From Categorical to Contextual: Interpreting High-Risk Classification for Profiling-Based AI Recommender Systems in the EU AI Act

Abstract

The EU's AI Act creates regulatory tension for recommender systems through its interaction with the GDPR's profiling provisions. This Article identifies a doctrinal challenge: Article 6(2)'s high-risk classification regime, when combined with GDPR Article 4(4), establishes a binary framework potentially inadequate for varied forms of algorithmic influence. Through doctrinal analysis, a "profiling paradox" is identified, manifesting in three dimensions: (1) conflation of data processing activities with behavioral influence mechanisms, (2) categorical treatment that undermines proportionate risk assessment, and (3) regulatory incentives that favor opaque non-profiling systems over transparent personalization. In comparison with the Digital Services Act's graduated approach, the AI Act's categorical treatment appears to overlook opportunities for more nuanced regulation. This Article proposes a "graduated influence'' doctrine for interpreting Article 6(3)'s "significant risk'' threshold through a multi-factor test examining decisional weight, outcome reversibility, transparency, and user agency. This framework seeks to address regulatory challenges while aligning with fundamental rights objectives.