High-risk AI system: EU AI Act definition
A high-risk AI system is one that Art. 6 classifies as high-risk: a safety component of a product, or a product itself, under the EU laws in Annex I that needs third-party conformity assessment, or a system used in an area listed in Annex III.
Last verified October 31, 2026, against the AI Act as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744).
Where it comes from. Art. 6(1)-(2) of the EU AI Act, with Annex I and Annex III. The definitions in Art. 3 do not define the term; Art. 6 sets the rules.
The two routes
- Annex III lists areas, read point by point: biometrics, critical infrastructure, education, employment, essential services (such as credit scoring of individuals, except fraud detection), law enforcement, migration, and justice and democratic processes.
- Annex I covers AI that is a safety component of a product, or is itself a product, under EU product laws such as those on medical devices, where the product needs third-party conformity assessment for health and safety reasons (6(1), 6(1c)).
An Annex III system is not high-risk if it poses no significant risk of harm and meets one of four conditions, such as a narrow procedural task (6(3)). That exception never covers a system that profiles people, and the provider must document its assessment and register the system (6(4)).
Example
A US company sells a tool that filters job applications to employers in the EU. Filtering applications is listed in Annex III point 4(a), so the tool is high-risk unless Art. 6(3) applies, and if it profiles candidates, Art. 6(3) cannot apply. The company is the tool’s provider; each employer that uses it is a deployer.
What it means for you
- The high-risk duties apply from December 2, 2027 for Annex III systems and August 2, 2028 for Annex I systems (Art. 113).
- A system placed on the market before its date is covered only after a significant design change, except systems for public authorities, due by August 2, 2030 (Art. 111(2)). Record each system’s market date.
- Providers carry most duties (Art. 16); deployers have their own (Art. 26); a non-EU provider needs an authorized representative.
- The Commission’s high-risk classification guidelines are still a draft.
Hiring in New York City too? See NYC Local Law 144.
Read next
- The EU AI Act for US companies
- Provider or deployer: your EU AI Act role
- Does the EU AI Act apply to a US company?
- Glossary
This page is general information, not legal advice.
Questions about your AI systems?
Talk to us about what you build or use, or see how an assessment works.
How it works