A high-risk AI system under the EU AI Act is one that either is, or is a safety component of, a product covered by the EU harmonisation laws in Annex I and needs third-party conformity assessment, or is used in one of the eight Annex III areas, such as recruitment, credit scoring or education. They carry the Act's heaviest obligations.
Key takeaways
- Article 6 gives two routes into the high-risk category: the product route (Article 6(1) and Annex I) and the use-case route (Article 6(2) and Annex III).
- An Annex III system can fall outside the category under the Article 6(3) derogation, but never if it profiles natural persons.
- Providers carry most of the work: risk management, data governance, technical documentation, logging, human oversight, a quality management system, conformity assessment and EU database registration.
- Deployers have their own, shorter list under Article 26, and some must also run a fundamental rights impact assessment.
- As of October 2026, after the Digital Omnibus, Annex III obligations apply from 2 December 2027 and Annex I obligations from 2 August 2028.
How Article 6 decides what is high-risk
The AI Act sorts AI into four tiers. If you need the whole picture first, read the four EU AI Act risk tiers explained, or start with our EU AI Act guide. This article stays with the second tier, the one where most compliance effort lands. The rules are in Article 6 of Regulation (EU) 2024/1689, and there are two separate ways in.
Route 1: Article 6(1) and Annex I products
An AI system is high-risk if both of these are true: it is intended as a safety component of a product, or is itself a product, covered by one of the EU harmonisation laws listed in Annex I; and that product has to pass a third-party conformity assessment before it can be placed on the market. Annex I covers sectors such as medical devices, machinery, toys, lifts and radio equipment. A diagnostic imaging model inside a CE-marked medical device is the textbook case; the sector's own conformity procedure is used to check the AI requirements too.
Route 2: Article 6(2) and Annex III use cases
The second route does not care about the product. It looks at what the system is used for. If the intended purpose falls inside one of the use cases listed in Annex III, the system is high-risk unless the derogation in Article 6(3) applies. This route catches ordinary business software such as a CV-ranking tool or a lender's credit-scoring model.
To see where your organisation stands overall first, Opsio's free EU AI Act readiness assessment takes about 40 minutes and returns a maturity score across ten governance areas, plus four editable Word documents, including an AI Risk Assessment Template you can use for the classification work in this article.
Need help with cloud?
Book a free 30-minute meeting with one of our cloud specialists. We'll analyse your situation and provide actionable recommendations — no obligation, no cost.
The eight Annex III areas, with business examples
Annex III is written at the level of specific uses, not whole sectors. A bank is not high-risk because it is a bank; its credit-scoring model is. Check the exact annex wording, which includes carve-outs.
| Annex III area | What it covers (summary) | Business example |
|---|---|---|
| 1. Biometrics | Remote biometric identification (not simple identity verification), biometric categorisation by sensitive attributes, emotion recognition | A retailer's camera system that identifies returning shoplifters from a watch list |
| 2. Critical infrastructure | Safety components in the management and operation of critical digital infrastructure, road traffic, and the supply of water, gas, heating and electricity | A model that automatically balances load on a regional electricity grid |
| 3. Education and vocational training | Admission decisions, evaluating learning outcomes, assigning education level, detecting cheating in tests | An online proctoring tool that flags students for suspected cheating |
| 4. Employment and workers management | Recruitment (targeted job ads, filtering applications, evaluating candidates), promotion, termination and task allocation, monitoring performance | An applicant-tracking system that scores and ranks CVs |
| 5. Essential private and public services | Eligibility for public assistance benefits, creditworthiness and credit scores (fraud detection excluded), risk assessment and pricing for life and health insurance, triage of emergency calls | A lender's model that sets a consumer's credit score |
| 6. Law enforcement | Victim or offender risk assessments, polygraph-type tools, evidence reliability, profiling in investigations, where permitted by law | A police tool that rates the reliability of witness evidence |
| 7. Migration, asylum and border control | Polygraph-type tools, security or health risk assessment, examining asylum, visa and residence applications, identifying persons | A system that triages visa applications for manual review |
| 8. Administration of justice and democratic processes | Assisting judges to research and interpret facts and law, influencing elections or voting behaviour (back-office campaign tools excluded) | A tool that drafts suggested rulings for a court |
Customer-service chatbots, marketing copy generators and code assistants are not in Annex III. They may have transparency duties under Article 50, but they are not high-risk unless someone points them at a listed use.
