Risk-level logic

The regulation does not classify technologies but uses. The same model can fall into three different categories depending on what it is made to do. That is the key to reading the text.

Prohibited uses

A short list, with no possible derogation: generalised social scoring, exploitation of people's vulnerability, certain forms of remote biometric identification, and, the point that surprises employers, emotion recognition in the workplace and in education.

If a tool offers to analyse your employees' emotional state, the answer is no, whatever the sales pitch.

High risk

This is where the essentials lie for an ordinary company, because the list touches on everyday uses: recruitment and human resources management, access to education, access to credit and insurance, certain uses in critical infrastructure.

Sorting job applications with AI is high risk. It is not prohibited, but it imposes real obligations: effective human oversight, informing individuals, keeping logs, documentation.

Limited risk: transparency

A conversational agent must make it clear that one is talking to a machine. Generated content must be identifiable as such. This is the level that concerns the greatest number of people.

Minimal risk

Everything else, that is, the vast majority: writing, summarising, translating, sorting emails, preparing drafts. No particular obligations.

The sorting to do at your end

List your uses, not your tools. For each one: does it decide something about a person? If so, look closely. If not, you are almost certainly at minimal risk.