06 · High-Risk AI Classification
- Regulation (EU) 2024/1689 + Regulation (EU) 2026/1744 + Commission high-risk guidelines page
- Annex III high-risk Chapter III, Sections 1–3 obligations apply from 2 December 2027. Annex I high-risk Chapter III, Sections 1–3 obligations apply from 2 August 2028.
Annex III high-risk Chapter III, Sections 1–3 obligations apply from 2 December 2027. Annex I high-risk Chapter III, Sections 1–3 obligations apply from 2 August 2028.
Two tracks into high-risk classification (Article 6)
Track 1 — Annex I (regulated products)
AI systems that are a safety component of a product covered by existing EU product safety laws in Annex I (e.g. machinery, toys, medical devices, aviation, motor vehicles, rail, lifts) and that product requires third-party conformity assessment under those Annex I laws.
Regulation (EU) 2026/1744 narrows the definition of a safety component. The AI component must have an intended safety function that prevents or mitigates risks to the health and safety of people or property, or its failure or malfunction must endanger them. Integration into a regulated product does not by itself make an AI system a safety component.
→ Article 6(1) / Annex I high-risk Chapter III, Sections 1–3 obligations apply from 2 August 2028.
Track 2 — Annex III (use cases)
AI systems listed in specific use-case areas in Annex III. Currently 8 areas:
| Area | Examples |
|---|---|
| Biometrics (non-banned) | Remote biometric ID, biometric categorisation, emotion recognition (not banned) |
| Critical infrastructure | AI managing road traffic, water/gas/electricity/heating, digital infrastructure |
| Education & vocational training | Admission decisions, exam scoring, student behaviour monitoring |
| Employment & HR | CV screening, interview analysis, promotion/termination, performance monitoring |
| Essential public & private services | Benefits eligibility, credit scoring, emergency call dispatch, insurance risk pricing |
| Law enforcement | Victim risk assessment, evidence reliability evaluation, offending risk (non-solo profiling) |
| Migration & border control | Visa/asylum examination, border crossing irregular migration risk |
| Justice & democratic processes | Court ruling assistance, election/voting influence tools |
→ Article 6(2) / Annex III high-risk Chapter III, Sections 1–3 obligations apply from 2 December 2027.
Exceptions — Annex III systems that are not high-risk
Under Article 6(3), an Annex III system can qualify for the exception where it poses no significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. At least one of the following conditions must apply:
- Performs a narrow procedural task
- Improves the result of a previously completed human activity
- Detects decision-making patterns or deviations without replacing or influencing a completed human assessment without proper human review
- Performs a preparatory task to an assessment (i.e. not the assessment itself)
Exception does not apply if the system profiles individuals — automated processing of personal data to assess work performance, economic situation, health, preferences, reliability, behaviour, location, or movement. Profiling always makes the system high-risk.
Providers whose system falls under Annex III but believe it's not high-risk must document that assessment before market placement. They must also register the system in the EU database under Article 49(2), using the reduced Annex VIII fields introduced by Regulation (EU) 2026/1744.
Obligations on high-risk AI providers
Once classified high-risk, providers must:
| Obligation | Article |
|---|---|
| Risk management system (documented, lifecycle-long) | Art. 9 |
| Data governance (relevant, representative, error-free datasets) | Art. 10 |
| Technical documentation (Annex IV format) | Art. 11 |
| Automatic event logging / record-keeping | Art. 12 |
| Instructions for use (for deployers) | Art. 13 |
| Human oversight design | Art. 14 |
| Accuracy, robustness, cybersecurity | Art. 15 |
| Quality management system | Art. 17 |
Obligations on high-risk AI deployers
- Implement human oversight as instructed by providers
- Monitor system performance in production
- Report serious incidents and malfunctions to providers and national authorities
- Conduct fundamental rights impact assessments (for certain deployers — public bodies, banks, insurers)
Conformity assessment
See 07 · Conformity Assessment for the full process.
- For Annex I product systems: follow the applicable product-law conformity-assessment procedure; AI Act requirements are integrated into that assessment for Section A systems
- For most Annex III systems: self-assessment (internal conformity assessment) is sufficient
- For Annex III point 1 biometric systems: notified-body involvement depends on the conditions in Article 43, including the use and coverage of harmonised standards or common specifications
After assessment: affix CE marking and issue EU declaration of conformity.
Under Article 49, providers must register Annex III high-risk systems before placing them on the market or putting them into service. Public-authority deployers and people acting on their behalf must register their use before putting the system into service or using it. Annex III point 2 critical-infrastructure systems use national registration; specified law-enforcement, migration, asylum and border-control systems use a secure non-public section of the EU database.
Draft classification guidelines (status: 9 October 2026)
The Commission's high-risk guidelines page still identifies the classification guidance as draft. The targeted consultation closed on 23 July 2026 and states that final adoption is planned by the end of 2026. No final adopted version was located in the 9 October 2026 review. This is a Commission publication target, not a change to the high-risk application dates.
Key articles and annexes
| Topic | Reference |
|---|---|
| Classification rules | Art. 6 |
| Annex I (regulated product laws) | Annex I |
| Annex III (use cases) | Annex III |
| Risk management | Art. 9 |
| Data governance | Art. 10 |
| Technical documentation | Art. 11 + Annex IV |
| Record-keeping | Art. 12 |
| Transparency to deployers | Art. 13 |
| Human oversight | Art. 14 |
| Accuracy/robustness/cybersecurity | Art. 15 |
| Quality management | Art. 17 |
| Conformity assessment | Arts. 43–49 |
| EU database | Art. 71 |
| Fundamental rights impact assessment | Art. 27 |