AI Regulations

Regulators sort AI by what it decides, not by which math it uses, and the riskier the use, the heavier the duties before and after launch.

Four risk tiers set the duties: banned uses stop, high risk uses need audits and override, limited risk needs disclosure, minimal risk runs free.

Why Does This Exist?

A bad movie tip wastes an evening. A bad hiring model quietly closes doors for years. The market punishes the first with churn and barely notices the second, so safety cannot rest on goodwill. Regulations set a floor: the more a system touches rights, safety or livelihoods, the more proof it owes before it touches the real world.

This page covers the risk based pattern most frameworks share: banned uses, strict high risk duties, disclosure duties and the free zone. The person who must be able to stop the system lives in human oversight. What safe behavior means lives in safety and alignment. The data duties underneath live in privacy in ML.

Think of It Like This

Building permits, shed to skyscraper

A backyard shed needs little paperwork. If it falls, your lawn suffers. A fifty floor tower needs soil tests, structural audits, fire inspection and signed drawings before anyone moves in. Nobody bans towers. The city prices the proof to the fall.

AI tiers work the same way. A spam filter is the shed. A CV screener or a diagnostic aid is the tower: representative data, audit trails and a human who can override, proved before launch and watched after. The use sets the paperwork, not the brand of the bricks.

Where it stops: buildings stand still once passed, within small drift. Models keep learning from shifting streets, so a passed audit expires. The permit needs a watch, not just a stamp.

How It Actually Works

Lawmakers regulate the use, not the weights, because uses stay still while architectures turn over. Let $U$ be the use case, such as screening CVs or filtering spam. Let $R(U)$ be its tier. Duties grow with the tier and never shrink on appeal to accuracy.

The four tiers

Unacceptable, banned. Uses that threaten rights or safety directly, such as social scoring of citizens or manipulative subliminal systems. No checklist can legalize them. The answer is stop.
High risk, strict duties. Uses that shape lives: hiring, credit, schooling, medical help, critical infrastructure. Duties before launch: prove the data is relevant and representative, keep logs that reconstruct decisions, and build human override into the loop. Duties after launch: watch for drift and bias for the whole service life.
Limited risk, disclosure. Uses that talk or synthesize: chatbots, generated images, emotion claims. The core duty is honesty: tell the person they face a machine and label synthetic media as synthetic.
Minimal risk, free. Games, spam filters, stock helpers. General law still applies, plus voluntary codes, but no AI specific audit gate.

Worked example with four systems

Take four uses and sort them. A citizen scoring system run by an authority: banned, stop. A CV screener: high risk, so it owes a conformity file with data proof, logs and override. A support chatbot: limited risk, so every session must open with a machine notice. A spam filter: minimal risk, general law only.

Now put numbers on the high risk one. Two hundred applicants per group. The model advances 60 in group one and 90 in group two. Selection rates are $60 / 200 = 0.30$ and $90 / 200 = 0.45$ . The disparate impact ratio is $0.30 / 0.45 \approx 0.67$ , under the 0.80 floor, so the conformity file fails and the screener stays held until the data or the thresholds change. The diagram stacks these four tiers as widening rows with the duties written on each row.

Code

A tiny sorter that mirrors the tier logic. Standard library only.

1def risk_tier(decides_lives: bool, banned_use: bool, talks_to_people: bool) -> str:2    if banned_use:3        return "banned"4    if decides_lives:5        return "high-risk"6    if talks_to_people:7        return "limited-risk"8    return "minimal-risk"9
10
11print(risk_tier(False, True, False))  # -> banned12print(risk_tier(True, False, False))  # -> high-risk13print(risk_tier(False, False, True))  # -> limited-risk14print(risk_tier(False, False, False))  # -> minimal-risk

Each printed tier names a duty list: banned means stop, high-risk means audits and override, limited-risk means disclosure, minimal-risk means general law.

Watch Out For

Framing compliance as a launch stamp

Symptom: legal signs off in week one, the model drifts by month three, and nobody rechecks because the file says passed. Selection gaps and calibration move with the street. Fix: schedule the same conformity numbers on live slices, with an owner and a rollback line, as in human oversight.

Pointing up the supply chain

Symptom: your team fine tunes a base model into a high risk helper, then answers audit questions with the base model card. Regulators ask the deployer, which is you. Fix: re prove data, logs and override for your exact use, and keep your own conformity file even when the base was clean.

The Quick Version

Tiers sort uses, not math: banned, high risk, limited risk and minimal risk.
Banned uses stop. No audit can clear them.
High risk systems owe representative data proof, decision logs and human override, before and after launch.
Our CV fixture advances 60 and 90 of 200 per group, scoring 0.67 and failing the 0.80 floor.
Chatbots and synthetic media must disclose the machine.
Compliance is a watch over the service life, and deployers inherit the proof burden.