Risk rating

Every AI system has a risk rating: Low, Medium, High or Very high, with an EU AI Act category beside it. Nobody types the rating in. Altrum works it out from the seven answers of the AI system’s risk profile, the same way every time, and shows the reasons.

The seven questions

You answer them when you register an AI system. The info icon next to each question says more.

Question	Answers
Does it do any of these?	Social scoring; Manipulating or exploiting vulnerable people; Scraping images to build face databases; Emotion recognition at work or in education; Sorting people by sensitive traits from biometrics; Predicting crime by profiling people; Real-time biometric identification in public for law enforcement; None of these. Choose all that apply.
Does it shape decisions about people in any of these areas?	Biometrics; Critical infrastructure; Education; Employment; Essential services; Law enforcement; Migration and borders; Justice and democracy; None of these. Choose all that apply. Count an area when the AI system’s output feeds the decision, even if a person makes the final call.
How do people meet it?	They chat or talk with it; They see content it creates; It makes realistic media of real people or events; It works behind the scenes. Choose all that apply.
What data does it handle?	Personal data; Special category data (health, biometrics, beliefs, sexual orientation or ethnicity); Confidential business data; None of these. Choose all that apply.
Who uses it or sees its output?	Our staff; Customers or partners; The public. The widest group.
Can it take actions?	No, it only suggests; After a person approves; On its own. Using tools, sending messages, changing records and making payments all count.
Does a person review its output before it affects someone?	Always; Sometimes; Never.

None of these and It works behind the scenes cannot be chosen with another answer to the same question.

The EU AI Act category

The first rule that matches sets the category:

If	Category
It does any of the practices in the first question	Prohibited
It shapes decisions in any of the areas in the second question	High risk
People chat with it, see content it creates, or it makes realistic media	Transparency obligations
Otherwise	Minimal

The exceptions in the Act for a narrow task in a high-risk area are not worked out for you. If one applies, choose a different level and say why.

The level

Answers add points:

Answer	Points
Personal data	1
Special category data	2, in place of the 1 for personal data
Confidential business data	1
Customers or partners use it	1
The public uses it	2
Takes actions after a person approves	1
Takes actions on its own	2
Makes realistic media of real people or events	1
A person reviews its output only sometimes	1, only in a high-risk area or when it acts on its own
No person reviews its output	2, only in a high-risk area or when it acts on its own

Then:

Category	Level
Prohibited	Very high, always
High risk	High, and Very high from 4 points
Transparency obligations or Minimal	0 to 1 points Low, 2 to 3 Medium, 4 to 5 High, 6 or more Very high

The reasons list the category first, then each answer that added points, for example “Employment is a high-risk area under the EU AI Act.” and “Handles personal data.”

Examples

AI system	Answers that count	Rating
Candidate screening	Employment; personal data; suggests only; always reviewed	High, High risk (1 point)
The same, sending rejections on its own	as above, but acts on its own and never reviewed	Very high, High risk (5 points)
Staff coding assistant	people chat with it and see what it creates; confidential data; acts after approval	Medium, Transparency obligations (2 points)
Customer support chatbot	people chat with it; personal data; customers; never reviewed, which does not count here	Medium, Transparency obligations (2 points)
Claims triage agent	essential services; special category data; customers; acts on its own; sometimes reviewed	Very high, High risk (6 points)
Invoice field extraction	behind the scenes; confidential data; staff	Low, Minimal (1 point)
Emotion detection in interviews	emotion recognition at work	Very high, Prohibited

Initial rating and current rating

Initial rating: the rating when the AI system was registered. It is kept as it was and never changes.
Rating: the current one. When someone changes the risk profile, it follows the new answers. The AI system’s page shows both.

Every change is kept in the Rating history on the AI system’s History tab: who made it, when, and the answers that changed. A change from an assessment reads Assessment accepted.

