Regulation: EU AI Act: Art. 5 and the RiskTier literal unknown/minimal-risk/limited-risk/high-risk/unacceptable (forgelm/config.py:1238) (aging) (TECH-T10-005) #495

Wave 2 · theme D2-7: Next-release technology updates · highest severity Next release · 1 finding(s) · effort not estimated

Summary

1. config.py:1268 implies Annex IV is the consequence of an Art. 5 'unacceptable' system. 2. The default 'minimal-risk' silently writes a classification nobody made (design-risk). 3. 'unacceptable' is warning-only (footgun). 4. There is no GPAI flag. 5. The Dec 2026 prohibitions are absent from the Art. 5 banner and the safety docs.

Primary finding

TECH-T10-005 — Regulation: EU AI Act: Art. 5 and the RiskTier literal unknown/minimal-risk/limited-risk/high-risk/unacceptable (forgelm/config.py:1238) (aging)

severity Next release

Item. Art. 5 and the RiskTier literal unknown/minimal-risk/limited-risk/high-risk/unacceptable (forgelm/config.py:1238) · verdict: aging · urgency: Next release

State in ForgeLM. forgelm/config.py:1238 defines RiskTier = Literal['unknown','minimal-risk','limited-risk','high-risk','unacceptable']. The comment at :1232-1234 maps unacceptable to Art. 5, high-risk to Art. 6, and limited/minimal to transparency-only/unrestricted. Both fields default to 'minimal-risk' (:1267, :1319). :1268 says 'high-risk and unacceptable trigger Annex IV documentation requirements'. For 'unacceptable', _warn_unacceptable_practice (config.py:~1812-1820) only logs a warning ('ForgeLM will not refuse the run'). The default tier is written into annex_iv_metadata (forgelm/compliance.py:1553-1561, 2969-2977). There is no GPAI-model dimension and no new Art. 5 prohibition.

State of the ecosystem on 2026-10-01. The Act's structure is unchanged by the Omnibus: prohibited practices (Art. 5), high-risk (Art. 6, with the Art. 6(3) derogation), transparency obligations (Art. 50) and minimal risk. The Commission page lists 'transparency risk', not 'limited risk'. GPAI models are a separate regime (Ch. V). Reg. 2026/1744 Art. 1(7) inserts Art. 5(1)(ba) (non-consensual intimate imagery) and (bb) (CSAM), plus Art. 5(1a)/(1b). Under (1a)(a)(ii), placing a system on the market is prohibited where generation of such material is a 'reasonably foreseeable and reproducible outcome' and the system lacks 'reasonable and adequate technical safety measures'. These apply from 2 Dec 2026 (amended Art. 113(3)(a)) and are directly relevant to generative fine-tunes.

Impact. 1. config.py:1268 implies Annex IV is the consequence of an Art. 5 'unacceptable' system. 2. The default 'minimal-risk' silently writes a classification nobody made (design-risk). 3. 'unacceptable' is warning-only (footgun). 4. There is no GPAI flag. 5. The Dec 2026 prohibitions are absent from the Art. 5 banner and the safety docs.

Recommendation. Keep the literal so the change is not breaking. Re-describe the tiers: 'limited-risk' = the Art. 50 transparency tier; 'unacceptable' = prohibited, with no documentation route. Consider defaulting to 'unknown' or warning when the default is never overridden. Consider refusing 'unacceptable' without an explicit override. Mention Art. 5(1)(ba)/(bb) (from 2 Dec 2026) in the Art. 5 banner and the safety guide, noting that safety-eval results are evidence of safeguards, not proof.

Sources.

• Regulation (EU) 2026/1744, Art. 1(7) (Art. 5 amendments), Art. 1(40)(a) (2026-07-24)
• Regulation (EU) 2024/1689, Arts 5, 6, 11, 50 (2024-07-12)
• European Commission: AI Act page (4 risk levels; prohibition 9 from December 2026) (2026-08-03)
• FPF AI Act timeline (new prohibited practice from 2 December 2026) (2026-07-28)

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}