FAQEU AI Act

EU AI Act Is this industry use high-risk?

A company's industry does not decide whether its AI is high-risk. Check the system's against the uses listed in , and check the separate product-safety route.

For a narrow or preparatory use, Article 6(3) may allow a documented . The conditions and registration duties still matter.

Author
Sorena AI
Published
May 9, 2026
Updated
Oct 21, 2026
Overview

A factory, bank or insurer can use both high-risk and lower-risk AI. Article 6(1) covers certain products and safety components. Article 6(2) covers the intended uses listed in . Article 6(3) allows a limited exception to the Annex III route when its harm, task and profiling conditions are met.

Search this module

Find a question or answer quickly

4 of 4 questions
Question 1

What makes an industry use high-risk?

A system falls under when its matches a listed use, subject to Article 6(3). A covered product or can separately be high-risk under Article 6(1). Keep both checks: the product route does not itself put a system in Annex III. The Commission FAQ explains that classification follows function, specific purpose and conditions of use.

A predictive-maintenance dashboard, production-quality analytics tool or internal knowledge assistant is not high-risk solely because a factory, utility, insurer, bank or public-sector supplier uses it. Check for a listed purpose, such as recruitment, worker management, creditworthiness, life or health insurance pricing, emergency triage or a in specified infrastructure. Biometrics, education, law enforcement, migration, justice and democratic processes also need a use-specific check.

Commission examples and draft classification guidelines can help apply the rule, but they do not add an category. Record the exact Annex III point, the system's , and the deployment facts instead of classifying from an industry label or an example alone.

  • Start with the provider's , instructions for use, technical documentation, sales materials, and actual deployment context.
  • Check Article 6(1) first if the AI is a product or covered by Annex I legislation and the product requires third-party conformity assessment.
  • Check Article 6(2) and next if the system is used for a listed area involving people, rights, access, employment, public services, infrastructure safety, or public authority decisions.
  • Do not classify a system as high-risk just because the customer is in an industrial sector or the model uses operational, employee, financial, or safety-related data.
  • Treat differently: Article 6(3) says an system is always high-risk where it performs profiling of natural persons.

Is all AI used by industry high-risk?

No. A system used by an industrial company falls under only when its matches a listed use case, subject to the limited Article 6(3) exception. Separately, a system can be high-risk under the product or safety-component route in Article 6(1); Article 6(3) does not remove that classification.

Question 2

Which uses does Annex III cover?

lists eight areas: biometrics; critical infrastructure; education and vocational training; employment, worker management and access to self-employment; essential private and public services and benefits; law enforcement; migration, asylum and border control; and justice and democratic processes. Match the specific use within the area.

Industrial uses most often need closer review where the AI affects natural persons or safety-critical infrastructure. Examples include recruitment screening for plant workers, task allocation or performance monitoring based on worker behaviour, credit scoring of natural persons, life or health insurance pricing, emergency-call triage, biometric identification, emotion recognition, or an AI in road traffic, critical digital infrastructure, or water, gas, heating or electricity supply. By contrast, equipment-failure forecasting, inventory planning, energy-use optimisation, document search, or translation may fall outside if they do not serve a listed .

  • Critical infrastructure: check whether the AI is a in management or operation of critical digital infrastructure, road traffic, or water, gas, heating or electricity supply.
  • Employment and worker management: check recruitment, candidate evaluation, task allocation based on personal traits or behaviour, and worker performance or behaviour monitoring.
  • Essential services: check public-authority or on-behalf-of-public-authority eligibility decisions for essential assistance benefits and services; natural-person creditworthiness or scoring, except financial-fraud detection; life and health insurance risk assessment and pricing; and the listed emergency-call, dispatch, or healthcare-triage uses.
  • Biometrics: distinguish permitted remote biometric identification, sensitive biometric categorisation, and emotion recognition from simple verification whose sole purpose is confirming a claimed identity.
  • Public-authority areas: law enforcement, migration, asylum, border control, justice, and democratic-process use cases need specific legal-purpose review and may have restricted registration visibility.

How do we draw the boundary?

Draw the boundary around the AI system's and effect, not around the business sector. A maintenance model for machines may be outside , while a worker-monitoring, hiring, credit, insurance, emergency-response, biometric, or critical-infrastructure may be inside Annex III if its intended purpose matches the listed use case.

