Skip to content
Arcus
Classification

How Classification Works

Last updated February 17, 2026

Learn how Arcus classifies your AI systems using advanced AI analysis and regulatory expertise.

Overview

Arcus uses a combination of AI-powered analysis and regulatory knowledge to automatically classify your AI systems according to the EU AI Act.

Classification Time: 10-30 seconds per system

The Classification Process

Step 1: Information Gathering

When you register an AI system, Arcus collects:

  • System name and purpose
  • Technical description
  • Use case and sector
  • User groups
  • Data types and sources
  • Decision-making authority
  • Risk indicators

Why This Matters: More detailed information = more accurate classification.

Step 2: AI Analysis

Arcus uses Claude (Anthropic) to:

  1. Parse your system description
  2. Identify key risk factors
  3. Match against EU AI Act criteria
  4. Analyze use cases and context
  5. Consider sector-specific rules
  6. Evaluate potential impacts

Step 3: Risk Determination

The AI evaluates your system against:

Prohibited Practices

  • Social scoring
  • Subliminal manipulation
  • Vulnerability exploitation
  • Real-time remote biometric identification

High-Risk Categories

  • Employment decisions
  • Credit scoring
  • Education and training
  • Law enforcement
  • Critical infrastructure
  • Healthcare
  • Biometric systems

Transparency Triggers

  • Chatbots and conversational AI
  • Emotion recognition
  • Deep fake generation
  • Recommendation systems

Step 4: Confidence Calculation

Each classification includes a confidence score based on:

  • Clarity of system description
  • Coverage of relevant details
  • Ambiguity in use case
  • Regulatory precedent availability
  • Complexity of the system

Confidence Levels:

  • High (80-100%): Clear, straightforward classification
  • Moderate (60-79%): Some ambiguity, review suggested
  • Low (<60%): Significant uncertainty, expert review recommended

Step 5: Results Delivery

You receive:

  • Risk Classification: Unacceptable, High, Limited, or Minimal
  • Applicable Articles: Specific EU AI Act articles
  • Compliance Requirements: What you need to do
  • Recommendations: How to improve or mitigate risks
  • Confidence Score: How certain the AI is

What Influences Classification?

Primary Factors

Purpose and Use Case

The intended use is the most important factor.

Example: Facial recognition

  • Photo organization app → Minimal Risk
  • Employee attendance tracking → High Risk
  • Real-time public surveillance → Prohibited

Sector and Domain

Certain sectors trigger automatic high-risk classification:

  • Critical infrastructure
  • Education
  • Employment
  • Finance (credit decisions)
  • Law enforcement
  • Healthcare

Decision-Making Authority

Systems that make or significantly influence consequential decisions:

  • Automated decisions → Higher risk
  • Human-in-the-loop → May reduce risk level
  • Advisory only → Often lower risk

Impact on Individuals

Who is affected and how:

  • General population → Risk depends on use case
  • Vulnerable groups (children, elderly, disabled) → Higher risk
  • Fundamental rights impact → Higher risk

Secondary Factors

  • Data sensitivity: Use of biometric, health, or other sensitive data
  • Scale of deployment: Millions of users vs. internal tool
  • Reversibility: Can decisions be easily reversed?
  • Transparency: Is AI use disclosed to affected persons?

Understanding the Output

Classification Report

After analysis, you'll see:

Risk Level: HIGH RISK
Confidence: 85% (High Confidence)
Category: Employment, Education and Vocational Training

Applicable Articles:
- Article 6(2): High-risk AI systems
- Article 10: Data governance
- Article 13: Transparency obligations
- Article 14: Human oversight

Reasoning:
This system makes automated decisions affecting employment 
outcomes, specifically recruitment and candidate evaluation. 
Under Annex III, section 4(a) of the EU AI Act, AI systems 
used for recruitment or selection of natural persons are 
classified as high-risk.

