Misclassified AI risk tier

What it is

Proportionate governance depends on sorting systems by risk: internal tiers that set the depth of validation and oversight, and legal classes such as high-risk under the EU AI Act. Classification is a judgement, made early, often by the team that wants the system approved. An error downward removes controls precisely where they were needed. It also goes stale: a system correctly classified at launch may warrant a higher tier after its use changes.

How it happens

• The team proposing the system classifies it, with no independent review.
• Criteria are vague, or consider the technology and ignore the use.
• A system is described as decision support when its output is followed without question.
• Classification is not revisited when purpose, population or autonomy changes.

Why it matters

Everything downstream follows from the tier: whether the system is validated independently, how closely it is monitored, who approves it. Legal misclassification can mean operating a high-risk system without conformity assessment, documentation or registration.

Warning signs

• Most systems sit in the lowest tier.
• Classification records give a result and no reasoning.
• No one outside the project reviewed the tier.
• Tiers have not been revisited since launch.

Who owns it

The system owner proposes the classification. A governance or second-line function confirms it independently. Legal advises on regulatory class.

In practice

A recruitment team describes its screening tool as an administrative aid that ranks applications for convenience. It is placed in the lowest tier. In practice only the top-ranked tenth are read. The same pattern generalises to any classification that rests on how a system is described by those who want it approved.