AI used for hiring, credit decisions, admissions or product safety may be high-risk.
Check the intended purpose and the legal conditions for each use. An industry name alone does not decide the answer.
A falls within a covered product-safety route or a listed Annex III use case. Start with the examples below, then record the exact legal entry, any exception and who is responsible for the duties.
A hospital, bank or manufacturer can use AI in several risk categories. Assess each intended use separately.
Article 6(1) covers AI that is a product or safety component under Annex I product law, where third-party conformity assessment is required. Article 6(2) covers the specific uses listed in Annex III.
Under the 2026 amendment, Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Annex III systems and 2 August 2028 for Article 6(1) systems. Classify now so you can plan the relevant work.
Sources (3)
Primary legal text for Article 6 classification, Annex I product-law routes, Annex III use cases, and Article 6(3) carveouts.
Classification rules for high-risk AI systems
Commission FAQ explaining that high-risk classification is based on intended purpose, product safety legislation, and Annex III use cases.
How do I know whether an AI system is high-risk?
Supports the 2 December 2027 date for Annex III Chapter III Sections 1-3 and the 2 August 2028 date for Article 6(1) systems.
Annex III lists uses, rather than declaring whole industries high-risk. The examples below are prompts for checking the legal entry.
Check permitted use under other law first. A high-risk classification cannot authorise a prohibited practice.
Sources (2)
Annex III source for the listed high-risk areas and sector examples.
High-risk AI systems referred to in Article 6(2)
Commission overview summarising high-risk areas such as critical infrastructure, education, employment, essential services, biometrics, law enforcement, migration, asylum, and border control.
AI use cases that can pose serious risks
For a product, identify the AI safety function and the sector's third-party assessment requirement. A manufacturer using AI for an unrelated office task does not meet this route simply because it makes regulated products.
Annex I Section A generally combines AI Act requirements with the sector assessment. Any limitation for overlapping protection requires an applicable delegated act and its conditions.
Section B has limited direct AI Act application under amended Article 2(2); relevant requirements must be checked in sector law. The 2026 amendment moves machinery to Section B and provides for AI safety requirements through the Machinery Regulation.
Sources (3)
Primary source for Article 6(1) and the Annex I list of Union harmonisation legislation.
List of Union harmonisation legislation
Commission FAQ gives examples of product-safety high-risk systems, including robots, drones, and medical devices.
safety components of products covered by sectorial Union legislation
Supports the amended Section A overlap mechanism, Section B direct-application limits, machinery treatment, and 2 August 2028 product-linked date.
An Article 2 exclusion concerns whether the Act applies to the activity. Article 6(3) is a limited exception to high-risk classification for an otherwise listed Annex III use.
To use Article 6(3), establish no significant risk to health, safety or fundamental rights, including no material influence on decision outcomes, and satisfy a listed task condition.
Sources (2)
Primary legal text for Article 2 scope exclusions and Article 6(3) high-risk carveouts.
shall not be considered to be high-risk
Official Service Desk article page for the Article 6 classification rule and the non-high-risk assessment record.
Classification rules for high-risk AI systems
Use one record per decision or safety function. Identify the supplier, the organisation using it, the affected people and the evidence each party needs.
These examples show what to check. Confirm the precise legal entry, exceptions and role boundaries for your system.
Sources (2)
Primary source for the product-safety and Annex III routes, including creditworthiness, employment, education, emergency dispatch, and product safety cases.
Current source for amended Annex I sector treatment and Chapter III application dates.
For Annex III and applicable Section A systems, providers generally handle conformity, documentation, quality management, registration, required CE marking, controlled logs and corrective action. Deployers handle use under instructions, oversight, monitoring, controlled inputs and logs, and applicable notices or assessments.
For Section B and machinery, map responsibilities to the amended sector law. Agree on evidence and support with suppliers before purchase or use.
No. Classification follows the intended use and Article 6 conditions. A recruitment ranker or medical-device AI may be high-risk, while another tool in the same organisation may fall outside those conditions. Check other AI Act duties separately.
It must pose no significant risk to health, safety or fundamental rights and meet a listed Article 6(3) task condition. The provider must document the assessment before supply or first use and register under Article 49(2). An Annex III system that profiles people remains high-risk.
Sources (2)
Primary legal text for Articles 16, 26, and 27 provider, deployer, and fundamental-rights-impact-assessment duties.
Obligations of providers and deployers of high-risk AI systems
Commission FAQ summarising provider and deployer obligations for high-risk AI systems in practical terms.
