The Taxonomy of Harm

Here's the map. Four tiers. At the top, unacceptable risk — banned outright: social scoring, real-time biometric identification in public spaces, systems designed to manipulate behavior. Below that, high risk — hiring, policing, credit scoring, education, critical infrastructure. These don't get banned; they get paperwork. Fundamental Rights Impact Assessments, human oversight, transparency obligations. Then limited risk, where deepfakes get a label that says "made by a machine." And at the bottom, minimal risk — spam filters, video game NPCs — where you can do whatever you want, because nobody's worried about a Bayesian classifier deciding your inbox.

It's a genuinely careful piece of work. Which is exactly the problem.

A classification system is a promise about what you'll regulate, not a guarantee of what won't get built. The fines sound terrifying — €40 million or 7% of global turnover for the banned stuff — until you read the timeline. The provisions phase in over six to thirty-six months after the thing actually passes, and it hasn't passed; this is a negotiating position. By the time the rules bite, the models will have changed shape. They already did once: general-purpose AI got bolted onto the framework late, in 2023, because the taxonomy was drafted before ChatGPT existed. The map was out of date before the cartographers put down their pens.

This is the part the keynote skips. A taxonomy is a design choice, and design choices reflect the mind of the designer. Drawing the categories is the act of deciding which harms are legible — which ones get a tier and which ones don't have a name yet. Technology amplifies what's already there; regulation can only amplify what it can already see. The harm you didn't anticipate doesn't fall into "minimal risk." It falls outside the frame entirely, into the white space past the edge of the map, and there's no fine for operating there because nobody drew a line.

None of which makes the map worthless. A description of the terrain is more than most jurisdictions have managed, and "we named the harms out loud" beats "we'll figure it out after the lawsuit," which is the American model. Credit where it's due: Europe took the question seriously enough to argue about it for two years. Mark the calendar.

But a map is a description of the terrain, not a fence across it. The territory keeps moving while the document gets ratified, translated, and phased in. So start the timer — to the first high-risk system that ships with a Fundamental Rights Impact Assessment stapled to it like a parking ticket nobody reads, fully compliant, perfectly documented, and doing the exact thing the taxonomy was supposed to prevent. It'll be in a tier. It'll just be in the wrong one.