A governance committee is sorting four planned AI projects into the EU AI Act risk tiers so it can allocate compliance effort. One project is an AI-driven spam filter for internal email. The committee wants to apply effort in proportion to the obligations each tier attracts. Which statement most accurately describes how the obligations scale across the tiers?
- AMinimal-risk systems such as the spam filter attract no mandatory AI Act obligations, while high-risk systems carry the heaviest duties including risk management, data governance, logging and human oversight. Correct
- BEvery AI system regardless of tier must undergo the same third-party conformity assessment, with the tiers differing only in the size of the potential fine.
- CLimited-risk systems carry the heaviest substantive duties because their transparency obligations are more demanding than the requirements placed on high-risk systems.
- DMinimal-risk systems must still complete a fundamental rights impact assessment, while high-risk systems are exempt because they are already covered by sectoral law.
Why A is correct: The AI Act imposes its substantive duties chiefly on high-risk systems, covering risk management, data governance, record-keeping and human oversight, while minimal-risk systems like a spam filter face no mandatory requirements and are only encouraged to follow voluntary codes.
Why B is wrong: A uniform conformity assessment sounds orderly and is therefore tempting, but the Act calibrates obligations to risk, so minimal and limited-risk systems are not subjected to the high-risk conformity assessment, making this incorrect.
Why C is wrong: This is tempting because limited-risk transparency duties are real, but they are comparatively light disclosure duties, and it is the high-risk tier that carries the most demanding substantive requirements, so the ranking is reversed.
Why D is wrong: The fundamental rights impact assessment is a genuine AI Act tool, which makes this plausible, but it is associated with certain high-risk deployments rather than minimal-risk systems, so this assigns the duty to the wrong tier and wrongly exempts high-risk systems.