The Article 6(3) derogation: when an Annex III system is not high-risk
Under Article 6(3), an Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights, including by not materially influencing the outcome of decision-making. That is the case where the system is intended to do one of four things:
- A narrow procedural task, such as converting unstructured documents into structured data or removing duplicate applications.
- Improving the result of a human activity already completed, for example polishing the language of a job advert a recruiter has already written.
- Detecting decision patterns or deviations from earlier patterns, without replacing or influencing the human assessment unless there is proper human review, such as flagging that one examiner grades far more harshly than colleagues.
- A preparatory task for an assessment relevant to an Annex III use, such as translating documents before a caseworker reads them.
There is one hard override. An Annex III system that performs profiling of natural persons is always high-risk, whatever else is true. Profiling here carries its GDPR meaning: automated processing of personal data to evaluate personal aspects such as work performance, economic situation, health, reliability or behaviour. A tool that scores candidates on predicted job performance profiles them, so the derogation is not available.
A provider relying on the derogation must document its assessment before placing the system on the market, register the system in the EU database under Article 49(2), and give the documentation to authorities on request.
What providers of high-risk AI must do
The provider develops the system, or has it developed, and places it on the market or puts it into service under its own name, which includes an in-house model built for your own use. The core requirements are in Chapter III, Section 2, and the provider's duties are collected in Article 16.
| Article | Requirement | What it means in practice |
|---|---|---|
| Art. 9 | Risk management system | Identify, estimate and reduce foreseeable risks across the life cycle, with testing |
| Art. 10 | Data and data governance | Relevant, representative data examined for bias; as amended, special-category data may be processed for bias detection where strictly necessary |
| Art. 11 | Technical documentation | Annex IV documentation kept up to date (simplified for SMEs and small mid-caps) |
| Art. 12 | Record-keeping | Automatic event logs for traceability |
| Art. 13 | Transparency to deployers | Instructions for use: purpose, accuracy, limitations, oversight, logs |
| Art. 14 | Human oversight | People can understand, monitor, override or stop the system |
| Art. 15 | Accuracy, robustness, cybersecurity | Declared accuracy, resilience, protection against attacks such as data poisoning |
| Art. 17 | Quality management system | Written procedures for design, testing, data, monitoring and incidents, proportionate to size |
| Art. 43 (with 47, 48) | Conformity assessment | Internal control for most Annex III systems; a notified body for some biometrics; sector procedure for Annex I. Then EU declaration of conformity and CE marking |
| Art. 49 | Registration | EU database registration before market placement |
After launch, providers must run post-market monitoring (Article 72) and report serious incidents to the market surveillance authority (Article 73). Breaches of these obligations can lead to fines of up to €15 million or 3% of worldwide annual turnover, whichever is higher, with the lower figure applying to SMEs and start-ups.
What deployers of high-risk AI must do
Most organisations meet high-risk AI as a deployer that buys an HR or credit tool. Article 26 asks deployers to use the system in line with the provider's instructions, assign human oversight to people with the competence and authority to act, make sure input data under their control is relevant, monitor operation and report risks or serious incidents, keep automatically generated logs for at least six months, inform workers and their representatives before using the system at work, and tell people when a high-risk system is used to make or support decisions about them.
