High-risk AI systems
High-risk AI is the heart of the AI Act. These systems are allowed, but only if they meet strict requirements on risk management, data, documentation, transparency, human oversight and robustness.
Learning objectives
- Explain the two routes to high-risk classification (Annex I and Annex III)
- Apply the Article 6(3) filter for Annex III systems
- Summarise the core requirements for providers
- Describe deployers' duties, including the fundamental rights impact assessment
- State when the high-risk rules apply after the 2026 amendments
2 December 2027 — Annex III (stand-alone) high-risk systems. 2 August 2028 — Annex I (AI in regulated products). Systems already on the market before these dates are only caught if they are significantly changed afterwards; systems used by public authorities have until 2 August 2030.
4.1 Route 1: AI in regulated products (Annex I)
Under Article 6(1), an AI system is high-risk if both conditions are met:
- it is a safety component of a product, or is itself a product, covered by the EU product legislation listed in Annex I; and
- that product must undergo a third-party conformity assessment under that legislation.
Annex I covers areas such as medical devices and in-vitro diagnostics, toys, lifts, radio equipment, personal protective equipment, and vehicles and aviation. Following the 2026 amendments, a "safety component" must have the intended purpose of preventing or mitigating risks to health and safety — AI used purely for efficiency or convenience in a product is not a safety component.
4.2 Route 2: high-risk use cases (Annex III)
Under Article 6(2), AI systems used in the areas listed in Annex III are high-risk. The eight areas are:
| Area | Examples of high-risk uses |
|---|---|
| 1. Biometrics | Remote biometric identification (not 1:1 verification); biometric categorisation by sensitive attributes; emotion recognition (where not prohibited). |
| 2. Critical infrastructure | Safety components in managing road traffic, digital infrastructure, or supply of water, gas, heating and electricity. |
| 3. Education and vocational training | Deciding admission; evaluating learning outcomes; assessing the appropriate level of education; detecting cheating in tests. |
| 4. Employment and worker management | Recruitment and CV screening; decisions on promotion, termination and task allocation; monitoring and evaluating performance. |
| 5. Access to essential services | Eligibility for public benefits; creditworthiness and credit scoring (except fraud detection); risk assessment and pricing in life and health insurance; triage of emergency calls. |
| 6. Law enforcement | Assessing risk of victimisation; polygraphs; evaluating reliability of evidence; profiling in criminal investigations. |
| 7. Migration, asylum and border control | Assessing security or health risks; examining asylum, visa and residence applications. |
| 8. Administration of justice and democracy | Assisting judges in researching and interpreting facts and law; systems intended to influence election outcomes or voting behaviour. |
The Article 6(3) filter
An Annex III system is not high-risk if it does not pose a significant risk of harm to health, safety or fundamental rights — for example because it only:
- performs a narrow procedural task (e.g. sorting incoming documents into categories);
- improves the result of a previously completed human activity (e.g. polishing the language of a document);
- detects patterns or deviations in decision-making without replacing or influencing a human assessment without proper human review; or
- performs a preparatory task to an assessment (e.g. translating files).
An Annex III system that performs profiling of natural persons is always high-risk — the filter cannot be used. Providers relying on the filter must document their assessment and make it available to authorities on request.
4.3 Requirements for high-risk AI systems
Chapter III, Section 2 sets out the requirements every high-risk system must meet:
| Article | Requirement | In plain English |
|---|---|---|
| 9 | Risk management system | A continuous, iterative process across the whole lifecycle to identify, evaluate and mitigate risks. |
| 10 | Data and data governance | Training, validation and testing data must be relevant, sufficiently representative and, as far as possible, free of errors and complete — with bias examined and mitigated. |
| 11 | Technical documentation | Detailed documentation (Annex IV) showing how the system complies. SMEs and small mid-caps can use simplified forms. |
| 12 | Record-keeping | Automatic logging of events to ensure traceability. |
| 13 | Transparency to deployers | Clear instructions for use: capabilities, limitations, accuracy, intended purpose and oversight measures. |
| 14 | Human oversight | Designed so people can understand, monitor, override and stop the system, and avoid "automation bias". |
| 15 | Accuracy, robustness and cybersecurity | Appropriate, declared levels of accuracy; resilience to errors and attacks such as data poisoning and adversarial examples. |
Provider obligations
On top of building a compliant system, providers must:
- run a quality management system (Article 17) — proportionate for SMEs and small mid-caps;
- complete a conformity assessment (Article 43) — mostly internal control for Annex III, third-party for some biometrics and for Annex I products under their sector rules;
- draw up an EU declaration of conformity and affix the CE marking;
- register the system in the EU database (Article 49);
- carry out post-market monitoring (Article 72) and report serious incidents to authorities (Article 73);
- take corrective action and cooperate with authorities.
4.4 Deployer obligations
Organisations using high-risk AI must (Article 26):
- use the system in line with the instructions for use;
- assign human oversight to people with the competence, training, authority and support to do it;
- ensure input data under their control is relevant and sufficiently representative;
- monitor operation and report risks and serious incidents to the provider and authorities;
- keep automatically generated logs for at least six months;
- inform workers and their representatives before using high-risk AI in the workplace;
- inform people when a high-risk system is used to make, or help make, decisions about them.
People affected by decisions based on certain high-risk systems also have a right to an explanation of the role the AI played (Article 86).
Fundamental rights impact assessment (FRIA)
Under Article 27, some deployers must assess the impact on fundamental rights before first use:
- bodies governed by public law;
- private entities providing public services; and
- deployers using AI for creditworthiness/credit scoring or life and health insurance risk assessment and pricing.
The FRIA describes the process, the period and frequency of use, the people likely to be affected, the specific risks of harm, the human oversight measures and what happens if risks materialise.
A UK-based recruitment agency uses a vendor's AI tool to shortlist candidates for roles at clients in France.
Classification: employment — Annex III, area 4. It ranks and filters candidates, which involves profiling, so the 6(3) filter can't apply. High-risk.
Roles: the vendor is the provider; the agency is a deployer (its output is used in the EU). From 2 December 2027 the agency must follow instructions, assign trained human reviewers, keep logs for six months, and tell candidates that AI is involved. The vendor must have completed conformity assessment, CE marking and registration.
Key takeaways
- High-risk status comes via Annex I (regulated products) or Annex III (eight sensitive areas).
- The Article 6(3) filter can take some Annex III systems out of scope — but never systems that profile people.
- Providers carry the heaviest load: Articles 9–15, quality management, conformity assessment, CE marking, registration and monitoring.
- Deployers must use systems properly, ensure human oversight, keep logs, inform people — and some must run a FRIA.
- Annex III rules apply from 2 December 2027; Annex I from 2 August 2028.