Risk rating

How Altrum works out an AI system’s risk rating and EU AI Act category, how an assessment updates it, and how guardrails lower the residual rating.

Every AI system has a risk rating, Low, Medium, High or Very high, and an EU AI Act category. Nobody types them in. Altrum works both out from seven answers about the AI system, the same way every time, and shows its reasons. The rating decides what the AI system needs before it goes live (see Lifecycle) and what its posture measures.

The seven questions

You answer them when you register an AI system, and can change them later with Edit risk profile.

Question	Answers
Does it do any of these?	Social scoring; Manipulating or exploiting vulnerable people; Scraping images to build face databases; Emotion recognition at work or in education; Sorting people by sensitive traits from biometrics; Predicting crime by profiling people; Real-time biometric identification in public for law enforcement; None of these. Choose all that apply.
Does it shape decisions about people in any of these areas?	Biometrics; Critical infrastructure; Education; Employment; Essential services; Law enforcement; Migration and borders; Justice and democracy; None of these. Choose all that apply. Count an area when the AI system’s output feeds the decision, even if a person makes the final call.
How do people meet it?	They chat or talk with it; They see content it creates; It makes realistic media of real people or events; It works behind the scenes. Choose all that apply.
What data does it handle?	Personal data; Special category data (health, biometrics, beliefs, sexual orientation or ethnicity); Confidential business data; None of these. Choose all that apply.
Who uses it or sees its output?	Our staff; Customers or partners; The public. The widest group.
Can it take actions?	No, it only suggests; After a person approves; On its own. Using tools, sending messages, changing records and making payments all count.
Does a person review its output before it affects someone?	Always; Sometimes; Never.

None of these and It works behind the scenes cannot be chosen with another answer to the same question.

The EU AI Act category

The first rule that matches sets the category:

If	Category
It does any of the practices in the first question	Prohibited
It shapes decisions in any of the areas in the second question	High risk
People chat with it, see content it creates, or it makes realistic media	Transparency obligations
Otherwise	Minimal

The exceptions in the Act for a narrow task in a high-risk area are not worked out for you. If one applies, choose a different level and say why.

The level

Answers add points:

Answer	Points
Personal data	1
Special category data	2, in place of the 1 for personal data
Confidential business data	1
Customers or partners use it	1
The public uses it	2
Takes actions after a person approves	1
Takes actions on its own	2
Makes realistic media of real people or events	1
A person reviews its output only sometimes	1, only in a high-risk area or when it acts on its own
No person reviews its output	2, only in a high-risk area or when it acts on its own

Then:

Category	Level
Prohibited	Very high, always
High risk	High, and Very high from 4 points
Transparency obligations or Minimal	0 to 1 points Low, 2 to 3 Medium, 4 to 5 High, 6 or more Very high

The reasons Altrum shows start with the category, then name each answer that added points, for example “Employment is a high-risk area under the EU AI Act.” and “Handles personal data.”

Examples

AI system	Answers that count	Rating
Candidate screening	Employment; personal data; suggests only; always reviewed	High, High risk (1 point)
The same, sending rejections on its own	as above, but acts on its own and never reviewed	Very high, High risk (5 points)
Staff coding assistant	people chat with it and see what it creates; confidential data; acts after approval	Medium, Transparency obligations (2 points)
Customer support chatbot	people chat with it; personal data; customers; never reviewed, which does not count here	Medium, Transparency obligations (2 points)
Claims triage agent	essential services; special category data; customers; acts on its own; sometimes reviewed	Very high, High risk (6 points)
Invoice field extraction	behind the scenes; confidential data; staff	Low, Minimal (1 point)
Emotion detection in interviews	emotion recognition at work	Very high, Prohibited

Initial rating and current rating

The initial rating is the one the AI system was registered with, and it never changes. The rating is the current one, and follows the answers as they change. The AI system’s page shows both.

Every change is kept in the Rating history on the AI system’s History tab: who made it, when, and the answers that changed. A change from an assessment reads Assessment accepted.

After an assessment

An assessment often learns more about an AI system than the seven questions did. When its answers point to different risk profile answers, the AI system’s page says so, for example “The assessment of 14 Oct 2026 suggests High, up from Medium.”, with Review.

Review lists each answer that changes, the old one struck through, with the questionnaire answer behind it under the info icon. Then:

• Accept puts those answers into the risk profile and the rules run again. Answers changed by hand since the assessment stay as they are, and so does a level a person chose, unless it is now below the rules’ level without a reason.
• Reject asks why, in 10 to 500 characters: “Say why, in at least 10 characters.” The risk profile stays as it was.

Owners, admins, Governance Leads and the AI system’s owner decide. A newer assessment replaces a suggestion nobody has decided on. A retired AI system gets no suggestions.

If the rating rises on an Approved or Live AI system, it keeps its traffic and needs approval again. See Lifecycle.

Which questions count

Six questionnaire questions feed the risk profile. The rest shape the guardrail suggestions instead.

Questionnaire question	Risk profile question	How the answers map
T1. Who will be able to use this AI system?	Who uses it or sees its output?	Only our own staff: Our staff. Customers or business partners: Customers or partners. The public, or a mix of these: The public.
T2. How do people interact with the system?	How do people meet it?	They type freely: They chat or talk with it. Set options or fixed fields: They see content it creates.
T3. Will the system handle any sensitive or personal information?	What data does it handle?	Names, payment details or government ID numbers: Personal data. Health information: Special category data. Passwords or technical secrets, confidential company documents: Confidential business data. None of these: None of these.
A1. What kinds of personal information might come up in conversations?	What data does it handle?	Any answer, Not sure included: Personal data.
T4. How are the AI’s answers used?	Can it take actions?	For information, to suggest options or to help make a decision: No, it only suggests. To take action on its own: On its own.
E1. Does the AI’s answer go straight to the person, or does someone check it first?	Does a person review its output before it affects someone?	Straight to the user: Never. A person reviews it first: Always.

The first two risk profile questions, prohibited practices and high-risk areas, always keep the answers given at registration. An answer the questionnaire cannot express, such as It makes realistic media of real people or events, is kept.

Residual rating

The residual rating is the rating after your guardrails are counted. When every risk the latest assessment found is covered, it is one level lower than the rating; otherwise it is the same. It never goes below Low, never moves for a prohibited practice, and needs a submitted assessment first: until then it says “Needs an assessment”.

The Residual sits in the AI system’s details and on its Risk tab. The tab lists each risk with its controls and how each control is covered:

Coverage	When
Covered	The control’s guardrail is on in the live version and blocks or masks.
Partly	The guardrail is on but set to Log only.
Not covered	Nothing is live, the guardrail is off, or it checks the wrong side. Input data protection needs the data protection guardrail on what people send, and Output data protection on what the model answers.
Altrum enforces	A control Altrum applies itself, such as logging and audit. It always counts as covered.

A risk is covered when every one of its controls is. Beside the residual, the tab says what would lower it, for example “Switch Harmful Content Filter from log only to block.” with a link to the guardrails. Applying or rolling back a guardrail version changes the residual at once. The EU AI Act category never changes with guardrails.

Choosing a different level

On the Review step, or later in Edit risk profile, a person can keep a level of their own instead of the one the rules give. The rules’ level stays visible beside it.

• A lower level needs a reason of 10 to 500 characters: “Say why the level is lower than suggested, in at least 10 characters.”
• A higher level may have a reason, and does not need one.
• A prohibited practice cannot be given another level: “A prohibited practice cannot be given another level.”

Owners, admins, Governance Leads and the AI system’s owner can change a risk profile. See Members and roles.