Public bodies, private entities providing public services, and deployers of credit-scoring or life and health insurance pricing systems must also complete a fundamental rights impact assessment (FRIA) before first use. The line between the two roles matters, because a deployer that rebrands, substantially modifies or repurposes a system becomes its provider. We cover this in provider vs deployer obligations under the AI Act.
When the high-risk rules apply
The original Act would have switched on the Annex III rules on 2 August 2026. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved those dates. As of October 2026 the schedule is:
| Obligation | Applies from |
|---|---|
| High-risk obligations for Annex III (stand-alone) systems | 2 December 2027 |
| High-risk obligations for Annex I (product-embedded) systems | 2 August 2028 |
| Public-authority deployers of high-risk systems already in use | 2 August 2030 |
| Article 50 transparency duties (not delayed) | 2 August 2026 |
Fourteen months is short if you have to build a quality management system and write Annex IV documentation. The full schedule, including GPAI dates, is in the EU AI Act timeline after the Digital Omnibus.
A practical classification sequence
- List every AI system you build, buy or embed, including AI features inside SaaS tools. See our guide to building an AI inventory register.
- Screen out prohibited uses under Article 5 first; those have to stop.
- Check Annex I, then Annex III against the intended purpose, not the technology. The same language model can be minimal-risk in marketing and high-risk in recruitment.
- Test the Article 6(3) derogation and record your reasoning, remembering the profiling override.
- Decide your role for each high-risk system: provider, deployer or both.
- Record the risks consistently with an AI risk assessment template, then build a gap plan with owners and dates.
Frequently asked questions
What is considered high-risk AI under the EU AI Act?
AI is high-risk when it is a safety component of, or is itself, a product under the EU harmonisation laws in Annex I that needs third-party conformity assessment, or when it is used for one of the purposes listed in Annex III, such as recruitment, credit scoring, education, essential public services, law enforcement, migration or justice. An Annex III system can escape the category only through the Article 6(3) derogation.
When do the high-risk AI obligations apply?
As of October 2026, after Regulation (EU) 2026/1744, obligations for Annex III high-risk systems apply from 2 December 2027, and obligations for AI embedded in Annex I products apply from 2 August 2028. Public-authority deployers of high-risk systems already in use have until 2 August 2030. Transparency duties under Article 50 were not delayed and apply from 2 August 2026.
Is a customer-service chatbot a high-risk AI system?
Normally not. Customer-service chatbots are not listed in Annex III, so they are not high-risk on their own. They do fall under Article 50: people must be told they are interacting with an AI system unless that is obvious. A chatbot can become high-risk if it is used for a listed purpose, for example deciding whether someone qualifies for public benefits or a loan.
Is Microsoft Copilot high-risk under the AI Act?
Used for general productivity work such as drafting emails, summarising meetings or writing code, a tool like Microsoft Copilot is not a high-risk system. The classification follows the use, though. If your HR team uses it to rank job applicants, that use falls into Annex III area 4, and your organisation may be treated as the provider of a high-risk system under Article 25.
Find out which of your systems are high-risk
Classification is the first decision that everything else depends on, and it is easier with a structured starting point. Assess your AI governance against the EU AI Act with Opsio's free questionnaire: 14 steps, about 40 minutes, and you receive an AI Governance Framework, an AI Acceptable Use Policy, an AI Vendor Due Diligence Checklist and an AI Risk Assessment Template in Word, written from your answers, plus a maturity score. No card and no obligation. If you want help afterwards, our AI governance consulting team can work through the high-risk gap plan with you.
This article is general information, not legal advice. Check the consolidated text of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. Statements are accurate as of October 2026.
Related Guides
Written By
Country Manager, India
Praveena leads Opsio's India operations, bringing 17+ years of cross-industry experience spanning AI, manufacturing, DevOps, and managed services.
Editorial standards: This article was written by cloud practitioners and reviewed by our engineering team. We revise it when the technology or regulation it covers changes; the dates on this page show the latest update. Opsio maintains editorial independence.