AI governance and regulation (EU AI Act): Worked examples

Before anything, three plain-word definitions we will lean on the whole page. If the parent note used these words casually, here they are nailed down. One more piece of shorthand you will meet in legal text:

Definition The three words we sort by (plus one piece of legal shorthand)

Risk tier ::: which of the four boxes (Unacceptable / High / Limited / Minimal) a system lands in. It is decided by what the system does to people, not by how clever the model is.
Obligation load ::: the pile of paperwork and safeguards the tier forces on you. Unacceptable = "you may not ship it at all". High = the full seven-part checklist. Limited = "just tell users". Minimal = "do whatever you like".
Trigger ::: the single fact in the scenario that pushes it up a tier. Finding the trigger is the whole skill.
Article ("Art." for short) ::: a numbered paragraph of the law itself, like a numbered rule in a rulebook. When we write Art. 5 we mean "rule number 5 of the EU AI Act", which happens to be the one listing the banned systems. It is just a pointer to where in the text the rule lives — nothing mathematical.

The scenario matrix

Every scenario this topic can throw at you falls into one of these cells. Each row is a "case class"; the worked examples below are tagged with the cell they cover.

Cell	Case class	What makes it distinct	Worked example
C1	Clear Unacceptable	A hard red line (social scoring, subliminal manipulation)	Ex. 1
C2	Clear High-risk	Employment / medical / law-enforcement use	Ex. 2
C3	Clear Limited	Chatbot / deepfake — transparency only	Ex. 3
C4	Clear Minimal	Game AI, spam filter — no obligation	Ex. 4
C5	Boundary / "looks banned but isn't"	Same tech, different context flips the tier	Ex. 5
C6	Degenerate input	A rule-based system with no rights impact	Ex. 6
C7	Multi-trigger (worst-tier-wins)	One system with several risky functions	Ex. 7
C8	Real-world word problem	A messy startup pitch you must classify + cost	Ex. 8
C9	Exam twist	Jurisdiction / "developed outside EU" trap	Ex. 9

Figure — AI governance and regulation (EU AI Act)

Let's read this figure carefully, because it drives every example. It is a decision ladder drawn as four stacked boxes:

Bottom rung — Minimal (chalk blue): the cheapest floor, 0 obligations. Games, spam filters live here.
Second rung — Limited (chalk blue): transparency only. Chatbots, deepfakes.
Third rung — High (pale yellow): the full 7/7 checklist. Hiring, medical, education.
Top rung — Unacceptable (chalk pink): banned. Social scoring, live mass biometric ID.

The upward white arrows between the rungs are the trigger points — you only climb when a specific fact fires:

Minimal → Limited fires on a "confusion trigger" (the user might not know they're dealing with a machine).
Limited → High fires on a "rights or safety trigger" (the system affects a fundamental right or physical safety).
High → Unacceptable fires on a "red-line trigger" (the system matches a banned pattern).

The pink arrow off the top labelled "fall off the top" is the key mental image: once a red-line trigger fires you don't get a higher rung with more paperwork — you leave the ladder entirely and the system may not ship. You always start at the bottom (cheapest) and climb only as far as the strongest trigger forces you. Every example below is one walk up (or off) this ladder.

The worked examples

Example 1 — Cell C1: Clear Unacceptable

Forecast: Pause. Which box, and is there any paperwork that could rescue it?

List every function. The system rates people's overall trustworthiness from unrelated behaviour and then restricts a public service. Why this step? You cannot find the trigger without first naming what the system does to people.
Match against the red lines. This is textbook social scoring by a public authority — explicitly prohibited by Art. 5 (recall: "Article 5", the rule of the Act that lists banned systems). Why this step? Unacceptable-risk is a closed list; matching the list is the entire test — no risk-weighing.
Check for a rescue. Is there a transparency fix or a human-oversight fix? No. Prohibited means prohibited; obligations don't scale it down. Why this step? Beginners assume "add oversight = allowed". For C1 there is no ladder rung below it — you fall off the top.

Answer: Tier = Unacceptable → banned outright. Obligation load = ∞ (recall: no finite pile of paperwork makes it legal — you may not ship).

Verify: Cross-check the tier against the Charter derivation in the parent note: social scoring violates dignity (Art. 1) and freedom of thought (Art. 10). Why this check matters: it independently confirms the "banned" verdict from a different source (human-rights law, not the risk-tier list) — if two independent routes agree, we haven't misread the list. A right-violating system with no proportionate law-enforcement carve-out ⇒ prohibited. Consistent. ✓

Example 2 — Cell C2: Clear High-risk

Forecast: Guess the tier AND the obligation count before reading on.

