presentsUNAIVERSE
The UN AI timeline

    Learn AI /AI Governance and UN Terminology /Risk-based regulation

    Risk-based regulation

    Also called: risk tiers, risk-based approach.

    Detail

    In five seconds

    What it is

    A way to set stricter rules for uses more likely to cause serious harm, while applying lighter duties to lower-risk uses.

    In plain words

    Instead of giving every AI use the same rule, this approach asks how much harm the use could cause and then matches the rule to that level of risk.

    An everyday example

    In an international office, a team needs to share documents from a knowledge base with new staff. Public training notes can be sent directly. Internal process guides need a manager's check first. Documents containing sensitive personal details are not uploaded to the open portal at all and must go through a protected channel. The team is not saying one document is "good" and another is "bad"; it is matching the handling rule to the possible harm if the document is misused.

    Where the story stops working

    Documents are usually sorted before sharing, while AI risk can change over time with context, scale, users, and new evidence. Also, regulation involves legal definitions, enforcement, and appeals, not just an office filing rule. A use may move between categories depending on purpose, sector, and safeguards, which the document example does not fully show.

    Remember thisThe core idea is simple: the greater the likely harm, the stronger the safeguards and obligations should be.

    This term is contested

    The broad idea is widely used, but the exact definition of risk, the number of tiers, and what belongs in each tier are contested across legal systems and policy communities.

    Understand it

    Understand it

    Why it matters

    Leaders often hear broad claims that AI should either be tightly controlled everywhere or left alone to innovate. A risk-based approach offers a more practical middle path. It helps decision-makers ask: where could harm be serious, who could be affected, and what safeguards are proportionate? That matters for budgeting, procurement, compliance, and public trust. It also shapes how organisations prioritise testing, documentation, oversight, and enforcement. If the risk categories are badly designed, however, important harms can be missed or low-value paperwork can spread too widely. So the quality of the classification matters as much as the idea itself.

    How a risk-based approach turns harms into different obligations

    Show how the same broad technology can face different rules depending on the likely severity and context of harm.

    1. 01

      1. Define the use

      Start with the actual purpose, users, setting, and affected people. The same technical tool may be low risk in one setting and high risk in another.

      Box 1 with icons for tool, context, and people; include a caption saying purpose and sector matter.

    2. 02

      2. Assess possible harm

      Consider what could go wrong, how severe the impact could be, how many people could be affected, and whether rights, safety, or access to services are at stake.

      Box 2 with a checklist and three sliders labelled severity, scale, and affected rights.

    3. 03

      3. Place in a tier

      Use defined criteria to group the use into a category such as minimal, limited, high, or prohibited, depending on the framework.

      Box 3 showing stacked bands from lower to higher risk, with an arrow placing one example into a band.

    4. 04

      4. Apply matching rules

      Higher-risk tiers face stronger duties such as testing, documentation, human oversight, monitoring, or limits on use. Lower-risk tiers face fewer duties.

      Box 4 with a ladder of obligations increasing from transparency to assurance, oversight, and restriction.

    A left-to-right step diagram with four boxes. Read from identifying the use, to estimating harms, to placing it in a risk tier, to assigning matching obligations. Each step shows how information narrows from a broad use case to a concrete regulatory response.

    Hovering or tapping a tier highlights the kinds of obligations that become more likely as risk increases.

    Describe this without the diagram

    This diagram explains a four-step process. First, identify the actual use of the system, including purpose, context, users, and affected people. Second, assess possible harm by looking at severity, scale, and whether safety, rights, or access to services could be affected. Third, place the use into a risk category using defined criteria. Fourth, apply rules that match that category: lower-risk uses may only need transparency, while higher-risk uses may need testing, documentation, human oversight, ongoing monitoring, or restrictions. The main lesson is that the rules depend on the use and likely impact, not only on the underlying technology.

    With reduced motion: A static four-box diagram with arrows from use, to harm assessment, to risk tier, to matching obligations; no animation, only colour and labels to show progression.

    Risk-based regulation groups technologies or uses by the level of harm they could cause, then applies different rules to each group. The basic input is an assessment of risk: what could go wrong, how serious the impact could be, and who could be affected.

    Next, a regulator or organisation sorts systems into categories, often called tiers. A high-risk use might face stronger requirements such as testing, documentation, human oversight, or limits on deployment. A lower-risk use might only need basic transparency, or no special AI-specific rule at all.

    The output is not one single verdict about whether AI is good or bad. It is a structured rulebook that aims to match obligations to likely impact. This is meant to focus attention and resources where failure could affect safety, rights, access to services, or public trust.

    People often confuse this with technology-neutral regulation, which tries to regulate the effect or activity without naming one technology. Risk-based regulation is different: its main organising principle is the level of risk. In practice, a policy can be both risk-based and technology-neutral, but they are not the same idea.

    How “Sorting documents by sensitivity before sharing” maps onto the real thing

    In the storyIn the AI system
    public training notes sent directlylow-risk uses with lighter requirements
    internal guides checked by a managermedium or high-risk uses with added safeguards and oversight
    documents with sensitive personal details blocked from the open portaluses considered unacceptable or subject to very strong restrictions
    sorting by possible harm from misuseclassifying systems by risk rather than treating all uses the same

    A worked example

    Before procurement is cleared, a public employment service assesses two proposed AI uses: a chatbot that explains application procedures and a system that ranks applicants for training places.

    Starting from: The compliance assessment covers intended purpose, possible severity and scale of harm, effects on access to services, reversibility, data used and the level of human oversight.

