risk-based approach
In plain wordsA way of regulating AI in which the strictness of the rules depends on how much harm a use could cause: bans for the worst uses, heavy checks for risky ones, little or nothing for the rest.
A regulatory design in which obligations scale with the likelihood and severity of the harm that an AI systemAI system, n.: A complete piece of technology that uses AI to do something, such as screening loan applications, driving a car or chatting with customers, including the AI model and the software around it. or use may cause, instead of applying uniformly. The EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models. is the canonical example, sorting uses into four tiers often drawn as a pyramid: unacceptable risk (prohibited AI practicesprohibited AI practices, n.: Uses of AI that the EU bans outright as too harmful — such as manipulating people, social scoring, and most live facial recognition by police in public places.), high risk (high-risk systemshigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., subject to requirements and conformity assessmentconformity assessment, n.: The check, done by the maker or by an approved outside body, that a high-risk AI system meets the EU's legal requirements before it can be sold or used.), limited risk (transparency obligationstransparency obligations, n.: EU rules requiring that people be told when they are dealing with AI: chatbots must say they are bots, AI-made content must be marked, and deepfakes must be labeled.) and minimal risk (no new duties). General-purpose AI modelsgeneral-purpose AI model, n.: The EU's legal name for the large, adaptable AI models behind chatbots and similar tools: models that can turn their hand to many different jobs and be built into many other products. sit on a separate track keyed to capability rather than use. Risk-based thinking also structures the NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use. and ISO/IEC 42001ISO/IEC 42001, prop. n.: An international standard for how an organization should run its AI work responsibly — policies, risk checks, roles and records — which outside auditors can certify, much as ISO 9001 does for quality..
Under a risk-based approach, a spam filter and a CV-screening tool face very different rules.
Origin
Risk-based regulation was established in environmental, food-safety and financial supervision before AI; in the UK, the Hampton Review (2005) promoted it across regulators. For AI, the European Commission's White Paper on Artificial Intelligence (February 2020) proposed concentrating mandatory requirements on high-risk applications, and its April 2021 AI Act proposal introduced the four-tier structure.
Usage note
Critics argue that use-based tiers fit general-purpose models poorly, since their risks depend on downstream use, and that 'risk' is fixed by the legislator's lists rather than measured. Alternatives include rights-based approaches and capability-based approaches keyed to computecompute threshold, n.: A legal cutoff based on how much computation was used to train an AI model. Models trained with more than that amount face extra rules, on the theory that bigger training runs produce more capable models. or capability thresholdscapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back..
Related
- EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models.
- high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks.
- prohibited AI practicesprohibited AI practices, n.: Uses of AI that the EU bans outright as too harmful — such as manipulating people, social scoring, and most live facial recognition by police in public places.
- transparency obligationstransparency obligations, n.: EU rules requiring that people be told when they are dealing with AI: chatbots must say they are bots, AI-made content must be marked, and deepfakes must be labeled.
- NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use.
- AI regulationAI regulation, n.: Laws and binding government rules about artificial intelligence: what AI may be used for, what checks its makers must run, and what penalties apply when they break the rules.
- capability thresholdcapability threshold, n.: A level of dangerous ability — such as meaningfully helping someone make a biological weapon — that, once an AI model reaches it, obliges its developer to add stronger safeguards or hold the model back.
- compute thresholdcompute threshold, n.: A legal cutoff based on how much computation was used to train an AI model. Models trained with more than that amount face extra rules, on the theory that bigger training runs produce more capable models.
Sources
- European Commission (2020). White Paper on Artificial Intelligence: A European approach to excellence and trust. COM(2020) 65 final.
Defined in law or standards
EU AI Act (Reg. (EU) 2024/1689), Art. 3(2) (definition of 'risk'); Recital 26
Mentioned in
AI governanceAI governance, n.: The rules, institutions and habits that shape how AI is built and used — from laws and treaties to technical standards and a company's own review processes., AI regulationAI regulation, n.: Laws and binding government rules about artificial intelligence: what AI may be used for, what checks its makers must run, and what penalties apply when they break the rules., EU AI ActEU AI Act, prop. n.: The European Union's law on artificial intelligence, the first broad AI law anywhere: it bans some uses, sets strict checks for risky ones and puts duties on the makers of the biggest AI models., high-risk AI systemhigh-risk AI system, n.: Under EU law, an AI system used where mistakes could seriously hurt people's safety or rights — in hiring, schooling, loans, policing, borders or products like medical devices — and which must therefore pass strict checks., AI regulatory sandboxAI regulatory sandbox, n.: A supervised testing ground where companies can try out new AI with regulators watching and advising, before the product faces the full weight of the rules., NIST AI Risk Management FrameworkNIST AI Risk Management Framework, prop. n.: A free, voluntary guide from the US government's standards agency that helps organizations spot, measure and reduce the risks of the AI systems they build or use., prohibited AI practicesprohibited AI practices, n.: Uses of AI that the EU bans outright as too harmful — such as manipulating people, social scoring, and most live facial recognition by police in public places., transparency obligationstransparency obligations, n.: EU rules requiring that people be told when they are dealing with AI: chatbots must say they are bots, AI-made content must be marked, and deepfakes must be labeled., AI Basic ActAI Basic Act, prop. n.: South Korea's main AI law, in force since January 2026, which sets safety and transparency duties for AI used in sensitive areas and for AI-generated content., Collingridge dilemmaCollingridge dilemma, n.: The trap that a new technology is easiest to control when little is known about its harms, but by the time the harms are clear it is too widespread to change easily., ISO/IEC 23894ISO/IEC 23894, prop. n.: An international guidance standard that explains how organizations can apply ordinary risk-management practice to the particular risks of AI systems.