Name the function + who it touches. It influences a medical decision that can be life-threatening. Why? Medical devices are a named high-risk category — the domain itself is the trigger.
Confirm it's not banned. Diagnosing disease is not on the red-line list. Why? Always rule C1 out before settling on C2 — the ladder is climbed from the top down for danger, but you still confirm you're not off the edge.
Load the full checklist. All 7 obligations from the parent's compliance formula apply: risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy/robustness/cybersecurity. Why? High-risk is "all or nothing" — you don't get to pick a subset.
Pin the numeric bars. Parent note example gives clinical thresholds: sensitivity $\geq 95%$ , specificity $\geq 90%$ . Why? The accuracy obligation is only meaningful with concrete pass/fail numbers.

Answer: Tier = High-risk. Obligation load = 7 / 7, with sensitivity $\geq 0.95$ and specificity $\geq 0.90$ as hard bars.

Verify: Suppose a validation run gives 96 true positives out of 100 sick patients and 92 true negatives out of 100 healthy patients. $sensitivity = \frac{96}{100} = 0.96 \geq 0.95 ✓ specificity = \frac{92}{100} = 0.92 \geq 0.90 ✓$ Why this check matters: the accuracy obligation is not satisfied by saying "we're high-risk, we tried" — it is only satisfied when measured performance clears the legal numbers. This plug-in shows a concrete deployment that would actually pass audit, proving the thresholds are reachable and that our stated bars (0.95, 0.90) are the ones being tested against. Both bars cleared. See 6.4.4-Robustness-and-adversarial-examples for why the robustness clause forces testing across scanner types too.

Example 3 — Cell C3: Clear Limited

Forecast: Which single word from the definitions is the whole obligation here?

Before the steps, unpack the transparency rule in plain words so the equation below is earned, not dropped.

Definition The transparency obligation, term by term

The Limited-risk duty is a sum of two separate things a user is owed. Write it as: $User Awareness = Clear Disclosure + Right to Know$ Read the " $=$ " as "is achieved by" and the " $+$ " as "AND — both parts are required, not either/or":

Clear Disclosure ::: an active statement the system pushes at you, e.g. the line "You're chatting with an AI" shown before you type. The provider must volunteer it.
Right to Know ::: your standing entitlement to ask and be told that a machine, not a person, is behind the interaction — even if you weren't shown a banner.
The " $+$ " means both must hold. A banner with no way to confirm, or a confirmable-on-request system with no banner, each fails half the duty. There is no partial credit — this is a logical AND, not an arithmetic sum.

Function 1: chatbot. Users interact with a machine that could be mistaken for a human. Why this step? The trigger for Limited-risk is confusion about who/what you're talking to.
Apply the transparency formula. Using the definition above, satisfy both terms: push a Clear Disclosure ("You're chatting with an AI") and honour the Right to Know (a user can confirm on request). Why this step? People behave differently with humans vs. machines — disclosure restores informed choice, and only the AND of both parts fully restores it.
Function 2: synthetic spokesperson = a deepfake. Must be labelled as AI-generated/synthetic. Why this step? Prevents the video being mistaken for a real endorsement (misinformation control).

Answer: Tier = Limited-risk. Obligation load = transparency only — one disclosure line for the chatbot, one "synthetic" label on the video. No documentation, no oversight, no audits.

Verify: Contrast test — remove the human-confusion element (e.g. the bot clearly says "AI Assistant" in its name so no reasonable user is fooled). Why this check matters: it tests whether we identified the right trigger — if the classification survives removing the disclosure banner but nothing higher appears, then no rights/safety trigger was ever present and we can't have under-shot the tier. The disclosure trigger weakens, but the label is cheap, so we comply anyway. No higher trigger present ⇒ cannot be High. Consistent with the ladder (one rung up from Minimal). ✓

Example 4 — Cell C4: Clear Minimal

Forecast: How much paperwork? (It's a trick — guess the number.)

Ask: does it touch a fundamental right or safety? Monsters attacking on-screen: no. Filtering spam: no life-altering decision about a person. Why this step? If no trigger fires at all, you're at the bottom of the ladder by default.
Confirm no confusion trigger. Nobody thinks the game monster is a real person, and spam filtering isn't a conversation. Why this step? Rules out even the Limited tier.

Answer: Tier = Minimal-risk. Obligation load = 0 (voluntary codes of conduct only).