After an assessment

When an assessment is submitted, Altrum reads its answers against the risk profile. If they change any answer, the AI system’s page shows one line, for example “The assessment of 14 Oct 2026 suggests High, up from Medium.”, with Review. Review lists each answer that changes, the old one struck through, with the questionnaire answer behind it under the info icon. Then:

Accept puts those answers into the risk profile and the rules run again. Answers changed by hand since the assessment stay as they are, and so does a level a person chose, unless it is now below the rules’ level without a reason.
Reject asks why, in 10 to 500 characters: “Say why, in at least 10 characters.” The risk profile stays as it was.

The AI system’s owner, owners and admins decide. Anyone else sees who decides under the info icon. A newer submitted assessment replaces a suggestion nobody has decided, and one whose answers agree with the risk profile leaves none. A retired AI system gets no suggestion. If the rating rises on an Approved or Live AI system, it keeps its traffic and needs approval again. See Lifecycle.

Which questions count

Six questionnaire questions feed the risk profile. The rest shape the guardrail suggestions instead.

Questionnaire question	Risk profile question	How the answers map
T1. Who will be able to use this AI system?	Who uses it or sees its output?	Only our own staff: Our staff. Customers or business partners: Customers or partners. The public, or a mix of these: The public.
T2. How do people interact with the system?	How do people meet it?	They type freely: They chat or talk with it. Set options or fixed fields: They see content it creates.
T3. Will the system handle any sensitive or personal information?	What data does it handle?	Names, payment details or government ID numbers: Personal data. Health information: Special category data. Passwords or technical secrets, confidential company documents: Confidential business data. None of these: None of these.
A1. What kinds of personal information might come up in conversations?	What data does it handle?	Any answer, Not sure included: Personal data.
T4. How are the AI’s answers used?	Can it take actions?	For information, to suggest options or to help make a decision: No, it only suggests. To take action on its own: On its own.
E1. Does the AI’s answer go straight to the person, or does someone check it first?	Does a person review its output before it affects someone?	Straight to the user: Never. A person reviews it first: Always.

The first two risk profile questions, prohibited practices and high-risk areas, always keep the answers given at registration. An answer the questionnaire cannot express, such as It makes realistic media of real people or events, is kept.

Residual rating

The residual rating is what is left of the rating once the guardrails in place are counted. It is one level below the rating when every risk the latest submitted assessment found is covered, and the same as the rating otherwise. It is never below Low, never moves for a prohibited practice, and needs a submitted assessment: until then the page says “Needs an assessment”. The Residual sits in the AI system’s details and on its Risk tab. The tab lists each risk with its controls and how each control is covered:

Coverage	When
Covered	The control’s guardrail is on in the live version and blocks or masks.
Partly	The guardrail is on but set to Log only.
Not covered	Nothing is live, the guardrail is off, or it checks the wrong side. Input data protection needs the data protection guardrail on what people send, and Output data protection on what the model answers.
Altrum enforces	A control Altrum applies itself, such as logging and audit. It always counts as covered.

A risk is covered when every one of its controls is. Beside the residual, the tab says what would lower it, for example “Switch Harmful Content Filter from log only to block.” with a link to the guardrails. Applying or rolling back a guardrail version changes the residual at once. The EU AI Act category never changes with guardrails.

Choosing a different level

On the Review step, or later in Edit risk profile, a person can keep a level of their own instead of the one the rules give. The rules’ level stays visible beside it.

A lower level needs a reason of 10 to 500 characters: “Say why the level is lower than suggested, in at least 10 characters.”
A higher level may have a reason, and does not need one.
A prohibited practice cannot be given another level: “A prohibited practice cannot be given another level.”

Who can change a risk profile: owners, admins and the AI system’s own owner. See Members and roles.

Get started

Your organization

AI systems and assessments

Guardrails

AI Gateway

Reporting, alerts, incidents and proof

Help

The seven questions

The EU AI Act category

The level

Examples

Initial rating and current rating

After an assessment

Which questions count

Residual rating

Choosing a different level

​The seven questions

​The EU AI Act category

​The level

​Examples

​Initial rating and current rating

​After an assessment

​Which questions count

​Residual rating

​Choosing a different level

The seven questions

The EU AI Act category

The level

Examples

Initial rating and current rating

After an assessment

Which questions count

Residual rating

Choosing a different level