Question 3

When can the Article 6(3) exception apply?

The Article 6(3) exception applies only to systems. The system must pose no significant risk of harm to health, safety or fundamental rights, including because it does not materially influence decision outcomes. It must also meet at least one of the four listed task conditions.

The four conditions cover a narrow procedural task, improving completed human work, detecting decision patterns or deviations with proper human review, or preparing for an assessment. Pattern detection must not replace or influence a completed human assessment without proper human review. An Annex III system that profiles natural persons is always high-risk.

  • Evidence for a narrow procedural task should show the system only structures, routes, deduplicates, translates, indexes, searches, or formats information without deciding the person-facing outcome.
  • Evidence for improving a completed human activity should show the human decision or assessment was already complete before the AI improved wording, presentation, consistency checks, or other non-substantive output.
  • Evidence for pattern or deviation detection should show the AI flags anomalies and does not replace or influence the underlying completed assessment without proper human review.
  • Evidence for a preparatory task should show the AI output has very low impact on the later assessment and is not treated as the deciding recommendation.
  • If the system profiles natural persons, record that Article 6(3) cannot be used to classify the system as non-high-risk.

Can an industry tool qualify for the Article 6(3) exception?

Yes, if the system poses no significant risk of harm, meets at least one Article 6(3) condition, and does not profile natural persons. The provider must document the assessment before market placement or putting into service and register under Article 49(2). The exception concerns systems; it does not remove a separate Article 6(1) classification.

Question 4

What must providers document and register?

For a high-risk conclusion, connect the to the exact point. Then assemble the records for conformity assessment, quality management, traceability and registration before market placement or first use, as applicable.

For an Article 6(3) conclusion, document the condition used and why the system does not materially influence decisions or otherwise pose significant risk. Article 6(4) still requires this internal assessment. Amended Annex VIII Section B keeps the applicable exception conditions as registration fields, but removes the former short grounds-summary and Member States-of-availability fields.

Track dates by provision and classification route. The 2026 amendment moves Chapter III Sections 1-3, except Article 6(5), to 2 December 2027 for systems and 2 August 2028 for Annex I systems. Articles 72 and 73, on monitoring and serious incidents, remain on the general 2 August 2026 date. Keep the amendment's 24 July 2026 publication and 27 July 2026 entry into force with the deadline decision.

  • High-risk provider registration evidence: provider contact details, AI system trade name, , supported functions, inputs and operating logic, status, Member States, EU declaration of conformity, instructions for use, and certificate details where applicable.
  • Article 6(3) internal assessment: document the condition relied on and the grounds for the under Article 6(4). For EU database registration, amended Annex VIII Section B retains provider contact details, submitting-person and authorised-representative details where applicable, AI system trade name and identifying reference, , Article 6(3) condition or conditions, and system status. The former short grounds-summary and Member States fields are no longer required registration fields.
  • Public-authority deployer evidence: when Article 49(3) applies, record the deployer details, the person submitting information, the system selected, and the registered use before putting the system into service or using it.
  • Visibility boundary: most Article 49 registrations feed the EU database, but Article 49 provides secure non-public registration for specified law enforcement, migration, asylum, and border-control systems, and national-level registration for point 2 critical infrastructure systems.
  • Change trigger: reassess the classification when , user population, human-review design, instructions for use, deployment setting, or supplier claims change.
  • Date evidence: retain the Article 113 baseline, Regulation (EU) 2026/1744, its Official Journal publication and entry-into-force dates, and the decision that maps each duty to the specific Article 6 route.

What proves an classification?

Providers should keep the intended-purpose analysis, the mapped point or Article 6(3) condition, the technical and user-facing materials relied on, the human-review and decision-impact evidence, and the EU database registration fields required by Annex VIII. For high-risk systems, that evidence supports conformity and registration; for Article 6(3) systems, it supports the documented and Article 49(2) registration.

