Category: AI Governance
High-Risk AI System
Also known as: High-Risk AI, Annex III AI System
Simply put
A high-risk AI system is a category defined under the EU AI Act, a binding EU regulation, for AI whose use can meaningfully affect people's health, safety, fundamental rights, or access to essential services. Such systems are generally subject to stricter obligations than lower-risk AI, though not every listed use case is automatically classified as high-risk. This is a legal classification under EU law and differs from voluntary risk frameworks or standards.
Formal definition
Under the EU AI Act (Regulation (EU) 2024/1689), Article 6 sets out two principal routes to high-risk classification. First, an AI system is high-risk where it is intended to be used as a safety component of a product, or is itself a product, covered by the Union harmonisation legislation listed in the Act's annex, and is subject to third-party conformity assessment under that legislation. Second, AI systems falling within the use cases enumerated in Annex III (covering areas such as biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice) are treated as high-risk. However, the final adopted text introduces a filter mechanism in Article 6(3): a system falling within an Annex III use case may be exempted from high-risk classification where it does not pose a significant risk of harm to health, safety, or fundamental rights, including where it does not materially influence the outcome of decision-making. This exemption does not apply where the system performs profiling of natural persons, in which case it is always considered high-risk. Providers relying on the exemption must generally document their assessment. This classification is a legal determination under EU law with extraterritorial reach for systems placed on the EU market or affecting persons in the EU; it should not be conflated with high-risk categorisations under voluntary standards or other jurisdictions' regimes. Classification is fact-specific and the interpretation of the Article 6(3) filter continues to evolve; readers should verify against the current official text and any implementing guidance.
Why it matters
High-risk classification is the pivot point of the EU AI Act's obligations. Systems that fall into this category are generally subject to the Act's most demanding requirements, covering areas such as risk management, data governance, technical documentation, human oversight, and conformity assessment, while AI outside the category faces lighter or no substantive obligations. Because the EU AI Act is a binding regulation rather than a voluntary framework, misclassifying a system is not merely a documentation error; it can expose providers and deployers to enforcement. Correctly determining whether a system is high-risk is therefore one of the first and most consequential compliance decisions an organisation makes.
Who it's relevant to
AI providers placing systems on the EU market
Providers bear primary responsibility for determining whether a system meets Article 6's criteria and, where relevant, for documenting any reliance on the Article 6(3) exemption. Given the Act's extraterritorial reach, this applies to providers established outside the EU whose systems are placed on the EU market or affect persons in the EU.
Deployers of AI in Annex III domains
Organisations using AI in areas such as employment, education, access to essential services, or biometrics need to understand whether the systems they operate are high-risk, since deployer obligations attach differently than provider obligations. The presence of profiling is particularly significant, as it removes access to the Article 6(3) exemption.
Compliance officers and legal counsel
Those responsible for regulatory strategy must treat classification as a fact-specific legal determination under EU law, distinct from risk labels in voluntary standards, and should monitor evolving interpretation of the Article 6(3) filter and any implementing guidance before finalising a position.
Auditors and conformity assessment bodies
Where a system qualifies as high-risk through the product-safety route, it may be subject to third-party conformity assessment under the relevant Union harmonisation legislation. Those verifying compliance need to distinguish this legal assessment from voluntary certification or internal assessment activities.
Inside High-Risk AI System
Statutory basis under the EU AI Act
The concept of a 'high-risk AI system' is a legal classification defined within the EU AI Act (Regulation (EU) 2024/1689), a binding regulation rather than a voluntary standard. Classification triggers a specific set of legal obligations under that Regulation. Readers should verify the operative provisions and any implementing or delegated acts against the current official consolidated text, as details and timelines are subject to amendment.
Two principal classification routes
Under the Act, an AI system may fall within the high-risk category broadly through two pathways: (a) systems intended to be used as a safety component of a product, or that are themselves a product, covered by specified EU harmonisation legislation and subject to third-party conformity assessment; and (b) systems falling within the use cases enumerated in Annex III. These routes have different mechanics, and the Annex III route is qualified by an exception (see below).