Verify: Obligation count 0 is the floor; there is no lower tier to fall into, and no trigger to climb from. Why this check matters: it confirms we landed on the very bottom rung of the ladder figure — if a check ever produced a negative obligation count it would mean the scheme has a hole below Minimal, which it must not. Count = 0 is legal and stable — matches "most AI applications get no burden" from the parent. ✓

Example 5 — Cell C5: Boundary — "looks banned but isn't"

This is the trap the parent's [!mistake] callout warned about. It deserves a figure because the context is the whole answer.

The figure shows one algorithm (facial recognition) fanning into three columns. Reading the columns:

Left column (chalk pink) — the RED / banned column. Its three stacked conditions are exactly live (real-time), public space, and mass identification. It is banned precisely because all three conditions hold at once.
Middle column (pale yellow) — High-risk. Conditions: post-hoc (recorded footage) + targeted (one suspect) + judge approval.
Right column (chalk blue) — Minimal. Conditions: private device + you opted in + one user.

Keep the phrase "live + public + mass" in mind — that trio is the whole red line.

Forecast: Same tech, three answers. Which one is banned, which is High, which is Minimal/Limited?

(a) Live + public + mass. All three red-line conditions present at once (these are exactly the three stacked in the figure's red / pink column: live, public, mass). Why this step? Real-time mass biometric ID in public creates a permanent chilling effect — the exact banned pattern. ⇒ Unacceptable (banned).
(b) Post-hoc + targeted + judicial oversight. The "live" and "mass" conditions are gone; a narrow law-enforcement exception with a warrant applies. Why this step? Removing the real-time/mass elements removes the trigger for prohibition; but identifying people in a law-enforcement context is still High-risk (needs oversight, logging). ⇒ High-risk (allowed with the full checklist).
(c) Private device, one consenting user. No public space, no mass surveillance, you opted in. Why this step? None of the biometric-surveillance triggers fire; and there is no confusion trigger either — a person unlocking their own phone knows perfectly well a machine is authenticating them, so the Limited-tier "did you know it's AI?" duty has nothing to bite on. ⇒ Minimal — not Limited, because the only thing that could have lifted it to Limited is a confusion trigger, and there is none.

Answer: (a) Banned, (b) High-risk, (c) Minimal (Limited is ruled out for the reason in step 3: no confusion trigger). Same algorithm; the context flips the tier.

Verify: Cross-check with the parent's [!mistake] fix: banned = real-time + public + mass; still-allowed = post-event analysis and non-public device unlock. Why this check matters: the parent note is our ground truth for this exact boundary — mapping our three answers onto its three named rows proves we didn't invent a boundary that the law doesn't draw. Our three answers map exactly onto those three rows. ✓

Example 6 — Cell C6: Degenerate input

Forecast: Does the fact that it's just rules, not learning, keep it out of the law entirely?

Test whether it's in scope — carefully. A common trap: "no learning ⇒ not an AI system." Wrong. The EU AI Act's definition of an AI system explicitly includes logic- and knowledge-based (rule-based) approaches, not just machine learning. So a deterministic rule engine can still count as an AI system. Why this step? This is the whole point of the degenerate cell — the naive escape hatch ("it's only rules") does not work.
So classify it by function, like everything else. What does it do to people? It computes tax deterministically — no discretionary, rights-affecting decision. Tax computation is not a named high-risk domain and is not a red line. Why this step? Being in scope only tells you the sorting machine applies; the tier is still decided by the impact on people.
Land the tier. No rights/safety trigger and no confusion trigger fire ⇒ bottom of the ladder. Why this step? Same reasoning as Example 4 — absence of every trigger means Minimal.

Answer: Tier = Minimal-risk (it is likely an AI system under the Act's broad definition, but a harmless one). Obligation load = 0 binding obligations, voluntary codes only. The "AI-powered" marketing neither adds nor removes duties — the function decides.

Verify: Degenerate check — the classification must not depend on the learning vs. rules distinction (the Act refuses that distinction) nor on the marketing label. Why this check matters: a robust classifier must give the same answer no matter how the system is implemented or advertised; if flipping "ML" to "rules" changed the tier, our rule would be reacting to the wrong feature. Both invariances hold: rule-based is still in scope, and the tier is still 0 obligations by function. Answer stable. ✓

Example 7 — Cell C7: Multi-trigger (worst-tier-wins)

Forecast: Three functions, three possible tiers. What tier does the whole product inherit?

Tier each function separately.
- (i) CV screening ⇒ High (employment is a named high-risk domain).
- (ii) Chatbot ⇒ Limited.
- (iii) Layout recommender ⇒ Minimal. Why this step? You must find every trigger before combining — miss one and you under-comply.
Apply worst-trigger-wins. $max (High, Limited, Minimal) = High$ . Why this step? A dangerous sub-function can't be hidden behind harmless ones — the strongest trigger governs.

