← Back to Concept Contrast

Concept Contrast Fable

The EU AI Act and high-risk AI systems: one is the whole law, the other is a category marked out within it

Conclusion first:The EU AI Act is a legal framework that defines different risk levels and corresponding compliance obligations. A high-risk AI system is a specific category of object marked as "high-risk" within this law's risk classification system. Treating a law and one of its classification names as concepts on the same level will lead to either over-compliance or omissions during compliance assessment.

The EU AI Act is a legal framework that defines different risk levels and corresponding compliance obligations. A high-risk AI system is a specific category of object marked as "high-risk" within this law's risk classification system. Treating a law and one of its classification names as concepts on the same level will lead to either over-compliance or omissions during compliance assessment.

Fable

A city gate order and a yellow gate drawn inside the city gate order

The Great Zhou dynasty issued a city gate ordinance. The ordinance divided incoming goods into several categories: tea and cloth went through the green gate; medicinal materials, iron tools, and gunpowder went through the yellow gate; weapons and military horses went through the red gate; unseen new goods first went through the white gate and were temporarily held pending classification. Half a year later, the prefecture reported its achievements back to the capital, but submitted only a stack of yellow gate inspection certificates. The capital replied that the yellow gate was neatly done, but the city gate ordinance was not only the yellow gate chapter.

The neighboring county soon had an incident. A batch of unclassified new sulfur powder was treated as ordinary tea goods and went through the green gate, emitting toxic smoke in the rain. Investigation revealed that the prefectural yellow gate was inspected beautifully, but no one managed the pending process at the white gate.

The compliance officer reread the city gate decree: it governs how to classify, what documents each category must submit to enter, post-inspection recordkeeping, cross-state penalties, and annual revisions. The yellow gate is only one gate color, not the entire decree.

He assigned each city gate to a different office: the classification officer handled which gate new goods entered, the inspection officer handled yellow-gate documents, the archive officer handled evidence retention, and the patrol officer handled re-review of old classifications. Each had its own duties, but they had to be able to see one another.

Later, a new process improved an old product from the green door to the yellow door. Only then did the prefecture know that asking "Am I a yellow-door product?" could not be asked just once; when the goods, use, and manner of harm changed, the door color could change too.

Only then did the prefecture realize that the Yellow Gate was just one category of gate under close watch, not the entire city gate ordinance. If only the Yellow Gate clerks were trained, the Green Gate, White Gate, and Red Gate would all be left with gaps; if only the titles of the city gate ordinance were memorized, there would be no understanding of why the Yellow Gate needed stricter rules.

The inspector sent from the capital did not just flip through the Yellow Gate certificate. He went door by door asking: who is responsible for classification, how can cargo owners appeal, who keeps records after an incident, how is cross-state movement tracked. Only then did the prefecture complete the full set of city gate governance, rather than treating the most conspicuous Yellow Gate as everything. Later, when the prefecture trained new officials, it first explained the entire city gate ordinance, then explained why the Yellow Gate was special. New officials no longer treated priority categories as the whole law, nor did they memorize only the title of a law without knowing which gate required strict inspection.

In the annual report, the prefecture wrote more cautiously: the city gate order is a whole living framework, and the yellow gate is a category of objects subject to strict inspection. Meeting the standard for yellow gates does not mean the entire order meets the standard, and a missed inspection at a white gate can poke out just as big a hole.

EU AI Act

The EU AI Act, a legal framework centered on risk classification, covering the full governance chain of classification, conformity assessment, transparency, supervision, enforcement, and penalties.

High-risk AI systems

The specific categories of systems flagged as "high-risk" in the EU AI Act risk classification framework, which must meet stricter compliance requirements — including risk management, data governance, technical documentation, and human oversight.

Story Mapping

  • The full six-part city gate decree: the complete framework of the EU AI Act, covering classification, risk rating, inspection, records, penalties, and amendments
  • The Yellow Gate's verification certificate: a compliance checklist for high-risk AI systems, corresponding only to the specific requirements of one risk level within the framework
  • New sulfur mixed into tea passes the green gate: a white gate miss triggers an incident—doing high-risk compliance well alone does not equal overall compliance
  • Each part is split according to departmental division of labor: each part of the bill corresponds to a different governance issue, and high-risk classification is only one layer of it
  • Goods that did not need approval last year are classified under the yellow gate this year: risk classification is dynamic and requires continuous assessment rather than a one-time check
  • Meeting the yellow gate standard does not mean meeting the city gate order standard: equating high-risk compliance with overall legal compliance is a common compliance blind spot

Putting it into practice in AI compliance system building

The most common mistake teams make in AI compliance is equating "my product is not a high-risk AI system" with "my product is not subject to the EU AI Act." Besides the high-risk category, this Act also has transparency obligations for limited-risk systems, obligations for general-purpose AI, and a process for continuously classifying new categories. The first step in compliance is determining which risk category your system belongs to, not jumping straight to benchmarking against the high-risk checklist. If your compliance budget only allows for one thing, do the classification assessment and continuous classification mechanism first, to ensure you are not suddenly pulled into inspection scope because of a category change.

京ICP备2026014272号