Compliance Requirements:
✓ Risk management system
✓ Technical documentation
✓ Record-keeping and logging
✓ Transparency to candidates
✓ Human oversight mechanisms
✓ Accuracy and robustness testing

Recommendations:
1. Implement comprehensive logging of all hiring decisions
2. Establish clear human review process before final decisions
3. Document training data sources and bias testing
4. Create candidate disclosure templates
5. Set up periodic accuracy monitoring

Confidence Indicators

High Confidence (80-100%)

  • Clear regulatory guidance exists
  • System matches well-defined category
  • Use case is straightforward
  • No ambiguity in description

Moderate Confidence (60-79%)

  • Some interpretation required
  • Could affect multiple categories
  • Limited precedent available
  • Description could be more detailed

Low Confidence (<60%)

  • Significant regulatory ambiguity
  • Novel or emerging use case
  • Insufficient system information
  • Borderline between categories
  • Expert review strongly recommended

Improving Classification Accuracy

Provide Detailed Descriptions

Instead of:

"Machine learning model for HR"

Try:

"Machine learning model that screens job applications by analyzing resumes against job requirements. The system ranks candidates from 1-100 based on skills match, experience, and qualifications. Hiring managers review top-ranked candidates before making final hiring decisions."

Include Context

Explain:

  • How the system is actually used
  • Who makes final decisions
  • What happens to the output
  • How often humans intervene
  • What safeguards are in place

Specify the Industry

Different rules may apply:

  • Healthcare AI vs. marketing AI
  • Financial services vs. e-commerce
  • Public sector vs. private sector

List All Use Cases

If your system has multiple functions:

  • List each capability separately
  • Explain how they interact
  • Note which is the primary use case

Special Cases

General Purpose AI

Foundation models and general-purpose AI (like GPT, Claude):

  • Have specific obligations under the Act
  • Downstream applications classified separately
  • Both provider and deployer have responsibilities

In Arcus:

  • Classify the specific application you're building
  • Not the underlying foundation model itself

AI Components vs. Full Systems

Example: E-commerce platform

The platform itself may be low-risk, but:

  • Product recommendation AI → Limited Risk (transparency)
  • Dynamic pricing AI → Potentially High Risk depending on use
  • Fraud detection AI → Risk depends on consequences

In Arcus:

  • Register each AI component separately
  • Classify based on the component's specific function

Multi-Jurisdictional Systems

If operating globally:

  • EU AI Act applies if you serve EU users
  • Can assess against other frameworks simultaneously
  • Compliance requirements may stack

Arcus Approach:

  • Primary classification under EU AI Act
  • Additional assessments for UK, US, etc.
  • Comparison view for differences

After Classification

High-Risk Systems

Next steps:

  1. Review requirements specific to your system
  2. Generate documentation using Arcus templates
  3. Create remediation tasks for compliance gaps
  4. Set up monitoring for ongoing compliance
  5. Schedule re-classifications for updates

Limited Risk

Next steps:

  1. Implement transparency measures
  2. Create disclosure templates
  3. Update privacy policies
  4. Train staff on disclosure requirements

Minimal Risk

  • No specific legal obligations
  • Consider voluntary best practices
  • Monitor for regulation updates

When Classifications Change

Regulation Updates

  • Arcus monitors regulatory changes
  • You'll be alerted to relevant updates
  • Re-classification may be triggered automatically

System Updates

Trigger re-classification if:

  • Purpose or use case changes
  • New features added
  • User base expands
  • Sector deployment changes
  • Decision-making authority shifts

Arcus Recommendation: Re-classify annually at minimum.

Challenging a Classification

Disagree with the result?

  1. Review the reasoning carefully
  2. Check if description was detailed enough
  3. Request expert review (available on Professional/Business plans)
  4. Provide additional context and resubmit

Remember: You're responsible for compliance, so final determination is yours to justify.

Technical Details

AI Model

  • Provider: Anthropic
  • Model: Claude (Anthropic)

Data Privacy

All classification data:

  • Hosted in Australia (Supabase Sydney region)
  • Encrypted in transit and at rest
  • Isolated per organisation with row-level security
  • Never shared with third parties
  • Can be deleted upon request

FAQs

Q: How often is the classification AI updated?

A: We update the model whenever:

  • EU AI Act guidance evolves
  • New legal precedents emerge
  • Classification accuracy can be improved

Q: Can I override the classification?

A: Yes, but you must document justification for audits

Q: What happens if I disagree?

A: Request expert review or provide more detailed information

Q: Is the AI perfect?

A: No AI is perfect. That's why we provide confidence scores and expert review options.

Learn More

Arcus classifications are guidance, not legal advice. Consult legal professionals for compliance decisions.

Was this article helpful?