Answer: Whole platform = High-risk ⇒ full 7/7 checklist, plus a transparency label on the chatbot sub-part. Beware reward-hacking in the screening model — see 6.4.2-Reward-hacking — where the model games a proxy metric like "keyword match" instead of true fit.

Verify: Ranking the tiers as Minimal=0, Limited=1, High=2, Unacceptable=3, the platform's tier is $max (2, 1, 0) = 2 = High$ . Why this check matters: it pins down which operator combines sub-tiers. If we had wrongly averaged instead of taken the max we'd get $\frac{2 + 1 + 0}{3} = 1 =$ Limited — which would let a genuinely high-risk hiring tool ship with almost no safeguards. The check proves max (not mean) is the safe operator. ✓

Example 8 — Cell C8: Real-world word problem

Forecast: Guess the tier, then guess the euro cost within €10k.

Classify. AI deciding access to education ⇒ named High-risk domain. Why this step? Education is explicitly listed; the essay score gates admission, a life-altering outcome — this is the trigger.
Confirm the record-keeping obligation is real. High-risk mandates a log per prediction, so the €2-per-essay term is a legally required cost, not optional tooling. Why this step? You may only include a cost term if an obligation forces it; here record-keeping does.
Set up the cost. First-year cost = fixed compliance + per-essay logging: $C = 40000 + 2 \times 10000$ Why this step? Separating the one-off fixed cost from the per-unit variable cost is the standard "fixed + variable" cost model.
Compute. $C = 40000 + 20000 = 60000 euros.$ Why this step? Plugging the projected volume (10,000) into the variable term gives the concrete first-year figure.

Answer: Tier = High-risk; first-year compliance cost = €60,000. Data governance must ensure the training essays span diverse student backgrounds, or the model risks disparate impact — the same failure mode as the medical example.

Verify: $40000 + 2 \cdot 10000 = 60000$ . Why this check matters: first, the units must come out as euros — $euros + (euros/essay \times essays) = euros$ — confirming we didn't mix a rate with a total. Second, check the variable share: logging is €20,000, which is $\frac{20000}{60000} = 33.3%$ of the total — a third of the bill, so it is material and correctly belongs in the model rather than being rounded away. ✓

Example 9 — Cell C9: Exam twist (jurisdiction trap)

Forecast: "They're American, so the EU can't touch them" — true or false?

Find the jurisdiction trigger. The Act applies to any AI system whose output is used in the EU market, regardless of where it's developed or hosted. Why this step? The parent's definition says exactly this — placement/use in the EU, not the developer's address, is the legal hook.
Apply it here. French applicants are screened using the outputs ⇒ the output is used in the EU ⇒ in scope. Why this step? Both the affected people and the decision sit inside the EU, so the "developed abroad" fact is irrelevant.
Now tier it by function. Employment screening ⇒ High-risk ⇒ full 7/7 checklist. The US developer must also appoint an EU authorised representative. Why this step? Once in scope, classification is the same function-based test as any other example — nationality never enters it.

Answer: Yes, the Act applies (extraterritorial reach); tier = High-risk, 7/7 obligations. "Built abroad" is not an escape hatch.

Verify: Consistency check against Ex. 2 and Ex. 7: employment + affecting people in the EU ⇒ High every time, developer location irrelevant. Why this check matters: the twist changes only one variable — the developer's nationality — which the Act's scope definition says is not a factor. A correct rule must therefore return the same tier as the plain employment cases; if our answer had flipped, we'd have wrongly let jurisdiction leak into the tier decision. The tier is unchanged ⇒ rule behaves correctly. ✓

Recall Self-test (reveal after answering)

Live facial recognition of a public crowd by police is which tier? ::: Unacceptable — prohibited (live + public + mass all fire). A hiring AI built in the US but screening EU applicants — in scope? ::: Yes; output used in EU ⇒ High-risk. A product with a High sub-function and a Minimal sub-function inherits which tier? ::: High (worst-trigger-wins / max rule). First-year cost of EduRank (€40k fixed + €2 × 10,000 logs)? ::: €60,000. A purely rule-based tax program marketed as "AI" — in scope, and obligation load? ::: In scope (the Act covers rule-based systems), but Minimal-risk ⇒ 0 binding obligations. Why is phone Face ID Minimal, not Limited? ::: No confusion trigger — you know your own phone is a machine authenticating you, so the transparency duty has nothing to bite on.

For the deeper "why do we even bother" foundations, see 6.4.5-AI-safety-research and 6.4.12-Long-term-existential-risks; for why transparency requires explaining a decision, see 6.4.3-Interpretability-and-explainability. Back to the parent: EU AI Act overview.