There is no "itemizing" when each category is required. You go through the risk assessment procedure as prescribed in the relevant standard, and identify the various tasks that people have to do and the risks that they are exposed to when doing those tasks, and assign "severity", "exposure", "avoidance" factors as prescribed in the standard, and *that* tells you what circuit category is required.
But, having been through this many hundreds if not thousands of times, you are likely going to find that all but the most trivial risks are going to require dual channel circuits with safety relays, etc. You may have some risk combinations that allow a lower risk category, but all it takes is one combination that's guarded by the same guarding to require "control reliable" or "category 3" or "performance level d" to govern that the whole thing needs to meet that category or performance level or whatever you want to call it.
The low and decreasing cost of safety-related hardware these days usually isn't worth the aggravation and risk associated with trying to save a few pennies by cheaping out by using a lower risk category.