Limited risk and minimal risk
Limited / transparency risk means disclosure or labelling duties only - inform users they are interacting with AI, label or watermark generated content. Minimal / no risk is where most AI systems fall (spellcheck, spam filters, games) and means voluntary standards at most.
Limited risk means transparency duties. Minimal risk, where most AI systems actually sit, means voluntary standards at most.
- 💬 Chatbots & conversational AI → users must be informed they are interacting with AI (EU Art. 52, mirrored in South Korea and Japan).
- 🖼️ Generative AI outputs → images, video and audio must be labelled or watermarked (China's 2023 GenAI Measures, California SB 942).
- 👔 AI impersonation & professional use → disclosure required in regulated professions like law or medicine (Utah SB 149 / SB 226).
- 😐 Emotion recognition in noncritical settings → requires clear notice to affected individuals (EU limited-risk duties; Japan voluntary guidance).
Illustrative limited-risk systems → chatbots, content-generating systems (email replies, recommendation engines), LLMs (GPT-type), and deepfake generation and editing tools.
| Providers must | Deployers must |
|---|---|
| Inform users they are interacting with AI, not a human; label or watermark AI-generated content; disclose model characteristics - LLMs publish training data, controls and limitations. | Notify individuals subject to emotion recognition or biometric categorisation; clearly disclose deepfakes and manipulated media when published; conduct impact or risk assessments before using high-risk or consequential-decision AI. |
Most AI systems fall here → entertainment and recreational AI (games, music, art for leisure); productivity tools with limited impact (spellcheck, grammar correction, spam filters, inventory management, data visualisation); voluntary standards and codes (Japan AI Guidelines v1.1, OECD, ISO); industry self-governance.
A limited- or minimal-risk use can become high-risk through → repurposing or redesigning the system; adding more data, personal data or a higher-risk context (facial detection becoming facial recognition); or adapting a system that rates past behaviour so it starts projecting future behaviour.