Classify industry AI systems under the EU AI Act by separating Article 6 product-safety routes from Annex III use cases.
Use this page to spot likely high-risk systems, document carveouts, assign provider and deployer work, and avoid treating every AI feature as the same risk class.
Structured answer sets in this page tree.
Cited legal and guidance references.
The EU AI Act has two main high-risk routes. Article 6(1) covers AI used as a safety component of, or itself constituting, a product covered by Annex I Union harmonisation legislation when that product route requires third-party conformity assessment. Article 6(2) separately makes the Annex III use cases high-risk, subject to the Article 6(3) non-high-risk carveout and the rule that Annex III systems performing profiling of natural persons remain high-risk.
Do not classify by industry label alone. A hospital, bank, manufacturer, school, recruiter, utility, or public authority can have low-risk, limited-risk, prohibited, and high-risk AI in the same portfolio.
First test Article 6(1): is the AI system a safety component of a covered product, or the product itself, under Annex I product legislation, and is third-party conformity assessment required under that sector law? Then test Article 6(2): is the intended purpose one of the Annex III use cases?
Annex III is best read as a use-case list, not a complete industry list. The same industry can appear under multiple Annex III headings depending on what the AI system is intended to do.
Use the examples below as classification prompts. They do not make every AI system in that industry high-risk; the intended purpose and actual deployment context still control the answer.
Annex I matters where the AI system is tied to product safety. The classification question is not simply whether a manufacturer uses AI; it is whether the AI is the product, or a safety component of a covered product, and whether that sector route requires third-party conformity assessment.
This route is especially relevant for AI in regulated physical products or safety-critical software embedded in them. It can sit alongside sector obligations under medical-device, machinery, vehicle, aviation, rail, radio-equipment, toy, lift, pressure-equipment, personal-protective-equipment, and other Annex I regimes.
A useful high-risk register should show why a system is high-risk and why nearby systems are not. This avoids over-scoping low-risk tools and under-scoping systems that make or influence decisions about people.
The AI Act also contains scope exclusions that should be separated from Article 6(3). An Article 2 exclusion means the Regulation does not apply to that activity or actor in the described circumstances; an Article 6(3) carveout is a classification result for an Annex III system that would otherwise be high-risk.
High-risk classification is only the start. The work changes depending on whether the organisation is the provider placing the system on the market or putting it into service, a deployer using it under its authority, or another operator in the value chain.
Industry teams should avoid pushing all work to either legal or the vendor. The provider usually owns conformity, technical documentation, quality management, logs under its control, registration, CE marking where required, and corrective actions. The deployer owns use according to instructions, human oversight, monitoring, input data under its control, workplace and affected-person notices where applicable, and some registration or impact-assessment duties.
No. The AI Act classifies by intended purpose and route, not by industry name alone. A creditworthiness tool, recruitment-screening system, medical-device AI, or admissions-ranking system may be high-risk, while a general drafting assistant or internal analytics tool in the same organisation may fall outside Article 6 high-risk classification unless another AI Act rule applies.
Article 6(3) allows a non-high-risk result for some Annex III systems that do not pose a significant risk of harm, such as systems limited to narrow procedural, preparatory, improvement, or decision-pattern detection tasks. The provider must document that assessment before market placement or putting into service, register under Article 49(2), and cannot use this route for Annex III systems that perform profiling of natural persons.
Sorena can help turn product, vendor, and deployment facts into a cited high-risk classification register with Article 6 routes, Annex III categories, carveout records, and provider/deployer evidence requests.
Ask source-linked questions about Article 6, Annex I product-safety routes, Annex III use cases, and provider or deployer duties.
Review your AI system inventory, high-risk classification evidence, and supplier/deployer responsibility split with Sorena.
"Classification rules for high-risk AI systems"
"AI use cases that can pose serious risks"
"What are obligations of deployers of high-risk AI systems?"
"Obligations of providers and deployers of high-risk AI systems"