Annex III use cases
Annex III lists specific use areas (for example, certain applications in biometrics, critical infrastructure, education, employment, access to essential services, law enforcement, migration, and administration of justice). Listing in Annex III is the starting point for the second classification route, not an automatic and unconditional designation, because a filter mechanism can rebut the presumption in defined circumstances.
Article 6(3) filter mechanism
Under the final text of the Act (Regulation (EU) 2024/1689), a system whose use case appears in Annex III is not classified as high-risk where it does not pose a significant risk of harm to health, safety, or fundamental rights, including by not materially influencing the outcome of decision-making. The Regulation describes conditions under which this may apply (for example, narrow procedural tasks or improving the result of a previously completed human activity). Importantly, this exemption does not apply where the system performs profiling of natural persons, and providers relying on the exemption are generally subject to documentation and registration expectations. Readers should confirm the precise conditions against the current official text.
Consequences of classification
Where a system is classified as high-risk, the Regulation imposes obligations that generally include risk management, data governance, technical documentation, record-keeping, transparency to deployers, human oversight, and appropriate accuracy, robustness, and cybersecurity, together with conformity assessment before placing on the market. The exact allocation of duties differs between roles such as provider and deployer.
Jurisdictional scope
This classification is a feature of EU law and applies within the scope of the EU AI Act, which can reach providers and deployers established outside the EU in defined circumstances where outputs are used in the Union. It is distinct from, and should not be conflated with, risk-tiering approaches in other jurisdictions such as the United States or the United Kingdom, which take different regulatory or non-binding approaches.
Common questions
Answers to the questions practitioners most commonly ask about High-Risk AI System.
Does listing in Annex III automatically make an AI system high-risk under the EU AI Act?
Not automatically in every case. While Annex III identifies use cases (in areas such as biometrics, critical infrastructure, education, employment, and access to essential services) that are presumptively high-risk, the final EU AI Act text (Regulation (EU) 2024/1689) introduced a filter mechanism, generally associated with Article 6(3). Under this provision, a system falling within an Annex III category may be treated as not high-risk where it does not pose a significant risk of harm to health, safety, or fundamental rights, for example where it performs a narrow procedural task or improves the result of a previously completed human activity. However, this exception does not apply where the system performs profiling of natural persons, which remains high-risk. Providers relying on the exemption generally must document their assessment. Readers should verify the exact conditions and any implementing guidance against the current official text, as interpretation is still developing.
Is 'high-risk' the same as 'prohibited' under the EU AI Act?
No. These are distinct categories. Prohibited practices are those the EU AI Act bans outright (subject to limited defined exceptions), and they cannot lawfully be placed on the market or used within scope. High-risk systems, by contrast, are permitted but subject to a set of obligations, such as risk management, data governance, technical documentation, human oversight, and conformity assessment, before and during their use. Treating high-risk systems as effectively banned, or assuming prohibited practices can be brought into compliance through controls, both misread the regulation's tiered structure. The precise scope of each tier should be checked against the current text, as the categories and any exceptions may be amended.
How does a provider determine whether an Annex III system qualifies for the Article 6(3) exemption?
The determination generally rests on whether the system poses a significant risk of harm to health, safety, or fundamental rights, taking into account the conditions set out in the Act. These conditions typically relate to whether the system performs a narrow procedural task, is intended to improve the result of a completed human activity, detects decision-making patterns without replacing or influencing human assessment without review, or performs a preparatory task. The profiling carve-out means a system performing profiling of natural persons cannot rely on the exemption. Providers claiming the exemption are generally expected to document their assessment and may need to register the system as required. Because application is fact-specific and guidance continues to evolve, providers should verify the current conditions and consult qualified professionals for their circumstances.
