How to Define Risk Levels for Different AI Uses: The Company's 4-Level Scale and Example Catalog

By Pedro Sonda, dooop

To define risk levels for AI uses, create a single scale with four levels (prohibited, high, moderate, and low) and three parts: classification criteria (impact on people, data sensitivity, system autonomy, external exposure, and ease of error reversal), a catalog of real company examples at each level, and rules on who classifies and when to reclassify. Controls and approval authorities then follow from the level. Thus, a new use is classified within minutes, and governance is proportional: light where risk is low, rigorous where it is high.

Updated in October 2026. Cited standards and bills may change; verify current status before legal decisions.

This content does not replace legal advice.

The Logic of Risk in Regulatory References

Reference	How It Classifies	Source
AI Act (European Union)	Prohibited practices, high-risk systems, transparency obligations for certain systems (such as chatbots), and other minimal risk uses	AI Act, summary
PL 2338/2023 (Brazil)	Excessive risk systems (prohibited) and high-risk systems requiring mandatory algorithmic impact assessment; preliminary risk assessment as best practice	Desinformante, 2024; Chamber
NIST AI RMF	Does not define fixed levels; guides mapping context and impacts and managing risks proportionally	NIST

Interpretation: The main references converge on a risk-based approach, with prohibitions at the top and increasing obligations according to impact. An internal scale aligned with this logic prepares the company for regulation and avoids equal controls for very different uses.

dooop Framework: The 4-Level Scale

Part 1: The Levels

Level	Definition	Consequence
Prohibited	Uses the company has decided not to perform, by principle or by law	Not approved; identified use is stopped
High	Uses that affect rights, opportunities, health, customers' money, or decisions about people, or that act with relevant autonomy	Committee approval; formal assessment; reinforced controls
Moderate	Uses with sensitive internal data, exposure to customers with review, or errors with limited impact	Governance responsible approval; specific controls
Low	Internal productivity uses, with non-sensitive data and natural human review	Allowed within usage policy; recorded in inventory

Part 2: The Criteria

Criterion	Question	Raises level when...
Impact on people	Does it affect someone's rights, opportunities, or treatment?	Hiring, credit, individual pricing, access to services
Data	Does it use personal, sensitive, or confidential data?	Health data, financial data, identified customer data, trade secrets
Autonomy	Does the AI suggest, recommend, or act alone?	Executes actions without case-by-case review
Exposure	Does it interact with customers or the public?	Direct response to customers; published content
Reversibility	Is the error easy to detect and undo?	Silent error, at scale, or irreversible

Practical rule: The level is defined by the highest criterion, not by the average. To assess a specific case before development, see How to Assess Risk Before Developing an AI Use Case.

Part 3: The Catalog of Examples

The scale only works if people recognize their own cases. Generic examples, which each company should replace with its own:

Level	Generic Examples
Prohibited	Automatically deciding layoffs; inserting customer data into unapproved tools; generating content impersonating a real person without authorization
High	Resume screening; credit analysis; agent executing payments; chatbot informing customers about contract terms
Moderate	Contract summaries for legal review; draft responses to customers reviewed by an attendant; internal sales data analysis
Low	Writing internal emails; meeting summaries; public information research; presentation support

Part 4: Who Classifies and When to Reclassify

Rule	Recommendation
Who classifies	The use owner proposes; governance responsible confirms
When in doubt	Classify at the highest level until evaluation
Triggers for reclassification	New data, more autonomy, exposure to customers, regulatory change, incident
Catalog review	Semiannual

How the Scale Connects to the Rest of Governance

Level	Approval Authority	Controls	Review
Prohibited	None	Blocking; communication	Annual (list)
High	AI Committee	See Does Every AI Application Need the Same Level of Control?	Quarterly
Moderate	Governance Responsible	Specific controls	Semiannual
Low	Manager, within policy	Usage policy	Annual

Approval authorities are leadership decisions; see AI Governance: What Should Leadership Decide?.

What to Do Now

Adopt the 4-level scale and adjust criteria to your sector.
Build the catalog with three to five real examples per level.
Classify the current inventory and identify high-risk uses without controls.

To build risk classification and proportional controls, explore dooop's AI Governance front.

Frequently Asked Questions

How many risk levels are ideal? Four is usually the balance: few levels make classification simple, and the "prohibited" level clarifies limits. More levels tend to generate discussion without changing controls.

Do regulated sectors need a different scale? The structure can be the same, but criteria and catalog should reflect sector requirements, and more uses tend to fall into "high."

Does the scale need to follow the AI Act? Companies operating in the European Union must observe the AI Act. For others, aligning the logic helps prepare for similar rules, such as those foreseen in PL 2338/2023.

About dooop

dooop is a consultancy based in Caxias do Sul (RS) that prepares leaders and organizations to transform artificial intelligence into business capability through strategy, governance, and training.