Primary sources

References and citations

eur-lex.europa.eu5 citations
Referenced sections
  • Primary legal source for Article 6 classification, Annex III areas, Article 6(3), provider documentation, Article 49, Article 71, and Annex VIII registration fields.
  • Supports the Article 6 classification sequence, Annex III high-risk areas, Article 6(3) exception, provider documentation duty, and Annex VIII registration fields.
  • Provides the full Annex III list and the Article 3 definition of intended purpose used to classify borderline industry systems.
Show 2 more
  • Supports the four Article 6(3) conditions, the profiling carve-out, the provider documentation duty, and the Article 49(2) registration link.
  • Supports Annex VIII registration fields for high-risk systems, Article 6(3) non-high-risk systems, and public-authority deployer registration.
"Classification rules for high-risk AI systems"
More quoted passages
"AI systems referred to in Annex III shall be considered to be high-risk."
"High-risk AI systems pursuant to Article 6(2)"
"shall not be considered to be high-risk"
"Information to be submitted upon the registration"
ai-act-service-desk.ec.europa.eu3 citations
Referenced sections
  • Official Service Desk source for Article 49 registration requirements for high-risk Annex III systems, Article 6(3) non-high-risk conclusions, public-authority deployers, restricted sections, and national-level critical-infrastructure registration.
  • Supports that providers concluding a system is not high-risk under Article 6(3) must register themselves and that system in the EU database.
  • Supports registration timing, public-authority deployer registration, secure non-public sections, and national-level registration for Annex III point 2 critical infrastructure systems.
"Before placing on the market or putting into service"
More quoted passages
"not high-risk according to Article 6(3)"
"High-risk AI systems referred to in point 2"
digital-strategy.ec.europa.eu3 citations
Referenced sections
  • Commission FAQ source for intended-purpose classification, examples of Annex III high-risk areas, provider obligations, deployer obligations, and EU database context.
  • Supports the intended-purpose classification approach and Commission examples of Annex III high-risk areas.
  • Supports provider and deployer obligation summaries for high-risk systems, including conformity assessment, quality management, monitoring, human oversight, and EU database registration.
"Annex III of the AI Act comprises 8 areas"
More quoted passages
"The risk classification is based on the intended purpose of the AI system."
"register the system in a public EU database"
digital-strategy.ec.europa.eu2 citations
Referenced sections
  • Commission policy source for the risk-based framework and high-risk examples, including safety components in critical infrastructure.
  • Supports the public Commission explanation that high-risk systems include safety components in critical infrastructure and other listed sensitive uses.
"AI safety components in critical infrastructures"
eur-lex.europa.eu2 citations
Referenced sections
  • Binding amendment published on 24 July 2026 and entering into force on 27 July 2026; it sets the revised Chapter III application dates for Annex III and Annex I high-risk systems.
  • Binding amendment published on 24 July 2026 and entering into force on 27 July 2026; it sets the revised Chapter III application dates for Article 6(2) Annex III systems and Article 6(1) Annex I systems.
Show all related guides (34)

When must you disclose AI use? | EU AI Act

Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.

When must you report a serious incident? | EU AI Act

Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.

Who needs a rights impact assessment? | EU AI Act

Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.

Common questions, clear answers | EU AI Act

Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.

EU AI Act deadlines and compliance calendar

Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.

EU AI Act fundamental rights impact assessments

Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.

EU AI Act GPAI model evidence checklist

Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.

EU AI Act monitoring and serious incidents

Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.

EU AI Act penalties and fines

Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.

EU AI Act serious incident reporting steps

Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.

EU AI Act timeline and phased deadlines

See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.

EU AI Act vs ISO/IEC 42001

Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.

EU AI Act vs NIST AI RMF

Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.

EU AI Act: Check whether the Act applies

Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.

EU AI Act: Choose a high-risk assessment route

Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.

EU AI Act: Classify a tool before approval

Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.

EU AI Act: Compliance checklist

Check each AI tool, decide which duties apply, and give every action an owner and evidence link.

EU AI Act: Conformity assessment

Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.

EU AI Act: Does it apply to you?

Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.

EU AI Act: Duties for general-purpose AI models

Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.

EU AI Act: High-risk requirements

High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.

EU AI Act: High-risk system checklist

Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.

EU AI Act: Is your use case high-risk?

Find high-risk AI examples in recruitment, banking, education, healthcare, public services and products. Check Article 6 conditions and exceptions.

EU AI Act: Plan your compliance work

Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.

EU AI Act: Standards and quality management

Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.

EU AI Act: Technical file and evidence templates

Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.

EU AI Act: When must you disclose AI?

Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.

EU AI Act: Which AI uses are banned?

Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.