Risk-Based AI Regulation

A risk-based approach regulates AI according to the harm a system could cause, rather than applying identical rules to every AI application. Regulatory scrutiny and obligations increase with the assessed level of risk to safety, fundamental rights, privacy or other public interests. The assessment considers both the AI system and the context in which it is used.

How risk is assessed

Regulators examine the potential severity and likelihood of harm throughout the AI system's life cycle.

• The system's purpose and context of use matter because the same technology can create different risks in entertainment, healthcare or policing.
• Assessment considers the scale of deployment, affected persons, human oversight and whether harm can be reversed or remedied.
• Greater attention is given where decisions affect essential services, legal rights or vulnerable groups.

How regulation changes with risk

A risk-based framework generally creates graduated regulatory responses rather than a single permission or prohibition.

• Uses posing intolerable risk may be prohibited.
• High-risk systems may face conformity assessment, data-governance, documentation, accuracy, cybersecurity, human-oversight and monitoring requirements.
• Systems creating risks of deception or manipulation may attract transparency obligations, such as disclosure that users are interacting with AI.
• Low-risk uses may remain subject mainly to general law, voluntary standards or codes of practice.

Rationale and limitations

The approach seeks proportionality: it concentrates regulatory capacity on serious harms while avoiding unnecessary burdens on benign innovation.

• Its effectiveness depends on clear classification criteria, competent oversight and meaningful accountability across developers and deployers.
• Because risks can change after deployment, continuous monitoring and reassessment are necessary.
• Poor classification can underestimate cumulative, systemic or context-specific harms.

How UPSC asks this