What obligations generally apply once a system is confirmed as high-risk?
For confirmed high-risk systems, the EU AI Act generally imposes a set of requirements that may include establishing a risk management system, applying data and data governance measures, maintaining technical documentation and record-keeping (logging), ensuring transparency and provision of information to deployers, enabling human oversight, and meeting standards of accuracy, robustness, and cybersecurity. Providers generally must undergo the applicable conformity assessment and comply with registration duties. The specific allocation of obligations varies by role, for example between providers and deployers. This is a qualitative summary; the exact requirements, thresholds, and procedures should be verified against the current official text.
Who bears responsibility for high-risk classification and compliance, the provider or the deployer?
Responsibility is allocated across roles, and the Act keeps these roles distinct. The provider (the entity that develops the system or has it developed and places it on the market under its own name) generally carries the primary burden for classification, conformity assessment, and most design-stage obligations. The deployer (the entity using the system under its authority in a professional context) has its own, generally narrower obligations, which may include operating the system in line with instructions, ensuring human oversight, and monitoring. Note that a deployer or other actor can, under certain conditions, be treated as a provider, for instance by substantially modifying a system or placing it under its own name. The precise triggers should be checked against the current text.
How do harmonised standards relate to demonstrating conformity for high-risk systems?
Harmonised standards are voluntary technical standards that, once cited in the Official Journal, can offer a presumption of conformity with corresponding requirements of the EU AI Act. Using them is not the only way to demonstrate compliance, and they do not themselves carry legal force, the binding obligations flow from the regulation. Conformity with a standard is distinct from certification, and meeting a standard does not by itself establish full legal compliance across all applicable requirements. Because relevant standards are still being developed and revised, and their citation status can change, readers should confirm which standards apply and their current status against authoritative sources rather than assuming permanence.
Common misconceptions
Any AI system whose use case is listed in Annex III is automatically high-risk.
This is no longer accurate under the final text (Regulation (EU) 2024/1689). The Article 6(3) filter mechanism allows an Annex III system to fall outside the high-risk category where it does not pose a significant risk of harm to health, safety, or fundamental rights, subject to the conditions set out in the Regulation. A key limit is that the exemption does not apply where the system performs profiling of natural persons. Providers should assess and document their reliance on this exception rather than assuming either automatic inclusion or exclusion.
'High-risk' means the system is prohibited.
High-risk classification and prohibition are distinct concepts under the Act. High-risk systems are permitted but subject to defined obligations and conformity assessment; the Regulation separately identifies certain practices that are prohibited. Treating 'high-risk' as a ban misstates the regulatory scheme.
Meeting a security or management standard such as ISO/IEC 27001 makes a system compliant as a high-risk AI system.
Voluntary standards are not the same as the binding obligations of the EU AI Act. Standards and future harmonised standards may support demonstrating conformity, but adherence to a standard does not by itself satisfy the Regulation's legal requirements, and certification against a standard is not equivalent to legal compliance or conformity assessment under the Act.
Best practices
Map each AI system against both classification routes (the harmonisation-legislation/product-safety route and the Annex III route) rather than assuming a single test determines status.
For Annex III use cases, conduct and document a structured assessment of whether the Article 6(3) filter mechanism applies, paying particular attention to the profiling limitation that removes eligibility for the exemption.
Retain evidence supporting any decision not to classify an Annex III system as high-risk, and confirm current documentation and registration expectations against the operative text before relying on the exemption.
Clearly allocate obligations by role (for example provider versus deployer), since duties differ and can shift depending on how a system is modified or deployed.
Keep security and quality-management standards distinct from the Regulation's legal requirements, using them as supporting tools rather than as substitutes for conformity assessment.
Verify all specific provisions, conditions, exemptions, and timelines against the current consolidated official text of Regulation (EU) 2024/1689 and any implementing, delegated, or harmonised standards, and seek professional judgment for application to particular circumstances.