    1. The chatbot is placed in a lower-risk tier because it provides public procedural information and its mistakes can be corrected relatively easily.
    2. It receives lighter duties, including accuracy checks, notice that users are interacting with an automated system and a route to a staff member.
    3. The ranking system is placed in a higher-risk tier because its output could affect access to a public service and its inputs may reproduce or conceal discriminatory patterns.
    4. It must meet stronger requirements for documentation, data and bias testing, meaningful human review, complaints, record-keeping and continuing monitoring.

    Result: The two uses are not regulated identically merely because both use AI. The obligations reflect the likely seriousness, reach and reversibility of harm from each use.

    In a United Nations workplace

    A partnerships officer in a Headquarters department is finalising the quarterly report to a donor by close of business. A proposed tool can both summarise cleared progress reports and score implementing partners for future funding. The governance review treats these functions separately, applying basic checks to the drafting aid and enhanced documentation, testing, review and approval to the scoring function.

    Risk is assessed by intended use, not by the product label. Summarising cleared material for human review is relatively low risk. Scoring partners could influence funding and carries more serious, less easily reversible consequences, so it belongs in a stricter tier with stronger obligations.

    Before you try thisConfidential partner assessments, funding recommendations and procurement-sensitive material must not be entered into a tool that has not been approved for them. An automated score must not determine a funding decision, because errors or inappropriate proxies could materially affect an implementing partner.

    Where you may hear it

    • During informals on a General Assembly text on AI governance
    • At a technology governance board reviewing a use case before procurement
    • In a procurement meeting when the vendor presents one platform for several functions
    • During a compliance review before a high-impact system is cleared for deployment

    Avoid confusion

    Avoid confusion

    Often confused with

    Common misconceptions

    • It means regulators rank the technology itself from safe to dangerous.

      Usually the focus is the use, context, and possible impact, not the tool in the abstract. The same model may face light rules in one setting and strict rules in another because the consequences differ.

    • Low risk means no risk.

      Low risk usually means lower expected harm or lighter obligations, not zero possibility of error or abuse. General consumer protection, privacy, labour, safety, or sector rules may still apply.

    • Once a system is placed in a tier, the job is finished.

      Risk can change with scale, new users, new data, new evidence, or new uses. A sound framework includes monitoring and re-assessment, not a one-time label.

    • A risk-based approach is automatically fair and neutral.

      Not necessarily. The categories, thresholds, evidence, and exceptions are design choices. If they are poorly drafted, some harms may be underestimated or some groups may receive less protection than intended.

    Quick check

    Which statement best captures a risk-based approach to AI regulation?

    Go deeper

    Go deeper

    The simple version

    Instead of giving every AI use the same rule, this approach asks how much harm the use could cause and then matches the rule to that level of risk.

    The technical version

    Risk-based regulation is a governance design in which regulatory obligations are calibrated to assessed risk rather than applied uniformly across all systems. The regulator first defines relevant risk factors, such as severity of possible harm, scale of impact, reversibility, affected rights or safety interests, sector, intended purpose, and degree of autonomy or human oversight. It then uses those factors to place systems or use cases into categories, often called tiers. Each tier carries different duties, for example transparency, record-keeping, conformity assessment, incident reporting, post-market monitoring, restrictions, or prohibition. The approach can be rule-based or principles-based, and it can operate at several levels: across an entire legal framework, within a sector, or inside organisational governance. It is distinct from technology-neutral regulation, which organises rules around activities or harms without centring one technology, although a legal regime may combine both approaches. Key design questions include how risk is measured, who performs the assessment, whether categories are fixed or dynamic, how enforcement works, and how to handle dual-use systems or general-purpose models whose risk depends heavily on deployment context.

    Reviewed external resources

    • Primary sourceRegulation (EU) 2024/1689 (the AI Act)European Union

      This official legal text gives a concrete example of a tiered AI framework and suits readers who want to see how risk categories can be written into law.

      Deeperlink checked 2026-07-31

    • Primary sourceGlobal Digital CompactUnited Nations

      This UN document shows how AI governance is discussed in a wider international digital agenda and suits readers interested in multilateral policy context rather than detailed legal design.

      Intermediatelink checked 2026-07-31

    • Primary sourceGoverning AI for HumanityUN Secretary-General's High-level Advisory Body on AI

      This report offers a high-level governance discussion that can help readers see where risk-based ideas fit in broader AI oversight debates, and it suits policy and leadership audiences.

      Intermediatelink checked 2026-07-31

    • EncyclopaediaWikipedia search: Risk-based regulationWikipedia

      This Wikipedia search results page helps readers find broad background on the term from multiple entries and suits readers starting with general orientation, but it is not one article.

      search results, not one pagelink checked 2026-07-31

    • VideoVideo explanations: Risk-based regulationYouTube search

      This YouTube search results page helps readers find video explainers with different styles and levels of detail and suits readers who prefer audiovisual learning, but it is not one curated source.

      search results, not one pagelink checked 2026-07-31

    • DiscussionCommunity discussion: Risk-based regulationReddit search

      This Reddit search results page lets readers see public discussion, questions, and disagreements about the term and suits readers who want informal perspectives, but it is not an authoritative source.

      search results, not one pagelink checked 2026-07-31

    Where this came from

    Drafted with a language model through an offline pipeline, checked against this site's schema, and every external link above fetched to see whether it answers. Treat it as a starting point and check anything that matters against the primary sources. How this site is built and what that means.

    The one thing to remember

    The core idea is simple: the greater the likely harm, the stronger the safeguards and obligations should be.