What are obligations of deployers of high-risk AI systems?
Sorena can help you check the legal entry, exception evidence and provider/deployer responsibilities.
"Classification rules for high-risk AI systems"
"High-risk AI systems referred to in Article 6(2)"
"List of Union harmonisation legislation"
"shall not be considered to be high-risk"
"Obligations of providers and deployers of high-risk AI systems"
"How do I know whether an AI system is high-risk?"
"safety components of products covered by sectorial Union legislation"
"What are obligations of deployers of high-risk AI systems?"
"Classification rules for high-risk AI systems"
"AI use cases that can pose serious risks"
Clear answers on AI Act scope, risk categories, provider and user duties, general-purpose models, disclosures, rights, assessments and deadlines.
Find the AI Act deadline for your system or model. Check high-risk dates, transparency duties, older-model transitions and the evidence to prepare.
Check who needs an Article 27 fundamental rights impact assessment, what it must contain and how DPIA reuse, notification and registration work.
Collect model documentation, integration information, copyright records and training summaries. Add testing, incident and security records for systemic risk.
Set up high-risk AI monitoring, identify serious incidents and check reporting deadlines, recipients, deployer escalation and corrective action.
Check the AI Act fine tiers, smaller-organisation caps, GPAI provider fines and the facts authorities consider when deciding a penalty.
Check serious-incident harm, preserve evidence and choose the reporting deadline and recipient for high-risk AI systems and systemic-risk GPAI models.
See which AI Act rules apply now and what comes next. Check high-risk dates, older-model transitions and the difference between legal and standards dates.
Compare AI Act legal duties with ISO/IEC 42001 management-system requirements. See which records can be reused and what certification does and does not cover.
Compare AI Act legal duties with the voluntary NIST AI RMF. Map risk records to specific requirements and identify legal steps that need separate evidence.
Use five checks to establish AI Act scope, exclusions, your role, risk categories and evidence for the decision.
Choose between provider-run internal control, notified-body assessment and a product-law procedure before release.
Classify an AI tool or model before purchase or release. Check EU scope, prohibited uses, high-risk rules, transparency and GPAI duties.
Check each AI tool, decide which duties apply, and give every action an owner and evidence link.
Some high-risk systems use a provider-run assessment. Others need an authorised independent assessor or a product-law assessment.
Check whether the AI Act applies to your system or model, identify your provider or deployer role, and keep evidence for the decision.
Check GPAI provider duties for documentation, integrator information, copyright and training summaries, plus extra requirements for systemic-risk models.
High-risk providers must meet system requirements before supply. Deployers must use and monitor the system under the provider's instructions.
Check the system's risk controls, data, documentation, logs, instructions, human oversight and testing before release.
Build a compliance plan for each AI tool: your role, the duties that apply, the evidence needed and the person responsible.
Use EN 18286:2026 to organise provider quality-management procedures and keep evidence that they work for each high-risk system.
Build the technical file and provider records for a high-risk AI system, with owners and evidence links for each field.
Check Article 50 chatbot notices, synthetic-output marking, biometric notices, deepfake disclosures and public-interest text exceptions.
Check Article 5 prohibited AI practices, the narrow exceptions, evidence to retain and the new content prohibitions from 2 December 2026.
Check provider, deployer, importer and distributor roles, when changes create provider duties, and how model and system responsibilities differ.
Find the assessment route for high-risk AI, when a notified body is required, and which declaration, CE-marking and registration records you need.
Check whether software counts as AI, how models differ from systems, when embedded AI is high-risk, and which scope and role evidence to keep.
Understand high-risk AI monitoring under Article 72: the provider plan, deployer feedback, logs, corrective action, incidents and change reviews.
See which industry AI uses fall under Annex III, when Article 6(3) can apply, and what providers must document and register.
See what Article 11 and Annex IV require in high-risk AI technical documentation, from system identity and testing to monitoring and retention.
Check general-purpose model duties, systemic-risk classification, open-source conditions, copyright, training summaries, incidents and application dates.
Check AI interaction notices, technical content marking, biometric notices, deepfake and text disclosures, exceptions, accessibility and deadlines.
Check serious-incident outcomes, reporting roles, 15-, 10- and two-day deadlines, authority recipients, corrective action and the separate model route.
Check who needs an Article 27 fundamental rights impact assessment, what it must cover, and how privacy assessments, notification and registration fit.