The EU AI Act is the first broad, binding regulation specifically aimed at AI systems rather than data processing in general, and it’s structured around a risk-based idea: different AI use cases get different levels of scrutiny depending on the potential harm they pose. Most WordPress AI features, a chatbot, a content-summarization tool, an SEO-suggestion assistant, sit at the lower end of that scale. That’s a useful, generally true observation, and also exactly the kind of statement that shouldn’t be trusted blindly for any specific feature you actually ship. This lesson walks through the general structure so you can reason about where a feature likely falls, clearly labeled as guidance, not a determination.
Course 1’s overview of the WordPress AI stack. No new WordPress APIs are introduced in this lesson, it’s entirely about the regulatory landscape those APIs operate inside.
This lesson describes the EU AI Act’s general, publicly-documented structure at a conceptual level. It is not legal advice, it does not classify your specific feature, and AI regulation is an actively evolving area with phased timelines and ongoing guidance from regulators. Any real determination of which tier a feature falls into, and what obligations follow from that, should come from qualified legal counsel, not from this course.
Step 1: The general shape of the four tiers
The Act’s risk-based structure is commonly described using four tiers. This is a simplified, general summary, not a substitute for the regulation’s actual text or official guidance.
| Tier | General idea |
|---|---|
| Unacceptable risk | A small set of AI practices considered to pose an unacceptable threat, such as certain forms of social scoring or manipulative systems, are prohibited outright. |
| High risk | Systems used in sensitive contexts, employment decisions, access to essential services, and similar, face substantial obligations: risk assessments, documentation, human oversight, and more. |
| Limited risk (transparency) | Systems like chatbots or AI-generated content face transparency obligations, generally, that people should be able to tell they’re interacting with AI or viewing AI-generated material. Lesson 4 covers this in depth. |
| Minimal risk | Most everyday AI applications, spam filters, simple recommendation logic, fall here and face no AI Act-specific obligations beyond general law. |
Different obligations under the Act phase in on different schedules, and regulators continue to issue guidance that clarifies edge cases. Don’t treat any specific date or obligation you’ve read, including anything summarized here, as fixed and final for your situation, without checking current, official sources first.
Step 2: Where typical WordPress AI features tend to sit, generally
Most of what this track has covered, a support chatbot answering FAQs, an ability that summarizes a blog post, an AI-assisted SEO suggestion tool, a WooCommerce order-status lookup, tends to sit in the limited-risk or minimal-risk range as a general matter. These are typically not systems making automated decisions about employment, credit, essential services, or similarly high-stakes categories, which is the kind of context the high-risk tier is generally aimed at.
Every classification above is a general tendency, not a rule. A feature that looks like an ordinary chatbot on the surface could still raise different questions depending on exactly what it decides, who it affects, and how automated the outcome is. If a feature touches anything resembling a significant decision about a person, treat that as a reason to ask a qualified professional specifically, rather than relying on the general pattern here.
Step 3: What the transparency tier generally implies for developers
The limited-risk tier’s core, generally-understood expectation is straightforward to state even without legal expertise: people interacting with an AI system, or viewing AI-generated content, should generally be able to tell that’s what’s happening. That principle shows up constantly in this track’s earlier work, chatbots, AI-drafted content in Gutenberg, AI-generated product descriptions, and it’s significant enough to warrant its own full lesson next.
Step 4: What to actually do with this lesson
The useful output of this lesson isn’t a classification, it’s a documented starting point for a real conversation. For each AI feature you ship or maintain, write down what it does, what data it touches, and what kind of decision (if any) it makes about a person. That document is what makes a conversation with legal counsel productive instead of open-ended.
Apply it: write a one-page feature summary
Take one AI feature currently in production and write a single page: what it does, what data it processes, what kind of output or decision it produces, and which of the four tiers it most resembles, in your own non-legal judgment. That page is the artifact worth handing to whoever in your organization is responsible for actually determining compliance obligations.
Recap
The EU AI Act organizes AI systems into a small number of risk tiers, unacceptable, high, limited (transparency), and minimal, with obligations scaling to potential harm. Most typical WordPress AI features tend to sit at the lower end of that scale, but “tends to” is a general observation, not a determination for your specific feature. The practical developer task is documenting what a feature actually does clearly enough that a qualified legal reviewer can make the real call, not making that call yourself from this lesson.
Resources & further reading
- AI Act, European Commission, digital-strategy.ec.europa.eu
- EU AI Act, first regulation on artificial intelligence, European Parliament
- GDPR.eu, general compliance guidance, gdpr.eu