The new EU Regulation 2024/1689 on Artificial Intelligence has been subject to many criticisms, especially from those who believe it is not fully adequate to tackle the needs arising from the growing use of AI systems: a limited number of prohibitions, basic transparency obligations for AI systems that present specific risks of impersonation or deception, a risk management system based on documents and conducted by the same provider of the system. Less attention has been paid to the preliminary option made by the EU legislature to adopt a so-called risk-based approach. This article aims to focus on the choice to regulate AI systems through so-called risk regulation and also ponder the consequences of this choice on the distribution of costs and benefits originating from the use of AI systems and the protection of individual rights. In its final part, the article formulates some proposals that support an interpretation of the Regulation more oriented toward risk distribution and protection of rights.