# EU AI Act: Risk Classification and Evidence Capability

Risk classification under Article 6, data governance under Article 10, documentation under Annex IV. Evidence arises in daily operations, not afterward.

Dargestellte Fassung: https://simo-online.com/en/why-simo/eu-ai-act

## Evidence capability under the EU AI Act for companies in the DACH region

EU AI Act Compliance

Risk classification, procedure documentation, audit-proof evidence and the overlap with GDPR. What Articles 6, 9, 10 and 13 require, anchored in day-to-day operations instead of attested afterward.

EU AI Act: what an institution actually has to produce

- Risk classification of your procedures under Article 6: prohibited, high-risk, limited, minimal.
- Data governance under Article 10: the origin of the underlying data, bias review, representativeness.
- Technical documentation under Article 11 and Annex IV: description of the procedure, method, evaluation criteria.
- Transparency obligations under Article 13: what affected persons and auditors must be able to see.
- Where this overlaps with GDPR: lawful bases under Article 6, automated decisions under Article 22, impact assessment under Article 35.

Four risk tiers, four control levels

The regulation classifies procedures by risk. The tier determines what an institution has to produce.

Typical procedures

What is required

## Prohibited

Article 5

Social scoring, real-time biometrics in public spaces

Full ban. Use is ruled out, regardless of intent.

## High-risk

Article 6 and Annex III

Credit scoring, candidate selection, access to education

Conformity assessment, technical documentation, data governance, logging, transparency.

## Limited

Article 50

Chatbots, generated content, deepfakes

Labeling obligation. Users must be able to recognize that they are dealing with an AI system.

## Minimal

Recital 27

Spam filters, recommendation logic, game characters

No obligation. A voluntary code of conduct is possible.

This is where SIMO works

We set up your operations so that this evidence arises in the course of everyday business. No compliance stamp applied afterward, evidence from the outset.

Pyramid showing the four risk tiers of the EU AI Act, from "prohibited" at the top to "minimal" at the base. SIMO works on the "high risk" tier.