's first large-scale regulatory framework for AI. Central to the AIA is a risk-based approach, aligning regulatory obligations with the potential harm posed by AI systems. To operationalize this, the AIA defines a Risk Classification Scheme (RCS), categorizing systems into four levels of risk. While this aligns with the theoretical foundations of risk-based regulations, the practical application of the RCS is complex and requires expertise across legal, technical, and domain-specific areas. Despite increasing academic discussion, little empirical research has explored how practitioners apply the RCS in real-world contexts. This study addresses this gap by evaluating how industrial practitioners apply the RCS using a self-service, web-based decision-support tool. Following a Design Science Research (DSR) approach, two evaluation phases involving 78 practitioners across diverse domains were conducted. Our findings highlight critical challenges in interpreting legal definitions and regulatory scope, and show that targeted support, such as clear explanations and practical examples, can significantly enhance the risk classification process. The study provides actionable insights for tool designers and policymakers aiming to support AIA compliance in practice.