ISO/IEC 42001 FAQ High Risk AI

Run two separate decisions. For the AIMS decision, apply documented criteria that distinguish acceptable from unacceptable risk. Identify consequences for the organisation, individuals, and societies; assess realistic likelihood where applicable; determine the risk level; compare it with the criteria; and prioritise treatment. Use the AI system impact assessment to account for intended use, foreseeable misuse, affected people, deployment context, and applicable jurisdictions.

For an EU AI Act decision, first confirm territorial and material scope under Article 2 and determine the operator role. The Act can reach providers placing systems on the Union market, EU deployers, and certain third-country providers or deployers where output is used in the Union. It excludes specified military, defence, national-security, scientific-research, pre-market research and testing, purely personal non-professional, and some free and open-source circumstances; each exclusion has conditions.

Then test Article 6. The product route requires both an Annex I product or safety-component link and a third-party conformity assessment under the listed product law. The listed-use route requires an intended purpose in Annex III, such as recruiting or filtering job applicants, evaluating students, credit scoring of natural persons other than fraud detection, emergency healthcare triage, or specified remote biometric identification. These are examples, and the exact Annex wording and facts control. The amended Article 6(1a)-(1c) clarifies that solely non-safety uses do not qualify as safety components unless failure would endanger health and safety, and third-party assessment solely for non-health-and-safety risks does not satisfy the product-route condition. Check Article 2(2) separately for Annex I Section B products; the amendment moves machinery to that section and provides for sector-specific requirements.

For an Annex III use, test the limited Article 6(3) derogation. The system must not pose a significant risk of harm to health, safety, or fundamental rights, including by not materially influencing decision-making, and must perform a narrow procedural task, improve a completed human activity, detect patterns without replacing or influencing the completed assessment without proper review, or perform a preparatory task. Profiling of natural persons remains high-risk. A provider relying on the derogation must document the assessment before placing the system on the market or putting it into service and must register it.

Regulation (EU) 2026/1744 entered into force on 27 July 2026. Under the amended Article 113, Chapter III Sections 1-3, except Article 6(5), apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. Record the applicable route, legal text, and effective date in the classification plan. Article 111 contains separate transition rules for existing systems, including specified large-scale IT systems and high-risk systems intended for public-authority use. ISO/IEC 42001 risk and impact work and other applicable law have their own timing.

For the AIMS record, keep the system's intended purpose, functionality, deployment context, affected population, risk criteria, risk assessment, impact assessment, treatment plan, statement of applicability, control results, residual-risk approval, monitoring, incidents, and change history. Show how each material consequence and selected control connects to the actual use.

For the EU record, keep the AI system definition analysis, Article 2 scope facts and exclusions, provider and deployer roles, intended purpose, product-law or Annex III route, exact Annex entry, decision influence and profiling facts, Article 6(3) assessment if used, registration evidence, applicable date, approver, and source version. If the product route applies, retain the product classification and third-party conformity-assessment basis under the relevant Annex I law.

A provider relying on Article 6(3) needs a system-specific assessment before market placement or putting into service. A generic statement that the tool is administrative, assistive, low-risk, or subject to human review does not establish the derogation.

Designated management must approve the AIMS risk-treatment plan and acceptance of residual AI risks. A legal or regulatory owner should approve the separate statutory classification within the organisation's governance model; neither approval substitutes for the other.

The provider owns the Article 6 classification and any pre-market Article 6(3) documentation. Deployers should still verify that the provider's classification and instructions fit their actual use, because a changed intended purpose or substantial modification can shift provider obligations under Article 25.

Security, privacy, safety, employment, product, supplier, and business owners should contribute when their requirements or evidence affect the decision. Escalate any proposed residual-risk acceptance that conflicts with binding law rather than recording it as an accepted exception.

Repeat ISO risk assessments at planned intervals and when significant changes are proposed or occur; repeat impact assessments at planned intervals or when significant changes are proposed. Revisit legal classification when intended purpose, functionality, integration, operator role, branding, market, affected population, decision influence, profiling, Annex coverage, product law, guidance, or application date changes.

A name or trademark change, substantial modification, or changed intended purpose can make a distributor, importer, deployer, or other party the provider of a high-risk system under Article 25. Review before the change is released, not only after an incident.

Keep the AIMS reassessment date and the legal-classification review date separately visible because the triggers, approvers, evidence tests, and consequences differ. If either analysis changes, update controls, technical documentation, instructions, registration, conformity-assessment planning, monitoring, and customer or supplier allocations as applicable.