High-risk AI system
High-risk AI systems are those listed in Annex III (e.g. employment, credit scoring, biometrics, education, essential services) or that are safety components of regulated products. They carry the Act's heaviest obligations.
There are two routes into the high-risk tier. The Annex III route captures listed use cases; the Annex I route captures AI that is a safety component of a product already covered by EU harmonisation legislation, such as machinery or medical devices. Providers must run a risk-management system, ensure data governance, produce technical documentation, enable record-keeping and human oversight, meet accuracy and cybersecurity requirements, pass a conformity assessment, draw up a declaration of conformity, affix the CE marking and register the system in the EU database. Annex III obligations apply from 2 December 2027; the Annex I product route follows on 2 August 2028.
- Art. 6
- Art. 8–15
- Annex I
- Annex III
High-risk AI system: why it matters
Roughly all of the Act's cost sits in this tier, and it lands on both sides of the contract: the provider builds the conformity file, but the deployer inherits Article 26 duties it cannot delegate back. The filtering test in Article 6(3) is therefore worth real effort — a system that performs a narrow procedural task, improves the result of prior human activity, or does no more than preparatory work can fall out of the tier, but the provider must document that assessment and register the system before relying on it.
High-risk AI system in practice
A recruitment platform ranks applicants for interview shortlists. That is Annex III employment territory, so from December 2027 it needs a lifecycle risk-management system, bias examination of its training data, logging that lets a deployer reconstruct a decision, and an oversight design that lets a recruiter override the ranking meaningfully rather than click through it. The customer HR team, meanwhile, must assign trained oversight staff, keep the logs, and inform affected workers before the tool is used on them.
High-risk AI system: the mistake people make
Treating the Article 6(3) exemption as self-executing. A provider that concludes its Annex III system is not high-risk must document that assessment, and register the system in the EU database anyway — quietly deciding you are out of scope leaves you with neither the exemption nor the file.
High-risk AI system: common questions
- When do high-risk AI obligations start?
- 2 December 2027 for Annex III use cases, moved from August 2026 by the 2026 Digital Omnibus. High-risk AI that is a safety component of a product regulated under Annex I follows on 2 August 2028.
- How do I know if my AI system is high-risk?
- Check two lists. If the system performs one of the Annex III use cases it is presumed high-risk unless a documented Article 6(3) assessment shows it poses no significant risk. If it is a safety component of a product covered by the Annex I legislation and requires third-party assessment, it is high-risk by that route.
- Does the deployer or the provider carry high-risk obligations?
- Both, with different lists. The provider owns Articles 8 to 22 — risk management, data governance, documentation, conformity assessment, CE marking. The deployer owns Article 26 — using the system as instructed, human oversight, monitoring, log retention, informing affected people.
High-risk AI system: terms that come up alongside it
Run the free 2-minute EU AI Act checker — no sign-up.